Struct RunOptions 

pub struct RunOptions {
    pub stop: CancellationToken,
    pub run_id: Option<String>,
    pub device_id: String,
    pub platform: Option<String>,
    pub vision: Option<Arc<dyn VisionVerifier>>,
    pub subflows: BTreeMap<Hash, FlowIR>,
    pub supervise: Option<SupervisePolicy>,
    pub clock: Option<Arc<dyn Fn() -> u64 + Send + Sync>>,
    pub stop_at: Option<String>,
    pub stop_after: Option<String>,
}

Options of Runner::run.

Fields

stop: CancellationToken

Cooperative stop token, honored at step boundaries (runSuspended → RunOutcome::Suspended).

run_id: Option<String>

Explicit run id; a UUIDv4 is generated when absent.

device_id: String

The bound device (checkpoint hard binding; also env.deviceId).

platform: Option<String>

The device platform for env.platform, when known (comes from the lockfile at the assembly layer; the SPI attestation does not carry it).

vision: Option<Arc<dyn VisionVerifier>>

The vision verifier consulted by vision verify-chain tails. None is equivalent to pointlock_vision::StubVisionVerifier: the vision channel cannot complete and reports "vision verifier not configured" — the chain degrades honestly toward unknown (principle 4).

subflows: BTreeMap<Hash, FlowIR>

The resolved subflow registry keyed by irHash (07 §1.3): every callee the flow’s subflows table pins must be present; entries self-verify at load. Empty for flows without subflows.

supervise: Option<SupervisePolicy>

This segment’s supervision policy (R13, spine §6.9): recorded in runStarted.supervisePolicy (explicitly null when absent) and gates action-step dispatch (mutating gates mutating steps, all every action step). Per segment, never inherited.

clock: Option<Arc<dyn Fn() -> u64 + Send + Sync>>

Injectable wall clock for human-deadline computation and lazy timeout settlement (tests); None uses the system clock.

stop_at: Option<String>

Breakpoint: suspend BEFORE entering the first step instance that matches this target (pointlock run --stop-at). A target is a run path — canonical (flow@hash8/each[1]/tap) or relative to the root flow (each[1]/tap) — or a bare step id, meaning the first instance whose step id matches. Per invocation, never persisted: the suspension is recorded honestly (runSuspended.reason = "stopped at breakpoint --stop-at <canonical path>") and a later resume continues past it unless the option is given again. A target that never matches is not an error. Only a genuine entry matches: a container whose span the previous segment left open (the run was suspended inside it) is continued on resume, not entered — its stepEntered is already on the ledger — so naming it as the target of the resuming segment does not stop there.

stop_after: Option<String>

Breakpoint: suspend AFTER the exit of the first matching step instance (--stop-after); same target grammar and posture as Self::stop_at, reason "stopped at breakpoint --stop-after <canonical path>".

Implementations

impl RunOptions

pub fn new(device_id: impl Into<String>) -> Self

Options with a fresh stop token, no explicit run id, no vision verifier (stub-equivalent), an empty subflow registry, no supervision and the system clock.