Struct AppState 

pub struct AppState {
    pub config: Arc<ProxyConfig>,
    pub http: Client,
    pub providers: ProviderRegistry,
    pub gate_health: Arc<GateHealthRegistry>,
    pub shadow_ledger: Arc<ShadowLedger>,
    pub guardrails: Arc<GuardrailRegistry>,
    pub traces: TraceSender,
    pub adaptive: Option<Arc<Mutex<AdaptiveConformal>>>,
    pub bandit: Option<Arc<Mutex<StartRungBandit>>>,
    pub predictor: Option<Arc<Mutex<PassPredictor>>>,
    pub tenant_rate_limiter: Option<Arc<DefaultKeyedRateLimiter<String>>>,
    pub spill: Option<SpillHandle>,
}

Shared state handed to every request handler. Cheap to clone: an Arced config, a pooled HTTP client, and a bounded channel sender.

Fields

config: Arc<ProxyConfig>

Static proxy configuration.

http: Client

Shared, connection-pooled HTTP client used to call upstream (observe passthrough).

providers: ProviderRegistry

Multi-provider registry used by the enforce-mode escalation engine.

gate_health: Arc<GateHealthRegistry>

Per-gate error budgets (auto-disable), shared across requests.

shadow_ledger: Arc<ShadowLedger>

Per-(tenant, route) shadow spend for the current UTC day (ADR 0009 D2). Shadow makes real model calls, so the daily ceiling is enforced through this rather than trusted.

guardrails: Arc<GuardrailRegistry>

Per-(tenant, route) guardrail state (ADR 0009 D3): the trailing window of resolved outcomes and whether a route is currently demoted.

traces: TraceSender

Fire-and-forget sender to the background trace writer.

adaptive: Option<Arc<Mutex<AdaptiveConformal>>>

Optional online/adaptive conformal serve threshold (Gibbs-Candès ACI). None = fixed serve_threshold from config (default). When present, /v1/feedback nudges it live and the enforce path reads its current value per request — the reactive, self-tuning loop.

bandit: Option<Arc<Mutex<StartRungBandit>>>

Optional UCB1 start-rung bandit (predict-to-start, verify-to-serve). None (default) = start every request at rung 0, byte-identical to today. When present, handle_enforce queries it for a predicted start rung per request and feeds back gate verdicts for online learning — all in-memory, per-process.

predictor: Option<Arc<Mutex<PassPredictor>>>

Optional per-query gate-pass predictor (ADR 0008 Phase 2). None (default) = no prediction, byte-identical to today. When Some, handle_enforce records its P(gate-pass) for the start rung on the receipt in shadow (never acted on) and feeds this request’s attempts back for online learning — in-memory, per-process, warm- started from receipts on boot.

tenant_rate_limiter: Option<Arc<DefaultKeyedRateLimiter<String>>>

Per-tenant request rate limiter (ADR 0004 §D6). None (the default) disables rate limiting entirely — set via build_tenant_rate_limiter from ProxyConfig::tenant_rate_per_sec.

spill: Option<SpillHandle>

Durable-receipts spill handle (FIRSTPASS_RECEIPTS=durable). None in best-effort mode (the default) — behavior is byte-identical to before. When Some, offer_trace appends to <db_path>.spill.jsonl on channel-full instead of dropping.

Trait Implementations

impl Clone for AppState

fn clone(&self) -> AppState

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AppState

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.