firstpass-core

The Firstpass domain contract — pure, with no I/O (no filesystem, network, clock, or env access). Everything here is deterministic so the audit hash chain and feature extraction are reproducible and testable in isolation; all I/O lives in firstpass-proxy.

This crate is the versioned thing every other component (gates, bandit, CLI, auditors) depends on. The serde field names on [Trace], [Config], [Verdict], and friends are the wire/audit contract — see each module for the "don't rename silently" rule.

Modules

• [verdict] — [Verdict], validated [Score], [GateResult] (the unit of ground truth).
• [features] — the versioned, privacy-preserving request [Features] vector.
• [trace] — the [Trace] audit record (SPEC §9.1).
• [hashchain] — tamper-evident, auditor-re-derivable hashing.
• [config] — declarative routing [Config] (SPEC §8.4).
• [cost] — model pricing and the counterfactual baseline.
• [conformal] — split-conformal risk control on the gate threshold (SPEC §10.1).
• [error] — the crate [Error] type.