Module object 

Core object primitives extracted from the monolith.

Structs

Action

An action records an operation between states.

ActionId

Unique identifier for an action (derived from content).

Agent

AI agent identity that performed changes on behalf of a principal.

Annotation

A stable logical annotation with revision history.

AnnotationRevision

A single revision of a logical annotation.

Attribution

Attribution for a change (who did it).

Blob

A blob stores raw file contents.

ChangeId

A stable change identifier (16 bytes / 128 bits).

ConflictSide

ConflictSymbol

ContentHash

A BLAKE3 content hash (32 bytes / 256 bits).

ContextBlob

A collection of logical annotations for a single target.

Discussion

DiscussionTurn

DiscussionsBlob

FileChange

A single file change with path and kind.

FileChangeSet

A collection of file changes with convenience accessors.

FileProvenance

LineSpan

OperationId

Origin

OriginSet

Principal

Human identity accountable for changes.

ProducerId

Identifies the producer that fired this signal. The version lets budgeting and signal-health surfaces age out signals from old producer versions without re-running computation — important when we tune a producer’s heuristics and want to compare apples to apples.

Redaction

A redaction declaration on a single blob in a single state.

RedactionsBlob

On-disk blob containing all redactions for a single blob hash. One file per redacted blob, encoded with rmp-serde — matches the ReviewSignaturesBlob pattern.

ReviewSignature

ReviewSignaturesBlob

RiskSignal

RiskSignalBlob

Top-level encoded blob. Stored under a [ContentHash] referenced from [State::risk_signals]. A blob with format_version > FORMAT_VERSION is rejected; older versions are read with the missing-field defaults.

Session

SessionSegment

SignalAnchor

Where in the change a signal fires. Symbol-level is preferred — symbols are durable across renames; line ranges are computed at fire time and drift as code is reformatted.

State

A state is an immutable snapshot with rich metadata.

StateSignature

Signature information for a state.

StructuredConflict

SymbolAnchor

Durable symbol-level anchor: a file path plus a symbol name. No line range — line numbers move under reformatting; symbols do not.

Tree

A tree represents a directory structure.

TreeEntry

A single entry in a tree.

Verification

Verification information for a state.

Enums

AnnotationKind

The canonical annotation taxonomy the product surfaces.

AnnotationScope

What part of a file an annotation targets.

AnnotationStatus

AnnotationVisibility

Visibility scope for an annotation. Determines which audiences see it on read paths and during bridge export.

ChangeIdParseError

Error parsing a ChangeId.

ChangeImportance

How important is this change for review.

ConflictError

ConflictResolution

ContextError

ContextTarget

A typed target for context entries.

DiffKind

Kind of file change.

DiscussionError

DiscussionResolution

EntryType

Entry type in a tree (blob or subtree).

FileMode

File mode for tree entries.

ModificationKind

What kind of modification was made to a file.

Operation

Type of operation performed.

OperationIdParseError

ProvenanceError

RedactionError

Errors produced while encoding/decoding redactions.

ReviewKind

Reviewer roles. New variants append at the tail; the wire format stays backwards compatible because serde emits the snake-case discriminant.

ReviewScope

Reviewer signed off on the whole change, or on a specific list of symbols.

ReviewSignatureError

RiskSignalError

RiskSignalKind

Why a signal fired. Variants are wire-stable; new variants are appended.

SemanticChange

A semantic change description.

SignatureStatus

Signature verification result.

Status

Lifecycle status of a state.

TreeError

Error type for tree operations.

Constants

MAX_REASON_LEN

Maximum length of RiskSignal::reason, in bytes.

REDACTION_SIGNING_PAYLOAD_VERSION_TAG

Stable byte prefix the signing payload begins with. Bumping this versions the payload format itself; old signatures with the old prefix continue to verify exactly as they did when written.

Functions

diff_trees

Collect all file changes between two trees.

generate_session_id

signing_payload

Build the deterministic byte payload that a ReviewSignature is computed over. Re-implementing this in another language (TypeScript, Python) must produce byte-identical output for verification to round-trip.

Type Aliases

DiscussionId

Stable opaque identifier for a discussion. Generated server-side at open time. We use a String rather than ChangeId to leave room for whatever id scheme the discussion service ends up choosing (likely a UUID).