Struct ToolBench 

pub struct ToolBench { /* private fields */ }

The tool bench: the turn layer’s routing of a call through the gate its own declared Effect names, in the three orderings the module documentation states.

Implementations

impl ToolBench

pub fn limit_egress(self, list: EgressAllowlist) -> ToolBench

Hands the bench the egress list the building wrote, frozen with the run (crates/city/spec/Policy.lean D27). A browser call to a public host outside it is refused before any byte leaves; the judgement compares against this short list, so it adds no read, no lookup and no round trip to the call.

impl ToolBench

pub fn new(domain: WriteDomain) -> ToolBench

pub fn for_job(self, asking: Address, job: Locator) -> ToolBench

Hands the bench the work it serves: where the run stands and what it was given to do.

Without it a spawn is refused rather than allowed, because an approval item that named neither the asker nor an artifact would reach a person as a question about nothing.

pub fn with_checkpoint(self, net: CheckpointNet) -> ToolBench

Hands the bench its checkpoint net. Without one, a suspected discard is refused rather than run unprotected.

pub fn register(&mut self, tool: Box<dyn Tool>) -> Result<(), AxError>

Registers a tool under its own declared name. A second tool claiming a taken name is refused rather than shadowing the first.

pub fn declared_writes(&self) -> DeclaredWrites

What each registered tool may write, read off its declared effect alone, taken out before the bench is lent to the run so the checkpoint policy can ask it while a wave waits (crates/runtime/spec/Run/Checkpoint.lean §8-45).

pub fn taint_mut(&mut self) -> &mut TaintSet

pub fn meta_of(&self, name: &ToolName) -> Option<&ToolMeta>

The registered tool’s declaration. Callers packaging a result need its temporal to decide whether a clock line is due.

pub fn invoke( &mut self, call: &ToolCall, key: &IdemKey, now: TimeMs, ) -> Result<BenchOutcome, AxError>

Routes one call: dedup, then the door its Effect names, then the tool itself: clear, then the tool tool_for names, then account, in order, on one thread.

pub fn clear( &mut self, call: &ToolCall, key: &IdemKey, now: TimeMs, ) -> Result<Clearance, AxError>

Dedup, the doors, and the discard forecast’s checkpoint: everything that decides whether a call may run, and reads or writes what the calls before it left. A concurrent wave clears its calls one at a time, in call order.

pub fn tool_for(&self, ticket: &Ticket) -> Result<&dyn Tool, AxError>

The tool a cleared call runs on. What comes back is the tool rather than the bench, because the bench is not Sync (its checkpoint holds a git repository handle) while a tool is: the calls of one wave invoke their tools on several threads at once, and none of them touches the dedup table or the taint.

Errors

A ticket naming a tool this bench does not hold.

pub fn tool_named(&self, name: &ToolName) -> Option<&dyn Tool>

The tool registered under name, lent out before any call to it is cleared, so a read the model hands over can start while it is still generating (crates/runtime/spec/Turn.lean §8-3). A name this bench does not hold starts nothing early; admitting the call reports it.

pub fn account( &mut self, ticket: Ticket, answered: Result<ToolOutcome, AxError>, ) -> Result<BenchOutcome, AxError>

Records what a cleared call answered. A concurrent wave accounts its calls in call order, so the dedup table and the taint grow in the order a serial wave grows them.

The key is recorded with the answer it earned, so a retry after a gate refusal is not a replay, and a call the tool itself failed answers its replay the same way it answered the first time rather than running again. Outside content enters the run here and nowhere else, so every later call’s doors read the taint it brought.

Errors

The tool’s own refusal, and outside content whose source label is empty.