Module object

Source

Expand description

Core object primitives extracted from the monolith.

Modules§

check_evidence: Immutable check results and explicit policy-bound acknowledgements. A valid signature proves authorship; admitting hosts independently verify authority.
collaboration
manifest: Canonical manifest/object encodings and fsck rules for the immutable CAS.
original_boundary_acceptance: Explicit present-tense acceptance of immutable originals. This never claims that an expired or revoked original credential authorized a past action.
source_target: Immutable source identities and shared position projections.
source_target_map: Immutable source-target bindings. Forks share a root; updates copy one trie route, never the map or its referencing annotations. Addresses are ordinary blob hashes. A failed update may leave unreachable immutable nodes, but never returns a replacement root for the caller to install.
thread_authority_admission: Immutable hosted testimony about original authority at first durable receipt. This is separate from causal acceptance and from current review/landing policy.
thread_genesis_admission: Hosted testimony about an original account-owned Thread genesis. This proves first admission; it grants neither current disclosure nor account enrollment.
thread_replication: Portable Thread identity and immutable replication operations. Source and discussion causality have separate graphs so selective sharing is closed.
tree_walk: Tree integrity walking — single traversal for reference and content checks.

Structs§

Action: An action records an operation between states.
ActionId: Unique identifier for an action (derived from content).
Agent: AI agent identity that performed changes on behalf of a principal.
AnnotatedTag: A byte-exact annotated Git tag object.
AnnotatedTagMarker: The native marker that owns an outer annotated-tag object.
Annotation: A stable logical annotation with revision history.
AnnotationDecimal
AnnotationQuery
AnnotationRevision: A single revision of a logical annotation.
AnnotationSourceReference
Attribution: Attribution for a change (who did it).
BindingDelta: Content-addressed state binding delta.
Blob: A blob stores raw file contents.
BranchCreatedV1: Branch creation operation body.
BuiltManifest: The output of a build: a root address plus every node byte string it reaches, deduplicated by address.
ByteSpan: Half-open byte range in the source blob. Spans are provenance metadata: they are encoded for navigation, but excluded from semantic digests.
BytesTreeSource: In-memory tree body, used by tests and stores that already hold the bytes.
CanonicalBody: Cached canonical MessagePack body for a content-addressed value.
ChangeId: A rewrite-stable logical change identifier (16 bytes / 128 bits).
ChangeLineage
CollabOpId
CollaborationActor
CollaborationIdempotencyKey
CollaborationMetadata
CollaborationOperationEnvelope
CollaborationScope
CollaborationSourceAnchor
ConflictRange: Zero-based, half-open line range (start_line..end_line).
ConflictRegion: One independently addressable conflict region in a file.
ConflictSide: Provenance and integrity information for one side of a conflict region.
ContentHash: A BLAKE3 content hash (32 bytes / 256 bits).
ContextBlob: A collection of logical annotations for a single target.
ContextProvenance: Evidence captured by the authoring context command. This remains inside the signed native operation even when a hosted view does not project every field.
ContextRevision
ContextSuggestion
CursorMovedV1: Cursor movement operation body.
DecodedCollaborationOperation
Discussion
DiscussionRecordId
DiscussionReference: One durable entity reference embedded in a discussion turn.
DiscussionTurn
DiscussionTurnV1
DiscussionsBlob
EntryRedactions: Explicit salted entry commitments hidden from one admitted reader.
EntryVisibility: The per-state entry-visibility sidecar: the set of per-entry tier overrides covering the trees reachable from one state, keyed by that state’s ChangeId.
EntryVisibilityEntry: One per-entry visibility override within a state’s trees.
FileBindingDelta: Complete replacement edges for one source file in a binding delta.
FileChange: A single file change with path and kind.
FileChangeSet: A collection of file changes with convenience accessors.
FileProvenance
FileTreeSource: File-backed tree body. Sequential reads seek per frame; resume at ordinal > 0 is refused because a path is not a content-address proof.
FsckFinding: One violation: the rule, where it was found, and a human-readable detail.
FsckOptions: What fsck should check beyond node structure.
FsckReport: Every finding from one fsck run.
HeddleNote: Portable Heddle metadata attached to a projected Git commit.
HostedCollaborationSet
ImportBinding: One name introduced by an import, in canonical source order.
ImportEntry: One unresolved, source-local import record.
KeyBinding: A signing key’s role within an identity’s provenance chain.
KeyBindingRegistry: Versioned, authority-signed checkpoint of the key-binding registry.
LegacyDiscussionId
LegacySourceLocator
LineSpan
ManifestBinding: An immutable (spool, facet, owner) -> content_root binding.
ManifestKey: The trie key: (kind, object_hash). Ordering is the canonical plan order — kind first, then the 32 hash bytes lexicographically.
ManifestObject: One immutable content object named by a manifest leaf.
MarkerName: Name of a heddle marker (tag-like construct).
MaterializedDiscussion
MaterializedRepositoryCollaboration
NativeToolCallRefV1: Native harness tool-call identity.
NoteAttribution
OccurrenceEntry: One unresolved symbol occurrence, numbered in source order.
OmittedBreakdown
OperationId
Origin
OriginSet
PackRangeAudit: What to check a pack claim against, beyond its own structure.
PackRangeClaim: One coalesced physical range read, plus the partition of authorized records it covers.
PackRecord: One object’s physical slice of a pack.
PartialTree: A redaction projection of a V4 Tree: visible entries keep their preimage + salt; redacted entries are reduced to their opaque 32-byte leaf hash. A PartialTree reconstructs the SAME Merkle root as the full tree, so a state that commits to the full tree still verifies against the projection.
Principal: Human identity accountable for changes.
ProducerId: Identifies the producer that fired this signal. The version lets budgeting and signal-health surfaces age out signals from old producer versions without re-running computation — important when we tune a producer’s heuristics and want to compare apples to apples.
PurgeEvidence: Separately signed evidence authorizing irreversible byte deletion.
Redaction: A redaction declaration on a single blob in a single state.
RedactionsBlob: On-disk blob containing all redactions for a single blob hash. One file per redacted blob, encoded with rmp-serde — matches the ReviewSignaturesBlob pattern.
ReservedRefNameError: Rejection when a user thread or marker name occupies heddle/.
ResolvedSemanticEdge: A resolved occurrence-to-definition edge.
ResolvedTreeTarget: Successful resolution of a path within a tree.
ReverseDependencyIndex: Content-addressed file → importers map for one state.
ReviewSignature
ReviewSignaturesBlob
RiskSignal
RiskSignalBlob: Top-level encoded blob referenced by a risk-signal state attachment.
Scope: Checkout/lane scope identifier for scoped operations.
ScopeEntry: A deterministic source-local scope. local_id is assigned in preorder.
SemanticFileFacts: Canonical source-local facts assembled into a SemanticFileNode.
SemanticFileNode: The per-file semantic node: deterministic source-local facts extracted from one source blob plus their reformat-stable digest.
SemanticGraphQueryRequest: weft#451 Tier-2 request body. Hosted RPC names remain residual in weft.
SemanticGraphQueryResponse: weft#451 Tier-2 response body. index_present is false when the state has no attached semantic index; the query then returns empty collections and never computes one.
SemanticGraphRef: One persisted reference to a definition, reconstructed without parsing.
SemanticIndexRoot: Root of a state’s semantic index. Attached to a state via StateAttachmentBody::SemanticIndex.
SemanticTreeEntry: One child edge of a SemanticTreeNode.
SemanticTreeNode: A semantic directory node mirroring a source Tree.
Session
SessionSegment
SignalAnchor: Where in the change a signal fires. Symbol-level is preferred — symbols are durable across renames; line ranges are computed at fire time and drift as code is reformatted.
SignalCounts
SourceHistoryLaws: Proof that a root is Source History and may be checked out, landed, or visited by Git Projection.
SpoolId
SpoolIdParseError
State: Immutable source-history state. state_id is recomputed from every encoded field; mutable repository metadata lives in StateAttachment objects.
StateAttachment
StateAttachmentId
StateId: Content-addressed identity of an immutable state core.
StateSignature: Signature information for a state.
StateVisibility: A visibility-tier declaration on a single state.
StateVisibilityBlob: On-disk blob containing all visibility records for a single state. One file per state, encoded with rmp-serde — mirrors the RedactionsBlob sidecar pattern.
StructuredConflict
SuggestionInputs
SuggestionSignal
SymbolAnchor: Durable symbol-level anchor: a file path plus a symbol name. No line range — line numbers move under reformatting; symbols do not.
SymbolEntry: One symbol defined in a source file.
SyntheticFrontierName: Type-distinct name of a synthetic frontier root.
ThreadName: Name of a heddle thread (branch-like construct).
TimelineBranchId
TimelineOperationEnvelope: A v1 timeline operation envelope.
TimelineOperationId: Content-addressed identifier for a timeline operation envelope.
TimelineStepId
TimelineToolPayloadMetadata: Scrubbed metadata for native tool payloads.
ToolCallFinishedV1: Tool-call finish operation body.
ToolCallStartedV1: Tool-call start operation body.
Tree: A complete tree with its encoding scheme and per-entry salts kept together. Use Self::from_entries_salted_v4 to supply explicit salts for a new tree; mutations through Self::insert maintain the selected scheme.
TreeDeltaHeader: Parsed HDC1 header, including its bounded first-entry and first-100 porch.
TreeEntry
TreeEntryReader: Incremental HTR4 reader. Does not materialize a full Vec<TreeEntry>.
TreeHeader: Parsed HTR4 header. Counts and payload length are known before any entry.
TreePage: One bounded page of decoded entries plus the cursor after the last entry.
TreePageLimits: Caller-sized page budget. Zero limits fail closed.
TreeResumeCursor: Persistable entry-boundary cursor bound to a tree id and encoding version.
Verification: Verification information for a state.

Enums§

AnnotatedTagError
AnnotationAnchorStatus: Snapshot-time resolution state for a file-backed context annotation.
AnnotationComparison
AnnotationKind: The canonical annotation taxonomy the product surfaces.
AnnotationScope: What part of a file an annotation targets.
AnnotationStatus
AnnotationTag
AnnotationTagPredicate
AnnotationValue
AudienceParseError: Error from AudienceTier::from_str. The string form is what the CLI’s --audience flag accepts; bad input here is a usage error.
AudienceTier: Audience reading the annotation set. Matches the CLI’s --audience <internal|public|team:NAME> flag and the web’s payload- shaping context.
AuthoredSourceRequirement: A distinct source permission required to emit an authored anchor or tag. Revision requirements include the original path, but not line coordinates: entry visibility is a property of the file, independent of its referrers.
ChangeIdParseError: Error parsing a ChangeId.
ChangeImportance: How important is this change for review.
ChangeLineageKind
CollabOpIdParseError
CollaborationAnchor
CollaborationAnchorStatus
CollaborationCodecError
CollaborationMention
CollaborationOperationBodyV1
CollaborationRecordKind
CollaborationResolution
CollaborationRevision
ConflictError
ContextError
ContextSuggestionTier
ContextTarget: A typed target for context entries.
DiffKind: Kind of file change.
DiscussionError
DiscussionRecordIdParseError
DiscussionReferenceKind: Kind of entity named by a DiscussionReference.
DiscussionResolution
EntryType
EntryVisibilityError: Errors produced while encoding/decoding an EntryVisibility sidecar.
FacetKind: Durable facet a repository fact belongs to.
FileMode
FsckRule: The named integrity rules fsck enforces.
ImportKindTag: Source-level import form. Resolution to repository paths happens later.
KeyBindingError
KeyRole: Capability granted to a key by an authority-signed registry checkpoint.
LeafPolicy: How a tree-path walk classifies and materializes the terminal entry.
LegacyDiscussionResolutionV1
ManifestBuildError
ManifestFacet: The four uniform spool facets from weft #358, plus an open named tail.
ManifestNode
ManifestObjectKind: The object types a manifest leaf may name.
ManifestOwnerKind: What a content root is bound to.
ModificationKind: What kind of modification was made to a file.
OccurrenceRole: Role played by a source-level symbol occurrence.
OpenedTreeBody: Store-facing handle for a seekable or lazily generated tree body.
Operation: Type of operation performed.
OperationIdParseError
PartialTreeLeaf: One leaf of a PartialTree: either fully visible (carrying its entry and salt, so its leaf hash is recomputable) or redacted to an opaque 32-byte leaf hash (salt, name, and target all withheld).
ProvenanceError
RedactionError: Errors produced while encoding/decoding redactions.
ReviewKind: Reviewer roles. New variants append at the tail; the wire format stays backwards compatible because serde emits the snake-case discriminant.
ReviewScope: Reviewer signed off on the whole change, or on a specific list of symbols.
ReviewSignatureError
RiskSignalError
RiskSignalKind: Why a signal fired. Variants are wire-stable; new variants are appended.
ScopeKind: Source-local lexical scope classification.
SemanticChange: A semantic change description.
SemanticEdgeKind: The relationship represented by a resolved source occurrence.
SemanticEntryKind: The kind of a SemanticTreeEntry’s target.
SemanticGraphQueryKind: Graph primitive selected by heddle semantic refs and the weft#451 wire.
SemanticIndexError
SignatureStatus: Signature verification result.
StalenessStatus: Result of checking an annotation’s freshness against current code.
StateAttachmentBody
StateAttachmentKind: The kind of a StateAttachmentBody, with the payload projected away.
StateIdParseError
StateVisibilityError: Errors produced while encoding/decoding/validating state visibility.
Status: Lifecycle status of a state.
SymbolKindTag: Durable symbol classification shared by semantic extraction, indexes, and review payloads so types, traits, enums, modules and the rest remain first-class without conversion tables.
SymbolNamespace: Namespace in which a binding or occurrence participates.
SyntheticFrontierNameError: Why a synthetic frontier name could not be built or parsed.
TimelineBranchReason: Why a timeline branch was created.
TimelineCodecError: Timeline operation codec error.
TimelineCursorMoveReason: Why the timeline cursor moved.
TimelineLabel: Safety labels attached to timeline operations.
TimelineOperationBodyV1: V1 timeline operation body variants.
TimelineOperationIdParseError: Error parsing a timeline operation id.
TimelineOperationKind: Explicit timeline operation kind stored in every operation envelope.
TimelineToolCallStatus: Tool-call terminal status.
TreeBodyIntegrity: How a tree body may be trusted for content-address verification.
TreeDecodeError
TreeDeltaOp: A cumulative HDC1 operation against a materialized anchor.
TreeEntryTarget
TreeError
TreeIntegrityEvent: Events emitted while walking reachable trees for integrity checks.
TreePathResolveError: Errors surfaced by resolve_tree_path that callers map to their own messages.
TreeScheme: How a Tree’s content id is computed. The scheme is part of the in-memory value, so Tree::hash() is a pure function of (scheme, salts, entries) and the value determines the id at every call site (MF-4).
TreeStreamError: Failure while streaming or range-resuming a canonical tree.
VisibilityTier: Content-side visibility tier. Shared by annotations, discussions, and states so the per-commit visibility tiers and annotation/discussion visibility draw from one vocabulary rather than parallel enums.

Constants§

COLLABORATION_OPERATION_SCHEMA_VERSION
CONTEXT_FORMAT
GIT_SYNTHETIC_FRONTIER_PREFIX: Git-side prefix for the same roots. Disjoint from refs/heads/.
HIGH_SUGGESTION_THRESHOLD
KEY_BINDING_REGISTRY_SIGNING_PAYLOAD_VERSION_TAG: Domain separator for authority signatures over registry checkpoints.
KEY_BINDING_SIGNING_PAYLOAD_VERSION_TAG: Domain separator for signatures that authorize a KeyBinding.
MAJOR_REWRITE_THRESHOLD_PCT
MAX_REASON_LEN: Maximum length of RiskSignal::reason, in bytes.
MEDIUM_SUGGESTION_THRESHOLD
PURGE_SIGNING_PAYLOAD_VERSION_TAG: Domain separator for a destructive purge authorization.
REDACTION_SIGNING_PAYLOAD_VERSION_TAG: Stable byte prefix the signing payload begins with. Bumping this invalidates signatures written with an older prefix unless verification also gains explicit version dispatch. Version 3 separates reversible redaction authority from destructive purge authority.
RESERVED_REF_SEGMENT: First path segment reserved for Heddle-internal refs.
STATE_VISIBILITY_SIGNING_PAYLOAD_VERSION_TAG: Stable byte prefix the signing payload begins with. Bumping this versions the payload format itself; old signatures with the old prefix continue to verify exactly as they did when written.
SUGGESTION_WINDOW
SYNTHETIC_FRONTIER_PREFIX: Wire and local-store prefix for synthetic frontier roots.
TIMELINE_OPERATION_SCHEMA_VERSION: Current timeline operation schema version.
TREE_BLOCK_ENCODING_VERSION: Block-compressed HTR4 variant. Readers accept both v4 and v5.
TREE_BLOCK_MIN_ENTRIES: Small real trees do not repay block/index overhead.
TREE_CANONICAL_MAGIC: Frame discriminator for a single canonical tree.
TREE_DELTA_ANCHOR_INTERVAL: A lineage is refreshed after 127 delta descendants.
TREE_DELTA_ENCODING_VERSION: Current HDC1 body version.
TREE_DELTA_HEADER_LEN: Fixed HDC1 header from the HTR4 radical spike.
TREE_DELTA_MAGIC: One-hop cumulative delta against a materialized tree anchor.
TREE_DELTA_MAX_OPS: Cumulative deltas above this operation count become anchors.
TREE_ENCODING_VERSION: Durable encoding version stored in every HTR4 header and resume cursor.
TREE_HEADER_LEN: Fixed header size: magic + version + tree id + counts.
TREE_LEAN_ENCODING_VERSION: Cursor version used by the HLR1 streaming reader.
TREE_LEAN_MAGIC: Lean hot-path tree anchor. The object key supplies the omitted tree hash.
TREE_REDACTED_ENCODING_VERSION: Body version byte for a redacted V4 projection (HRT1).
TREE_REDACTED_HEADER_LEN: Fixed HRT1 header: magic + version + declared root + entry count.
TREE_REDACTED_MAGIC: Redacted V4 projection — serve-only. Visible entries carry salt + frame; redacted entries carry only their opaque 32-byte leaf hash. NEVER packed.
TREE_SALTED_ENCODING_VERSION: Body version byte for a salted V4 canonical body (HSR1).
TREE_SALTED_MAGIC: Salted redactable V4 tree — the canonical stored form for V4. Full custody: carries every entry’s 32-byte salt inline. Rides loose objects and packs.

Traits§

ManifestNodeSource: Read access to canonical manifest node bytes, keyed by node address.
ObjectSource: Read-only object access needed by object graph walkers.
TreeByteSource: Random-access source of an uncompressed canonical tree body.

Functions§

annotation_status_for_source: Check an annotation’s staleness against already-loaded source bytes.
annotation_status_for_source_with_symbol_resolver: Check an annotation’s staleness with an injected symbol resolver.
apply_tree_delta: Apply a sorted cumulative delta to its materialized anchor.
authored_review_requirements: Source predicates of a signed review, independent of its current display location. The source and target scopes are explicit because a fork review can compare a source Thread with its independently shared parent Thread.
authored_source_requirements: Normalize the source dependencies of a signed anchor and its tags.
build_manifest: Build the canonical manifest for objects.
compute_dir_semantic_digest: Compute a directory node’s semantic_digest over its entries.
compute_file_scaffold_hash: Hash the file’s scaffold: the residual non-definition top-level token stream (every leaf under the file root not covered by an extracted symbol’s span). This is what binds use-decl swaps, impl Trait headers, attribute edits, macro_rules! bodies and definition-free files (re-export-only libs, top-level statements) into the file digest — semantic content that lives outside any extracted symbol.
compute_file_semantic_digest: Compute a file node’s semantic_digest over its scaffold and canonical source-local facts. Spans are deliberately excluded from this identity.
compute_symbol_semantic_hash: Compute a symbol’s normalization-stable semantic_hash.
decode_header: Parse the fixed HTR4 header. Does not read entry frames.
decode_lean_prefix: Decode at most wanted entries from the compact HLR1 porch. The returned byte count is the exact prefix a file-backed reader had to consume.
decode_redacted_projection: Decode an HRT1 redacted projection and verify it reconstructs its declared root.
decode_salted_v4: Decode a complete HSR1 salted-canonical body and verify its declared root.
decode_tree_delta: Reconstruct an HDC1 tree from exactly one materialized anchor and validate the result against its external object key.
decode_tree_delta_header: Parse and validate the fixed HDC1 header without reading its operations.
decode_tree_delta_header_prefix: Parse an HDC1 header from a bounded prefix while validating its offsets against the complete file length.
decode_tree_delta_ops: Decode wanted HDC1 operations. Used by bounded porch reads as well as full reconstruction.
decode_tree_delta_ops_prefix: Decode an HDC1 operation porch without transferring the rest of the body.
diff_trees: Collect all file changes between two trees.
diff_trees_visit: Diff two trees with internal iteration, invoking visitor for each FileChange in traversal order.
encode_lean_entry: Append one HLR1 entry using previous_name as its prefix-compression base. Store readers use this to expose a lazily merged HDC1 body as HLR1 bytes.
encode_redacted_projection: Encode a redacted V4 projection as HRT1 (serve-only). Visible frames are written first in strict ascending name order; redacted leaf hashes follow in strict ascending order.
encode_tree_delta: Encode a one-hop HDC1 body against anchor.
expand_manifest: Expand a manifest root into its object set, in canonical plan-key order.
extract_line_range: Extract bytes for a line range from source content.
fsck_manifest: Check a manifest graph rooted at root for structure and digests only.
fsck_manifest_with: Check a manifest graph rooted at root, with optional object and reachability checks.
fsck_pack_range: Check that a coalesced pack range is offset-canonical, gap-free, and — when the caller supplies them — digest-correct and manifest-covered.
generate_discussion_id
generate_session_id
is_canonical_tree: True when bytes begin with the canonical tree discriminator.
is_delta_tree: True when bytes contain an anchor-relative delta.
is_lean_tree: True when bytes contain a lean materialized anchor.
is_redacted_tree: True when bytes contain a redacted V4 projection (HRT1). These are serve-only and must be rejected by every pack/stream reader.
is_reserved_heddle_namespace: True when name occupies the reserved heddle/ namespace.
is_salted_tree: True when bytes contain a salted V4 canonical body (HSR1).
is_streamable_tree: True when the body can be paged directly without reconstruction.
materialize_repository_collaboration
parse_commit_extension_headers: Parse the extension headers from a raw git commit object’s content bytes (the bytes git cat-file commit <sha> prints — i.e. gix’s Commit::data), in their exact on-the-wire order, ready to store in State::extra_headers.
resolve_current_symbol: Resolve a symbol using the stored line range.
resolve_tree_path: Walk path from root through nested subtrees and resolve the terminal entry according to policy.
score_suggestions
signing_payload: Build the deterministic byte payload that a ReviewSignature is computed over. Re-implementing this in another language (TypeScript, Python) must produce byte-identical output for verification to round-trip.
split_path: Split a repository-relative path into its first component and the remainder.
tree_delta: Compute the sorted cumulative edit from anchor to current.
validate_annotation_tags
validate_tree_entry_name
visible: Single source-of-truth for the visibility×audience mapping. Pure over the two tier enums, so every consumer (annotation filtering, bridge export gating) shares the exact same rules — drift between consumers would be invisible at the call site and catastrophic for the Git projection export footer.
walk_tree_integrity: Walk all trees reachable from roots, deduplicating visited trees.

Type Aliases§

DiscussionId: Stable opaque identifier for a discussion. Generated server-side at open time. We use a String rather than ChangeId to leave room for whatever id scheme the discussion service ends up choosing (likely a UUID).

Module object

Module object Copy item path

Modules§

Structs§

Enums§

Constants§

Traits§

Functions§

Type Aliases§

Module object