chio-kernel 0.1.2

Chio runtime kernel: capability validation, guard evaluation, receipt signing
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106

//! The kernel enforces max_stream_total_bytes at the invoke seam.
#![allow(clippy::unwrap_used, clippy::expect_used)]

use chio_kernel::runtime::{
    enforce_stream_byte_limit, push_chunk_bounded, ToolCallChunk, ToolCallStream,
};
use chio_kernel::KernelError;

fn chunk(payload: &str) -> ToolCallChunk {
    ToolCallChunk {
        data: serde_json::json!({ "text": payload }),
    }
}

#[test]
fn oversized_stream_is_denied_with_overloaded_streambytes() {
    let stream = ToolCallStream {
        chunks: vec![chunk("aaaa"), chunk("bbbb"), chunk("cccc")],
    };
    // A tiny budget forces a breach.
    let err = enforce_stream_byte_limit(&stream, 8).unwrap_err();
    assert!(
        matches!(
            err,
            KernelError::Overloaded {
                resource: chio_kernel::OverloadResource::StreamBytes
            }
        ),
        "expected Overloaded {{ StreamBytes }}, got {err:?}"
    );
}

#[test]
fn within_budget_stream_is_allowed() {
    let stream = ToolCallStream {
        chunks: vec![chunk("x")],
    };
    assert!(
        enforce_stream_byte_limit(&stream, 0).is_ok(),
        "0 = unlimited"
    );
    assert!(enforce_stream_byte_limit(&stream, 1_000_000).is_ok());
}

#[test]
fn push_chunk_bounded_sheds_on_chunk_count_even_under_byte_cap() {
    // A byte-only bound lets a flood of tiny chunks that never trips
    // `max_total_bytes` grow the accumulator without bound. With a generous byte cap
    // but a chunk cap of 2, the 3rd tiny chunk must shed with
    // Overloaded { StreamChunks } rather than being retained.
    let mut acc: Vec<ToolCallChunk> = Vec::new();
    let mut running_bytes = 0u64;
    let byte_cap = 1_000_000u64; // never reached by tiny chunks
    let chunk_cap = 2u64;

    // First two tiny chunks fit within both caps.
    push_chunk_bounded(
        &mut acc,
        &mut running_bytes,
        chunk("a"),
        byte_cap,
        chunk_cap,
    )
    .unwrap();
    push_chunk_bounded(
        &mut acc,
        &mut running_bytes,
        chunk("b"),
        byte_cap,
        chunk_cap,
    )
    .unwrap();
    assert_eq!(acc.len(), 2);

    // The third chunk trips the chunk-count cap (bytes still far under the byte cap).
    let err = push_chunk_bounded(
        &mut acc,
        &mut running_bytes,
        chunk("c"),
        byte_cap,
        chunk_cap,
    )
    .unwrap_err();
    assert!(
        matches!(
            err,
            KernelError::Overloaded {
                resource: chio_kernel::OverloadResource::StreamChunks
            }
        ),
        "expected Overloaded {{ StreamChunks }}, got {err:?}"
    );
    // The accumulator stayed bounded at the cap: the rejected chunk was not retained.
    assert_eq!(acc.len(), 2, "rejected chunk must not grow the accumulator");
}

#[test]
fn push_chunk_bounded_chunk_cap_zero_is_unlimited() {
    // `0 = unlimited` for the chunk cap, mirroring the byte cap convention.
    let mut acc: Vec<ToolCallChunk> = Vec::new();
    let mut running_bytes = 0u64;
    for i in 0..1000 {
        push_chunk_bounded(&mut acc, &mut running_bytes, chunk(&format!("c{i}")), 0, 0).unwrap();
    }
    assert_eq!(acc.len(), 1000);
}