pub struct ContextQueryResult {
pub frames: Vec<ContextFrame>,
pub truncated: bool,
pub dropped_estimate: Option<u32>,
pub frame_attestations: Vec<FrameAttestation>,
pub result_attestation: Option<ProvenanceAttestation>,
}Expand description
The response to a context/query call.
§Where an attestation rides
frame_attestations and
result_attestation are the wire home of
SPEC.md §6.5’s evidence (§6.5.5, F11–F13). They sit on the result rather
than on the frames envelope because an attestation is a property of the
answer, exactly like truncated: the envelope carries only what the
transport needs (type, the correlation id), and an in-process provider
that returns a ContextQueryResult with no envelope at all must still be
able to sign what it serves.
Both are optional and both are omitted when empty, so an unsigned answer is byte-identical to one from a provider written before this existed.
Fields§
§frames: Vec<ContextFrame>§truncated: boolTrue if the provider had more candidates than fit the budget.
dropped_estimate: Option<u32>§frame_attestations: Vec<FrameAttestation>Detached per-frame evidence, one entry per attested frame
(SPEC.md §6.5.5). Never a parallel array: each entry names the
FrameId it covers in full.
result_attestation: Option<ProvenanceAttestation>One signature over the whole answer: a detached attestation whose
signed_commitment is the §6.5.3 Merkle root over the commitments of
exactly the frames in frames, in canonical order.
Implementations§
Source§impl ContextQueryResult
impl ContextQueryResult
Sourcepub fn unattested(
frames: Vec<ContextFrame>,
truncated: bool,
dropped_estimate: Option<u32>,
) -> Self
pub fn unattested( frames: Vec<ContextFrame>, truncated: bool, dropped_estimate: Option<u32>, ) -> Self
An answer carrying no detached evidence — what every provider that does not sign returns.
It exists so that adding frame_attestations
and result_attestation to this struct is
not a rewrite for a caller that never signs anything. A struct literal
naming the first three fields stopped compiling when those two landed;
this constructor, and ..Default::default() on a literal, are the two
ways to keep such a caller to a one-line change.
Sourcepub fn total_token_cost(&self) -> u64
pub fn total_token_cost(&self) -> u64
Sum of token_cost across returned frames — must never exceed the
query’s max_tokens for a conforming provider (checked in
contextgraph-conformance, phase 3; this is the cheap client-side sanity
check any host can run today).
pub fn respects_budget(&self, max_tokens: u32) -> bool
Sourcepub fn respects_frame_limit(&self, max_frames: u32) -> bool
pub fn respects_frame_limit(&self, max_frames: u32) -> bool
Whether the provider honored the query’s max_frames cap
(SPEC.md §B4).
max_frames was part of the query contract from the beginning and was
audited by nothing: a provider returning ten thousand one-token frames
against max_frames: 8 passed every check. Frame count is a real cost
— each frame carries a title, a citation label, and rendering chrome the
token budget does not capture.
Sourcepub fn frames_with_dishonest_cost(&self) -> Vec<&str>
pub fn frames_with_dishonest_cost(&self) -> Vec<&str>
Frames whose declared token_cost does not match the canonical count
for their content (SPEC.md §B3).
Returns ids so a host’s audit report can name the offending frames rather than only the provider.
Sourcepub fn canonical_token_cost(&self) -> u64
pub fn canonical_token_cost(&self) -> u64
The sum of the canonical costs of the returned frames — what the provider’s frames actually cost, as opposed to what it claimed.
Sourcepub fn is_attested(&self) -> bool
pub fn is_attested(&self) -> bool
Whether this answer carries any detached evidence at all
(SPEC.md §6.5.5).
Sourcepub fn attestation_for(&self, frame: &FrameId) -> Option<&FrameAttestation>
pub fn attestation_for(&self, frame: &FrameId) -> Option<&FrameAttestation>
The attestation entry covering one frame identity, if the provider sent one.
Matching is on the whole (provider_id, frame_id, content_digest)
triple, never on the frame id alone: two frames sharing an id but not a
digest are different bytes, and handing the first one’s evidence to the
second is the substitution the identity binding exists to prevent
(SPEC.md §6.5.2).
Sourcepub fn orphaned_attestations(&self, provider_id: &str) -> Vec<&FrameId>
pub fn orphaned_attestations(&self, provider_id: &str) -> Vec<&FrameId>
Attestation entries naming a frame this result does not carry
(SPEC.md §6.5.5, F11).
An entry with no frame beside it is evidence for something the host was never shown. It is not merely useless: a host that counted entries rather than matching them would report an answer as more thoroughly attested than it is. Returned as identities so a report can name them.
Trait Implementations§
Source§impl Clone for ContextQueryResult
impl Clone for ContextQueryResult
Source§fn clone(&self) -> ContextQueryResult
fn clone(&self) -> ContextQueryResult
1.0.0 (const: unstable) · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source. Read more