1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
/// Immutable policy runtime snapshot resolved at request entry.
///
/// Superset of all policy inputs needed across data generation + evaluation:
/// - Data gen: policy_address, policy_id, policy_cid, current_block, expire_block, policy_code_hash, wasm_cid
/// - Eval: policy_config, entrypoint, schema
///
/// Resolved ONCE per createTask commit, eliminating redundant sequential RPC reads.
use alloy::primitives::{Address, Bytes, B256};
use serde::{Deserialize, Serialize};
/// Immutable snapshot of all policy inputs for a single task evaluation.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct PolicyRuntime {
/// Source/target chain ID where policy contracts live.
pub chain_id: u64,
/// Policy client address.
pub policy_client: Address,
/// Content-addressed policy generation hash.
pub policy_id: B256,
/// Resolved policy contract address for this client.
pub policy_address: Address,
/// ABI-encoded policy parameters + expireAfter.
pub policy_config: crate::newton_policy::INewtonPolicy::PolicyConfig,
/// Rego entrypoint returned by policy contract.
pub entrypoint: String,
/// Schema JSON fetched from IPFS.
pub schema: serde_json::Value,
/// IPFS CID of the Rego policy source.
pub policy_cid: String,
/// On-chain keccak256(policy_bytes) for integrity binding.
pub policy_code_hash: B256,
/// Raw Rego module bytes fetched from `policy_cid`; keccak256(rego) must equal
/// `policy_code_hash`. Resolved eagerly (composition evaluates every policy in the
/// set before a response exists, so there is no later on-chain read to defer to).
pub rego: Bytes,
/// Block number at resolution time.
pub current_block: u32,
/// Expiration block = current_block + policy_config.expireAfter.
pub expire_block: u32,
/// IPFS CID of the WASM oracle plugin; empty for a pure-Rego policy.
pub wasm_cid: String,
/// IPFS CID of the secrets JSON schema (empty if no secrets).
pub secrets_schema_cid: String,
}