Struct NamespaceToken 

pub struct NamespaceToken { /* private fields */ }

Authorization proof that a caller is permitted to access a specific namespace.

Created by crate::VerbRegistry::dispatch after the gate approves the request. The sealed inner field prevents external code from constructing a token without going through the authorization path.

The namespace field is the write namespace: all records created via this token land in that namespace. visible is the read visibility set: list/search/get operations will return records from any namespace in this set. The write namespace is always a member of the visible set.

Single-namespace behaviour (backward-compatible default): visible contains exactly [namespace] — identical to the old strict-equality checks.

Implementations

impl NamespaceToken

pub fn namespace(&self) -> &Namespace

Return the write namespace this token authorises.

All records created via this token land in this namespace.

pub fn visible_namespaces(&self) -> &[Namespace]

Return the read-visibility set.

List, search, and get operations must accept records whose namespace is a member of this set. The write namespace is always included.

pub fn visible_namespace_strs(&self) -> Vec<&str>

Return a deduplicated list of visible namespace strings (borrowed).

Convenience for passing directly to storage layer filters.

pub fn actor(&self) -> &ActorRef

Return the actor reference embedded in this token.

pub fn with_namespace(&self, ns: Namespace) -> Self

Return a new token with the same actor but a different namespace.

The visible set is replaced with [ns] — the minted token has namespace = ns and visible = [ns]. This is a full read+write token for ns: public runtime APIs (list_notes, update_note, delete_note, etc.) accept it and will operate on ns. It is NOT a type-enforced write-only or append-only capability. This is a capability-transfer primitive, not a policy gate: the caller is responsible for enforcing any ACL check before calling this method and for using the minted token only in the intended narrow scope (e.g. a single create_note call).

Callers today:

• khive-pack-memory FTS fanout: iterates token’s own visible set; no escalation.
• khive-pack-comm inbound delivery: mints a token for the recipient ns, gated by actor.allowed_outbound_namespaces allowlist check immediately before, and uses it for exactly one create_note call (append-only by convention, not by type enforcement).

Under a security model (cloud, mutual auth), replace this call pattern with a type-enforced append-only capability or a comm.ingest Subhandler dispatch (see ADR-056/ADR-053) that goes through the Gate.

Trait Implementations

impl Clone for NamespaceToken

fn clone(&self) -> NamespaceToken

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NamespaceToken

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.