Crate supercode

Expand description

Backwards-compatible composition facade for Supercode.

New integrations should select the narrow package they need: supercode-interchange for session glue, supercode-reduce for reversible token reduction, supercode-runtime for provider/runtime primitives, or supercode-harness for the complete native Supercode agent and tool loop. This crate preserves the historical supercode import by re-exporting the complete harness surface.

Modules§

acp_frontend: First-class ACP client implementation of the canonical SDK runtime.
acp_server: Inbound Agent Client Protocol adapter for the SDK-owned Supercode runtime.
agent_package: Repository-native agent packages.
approvals: ORCH-9 (observed tier): one uniform listing of the approval requests waiting for an answer, across every harness supercode drives.
audit: Corpus coverage audit.
background: Compatibility path for native background-job state.
browser: Provider-independent browser capability owned by Supercode.
catalog: Compatibility path for session catalogs and durable locators.
channels: ORCH-14 — the channel noun at the OBSERVED tier: one uniform row per transport + account a gateway harness is reachable on, read from the harness’s own config file and never written.
checkpoint: §2 module 20 checkpoint (COMPOSABLE-HARNESS-DESIGN.md line 470): file checkpointing / shadow-git; D4-adjacent revert; D3 turn-diff tracking. Line 1504: “restores FILES, not context — pairs with, never replaces, the reduction sidecar.”
claude_compat: Claude Code project compatibility helpers.
claude_peer: Live Claude Code peer sessions: registry discovery and message delivery.
claude_runtime_state: Lossless, non-executing reconstruction of Claude Code runtime state.
codex_peer: Live stock-Codex session discovery.
config_schema: BP-9 (D6 row “Published JSON schema for config”, cc§6): the published JSON Schema for the supercode config file — .supercode.toml, ~/.config/supercode/config.toml, and the JSON mirror (HarnessConfig::from_json_str).
configfile: §3 “The Single Config File” (docs/composable-harness/COMPOSABLE-HARNESS-DESIGN.md) — P1 of the composable-harness migration (design §5.2, phase P1).
context_injection: BP-4 (catalog:91 “Synthetic context-injection blocks”, design §1.4: “harness-spliced reminders/nudges … the ambient nudge class is core”): the injection REGISTRY behind core.context_injections.
fidelity: Compatibility path for canonical interchange fidelity measurements.
formatters: §2 module 29 formatters (COMPOSABLE-HARNESS-DESIGN.md line 479): “D10/oc§10 format-on-write” — reuses the EXACT crate::tools::WriteObserver seam P5-9 built for checkpoint (D-5: “write-path interception seam shared with checkpoint”), rather than a second interception point.
frontend: Protocol-neutral frontend contract for one SDK-owned Supercode runtime.
git_metadata: P4e (COMPOSABLE-HARNESS-DESIGN.md §1.6/§3.1 core.session.git_metadata, catalog:331 “Git integration (metadata, diff, PR)”): a persisted, TYPED record of the git branch/sha/dirty state a session was RUNNING under, captured ONCE at session start (closes the loop catalog:331 flags — supercode already preserves a foreign session’s own git-shaped fields byte-for-byte on IMPORT via Session::raw’s verbatim capture; this is the WRITE half: supercode’s OWN sessions get the same provenance). Deliberately flat/typed (not a formatted string), the exact same rationale as crate::usage_log::UsageRecord/ crate::model_change::ModelChangeRecord (§1.13): a translatable, lossless session-data channel, not a lossy notice — so it survives a save/load round trip byte-for-byte, and a future reader (a translator, doctor/inspect stats) can consume it without re-parsing prose.
goals: BP-7 (catalog §4a “Goals (persistent objective across turns)”, cc’s /goal, cx’s /goal + goals_1.sqlite): the session’s standing objective.
harness_auth: Native coding-harness authentication coordination.
harness_command: The controlled tier’s substrate: one harness command, ready to run and ready to narrate.
harness_service: Versioned, language-neutral service over persisted harness sessions.
hermes_import: UNI-18: the Hermes write path, through Hermes’s own door.
human_export: P4e (COMPOSABLE-HARNESS-DESIGN.md §1.6/§3.1 core.session.export_format, catalog:283 “transcript export for humans”): a READ-ONLY rendering of a crate::Session’s conversation into text a human reads directly (terminal/file/clipboard) or opens in a browser — CC’s /export+/copy, CX’s Ctrl+O copy-last. This is core, not gated by the session.share module (§1.6: “export-to-human is universal while share links … are the OC+PI-only part session.share actually narrows to”).
interop_settings: Harness-owned controls that materially affect Supercode interoperability.
jobs: Observed-tier, READ-ONLY inventory of scheduled jobs across the harnesses that have them (Domain 11, concept 6).
jobs_control: Controlled-tier scheduled jobs (Domain 11, concept 6) — the FIRST controlled-tier noun, and the shape the rest of wave 2 copies.
live_runtime: Trusted local receipts for attachable Supercode runtimes.
lsp: §2 module 28 lsp (COMPOSABLE-HARNESS-DESIGN.md line 478): “D1 LSP diagnostics in edit path + query tool” — this module ships the WEAKEST FORM that satisfies D1: server LIFECYCLE for a HANDFUL of user-configured language servers, and diagnostics surfaced in the edit/write TOOL RESULT via the shared D-5 write-path seam (crate::tools::WriteObserver, P5-9/P5-11).
mcp: P5-2 (COMPOSABLE-HARNESS-DESIGN.md §2 module 15 mcp.client, D7 rows 1-8): full Model Context Protocol client support — stdio (P5-1 baseline, GROWN not rewritten), remote HTTP/SSE transports, resources + templates, prompts-as-commands, server instructions, and elicitation — plus the handle_request / serve_stdio harness-as-MCP-server direction (module 16).
mcp_oauth: P5-2 (COMPOSABLE-HARNESS-DESIGN.md §2 module 15 D7 row 2 “OAuth”; §2.1 dep “model.oauth → trust-grade token storage” — the same security class applies here): OAuth PROTOCOL support for authenticated remote MCP servers.
memory: ORCH-12 — the memory noun at the OBSERVED tier: read and search the persistent cross-session memory documents a harness keeps on disk.
model_catalog: §2 module 26 model.catalog (docs/composable-harness/ COMPOSABLE-HARNESS-DESIGN.md §3.1 [capabilities.model_catalog]) — P4 of the composable-harness migration (design §5.2 phase P4: “aliases + fallback chains (userconfig.rs:386-411) promoted into core” + the small_model knob).
model_change: P4c (COMPOSABLE-HARNESS-DESIGN.md §5.2 “P4” core NEW-significant item, §1.10/§3.1 core.model_switch.allow_switch, D9 row): a persisted, TYPED record of a mid-session model switch — pi’s model_change precedent (design §1.10: “persisted change records … pi’s model_change is the cleanest precedent”). Deliberately flat/typed (not a formatted string), mirroring crate::usage_log::UsageRecord’s exact rationale: a translatable, lossless session-data channel (§1.13), not a lossy notice — so it survives a save/load round trip byte-for-byte in the fields that matter, and a future reader (a translator emitting this same session under another harness’s format, a doctor/inspect stats command) can consume it without re-parsing prose.
modules: §2 “The Bolt-on Capability Taxonomy” (docs/composable-harness/ COMPOSABLE-HARNESS-DESIGN.md) — P3 of the composable-harness migration (design §5.2, phase P3: “A ModuleId enum (the 35 names) + resolved activation set on Config”).
ontology: The supercode ontology (docs/ONTOLOGY.md): the one model under the session spine and the orchestration. Lower layers never import upper ones — this module depends on nothing above it except the session layer’s crate::session::OrchestrationNouns wire block, which a Binding projects onto.
orchestration: The orchestration piece of the ontology (docs/ONTOLOGY.md §2.7, docs/ORCHESTRATOR-IR.md §2): a harness’s operational home as ONE typed value. These are the records the orchestrator loads, steps and saves; a Hermes or OpenClaw home compiles into them and decompiles back (the codecs are ONT-3’s). The wire form is the orchestrator IR’s canonical JSON: the runtime half is never persisted and is not here.
orchestration_doors: ONT-4: the orchestration doors, in one implementation.
orchestrator: The orchestrator’s home, its daemon lease, and the service unit the operator verbs print (ORC-7).
orchestrator_door: ORC-13 — the orchestrator’s WRITE door, the one every controlled-tier noun goes through when --harness orchestrator names it.
output_style: BP-5 (catalog D2 “Output style / personality module”: swappable response-style instruction layer; cc§7 “Output styles”; cx§2 “Personality layer”) — the named response-style layer.
parity: Behavior-parity ledger: the product’s own gap count, for the cc-parity and cx-parity presets and for the orchestration harnesses.
path_rules: BP-5 (catalog D2 “Path-scoped rules”: rule files activated only when matching files are touched; cc§2 “.claude/rules/*.md — modular instruction files; optional paths: frontmatter scopes a rule to file globs so it loads only when Claude touches matching files”).
permissions: P5-1 (COMPOSABLE-HARNESS-DESIGN.md §2 modules 10-11, §2.1 D-3, §2.2 C5, §5.3 risk 1): the permissions engine — command canonicalization + rule algebra + approval policy/cache + oc/cx import translators.
plugins: P5-12 (COMPOSABLE-HARNESS-DESIGN.md §2 module 18 plugins, D7 “in-process extension API, packaging/marketplaces, custom tools from files, provider injection, extension UI, plugin/package installation”; §2.1 D-10: “config-borne code execution without a trust gate is an injection hole”).
presets: §4 “Presets” (docs/composable-harness/COMPOSABLE-HARNESS-DESIGN.md) — P2 of the composable-harness migration (design §5.2, phase P2).
pricing: BP-7 (catalog §4a “Turn/budget caps” — the spend cap; “Per-turn cost/usage accounting” — the cost half): token→dollars on the request path.
pricing_ref: Reference pricing constants used only to translate measured byte/token savings into a dollar figure in test logs and docs (D15). These are stated constants for one Opus-class API list price (July 2026) — not a live lookup, and not used anywhere on the request path.
profiles: ORCH-10 — the profile noun at the OBSERVED tier: one uniform row for every named, routable config home supercode can see, read from each harness’s own files and never written.
profiles_control: ORCH-21 — the profile noun at the CONTROLLED tier: create and delete a routed config home through the HARNESS’S OWN verb, with supercode as the uniform client.
reduce: Compatibility facade for optional reversible reduction.
routes: ORCH-15 (observed tier): the routing noun — which profile / agent a surface tuple resolves to.
runs: Observed-tier, READ-ONLY inventory of scheduled-job FIRES across the harnesses that keep a run store (Domain 11, concept 7).
runtime: Primitive live-runtime contracts and the Codex app-server reference adapter.
runtime_lease: Transport-neutral observer and controller leases for live SDK runtimes.
runtime_registry: Authenticated inventory and attachment for live and persisted sessions.
sandbox: P5-10 (COMPOSABLE-HARNESS-DESIGN.md §2 module 12 permissions.sandbox, ~row 462): the OS-level enforcement BACKSTOP permissions.rules’ rule-layer floor and the file-tool crate::tools::SandboxPolicy both defer to for full coverage (crate::permissions module doc: “complete OS-level write confinement of arbitrary bash… is capabilities. permissions.sandbox’s job (P5 module 10, a later unit), not this one’s” — this IS that unit).
schema: Typed schemas for the on-disk session formats.
sdk: Versioned public SDK contract shared by every Supercode surface.
server: §2 module 31 server (COMPOSABLE-HARNESS-DESIGN.md, D7 “full programmatic RPC/HTTP server”, D8 “remote attach”, D10 “daemon”; §1.9 Obligation 9’s out-of-process half — the in-process SDK already meets the core commitment via crate::EventSink).
session: Compatibility path for canonical sessions and native codecs.
session_activity: Protocol-neutral activity for persisted and live harness sessions.
session_index: Revisioned session-list subscriptions for latency-sensitive frontends.
session_journal: BP-8 (catalog domain 5): the append-only session journal — one flush-per-record log of everything that happens to a session while it is live, written beside the transcript as <name>.journal.jsonl.
session_title: P4b (COMPOSABLE-HARNESS-DESIGN.md §5.2 “P4”, §1.6/§3.1 core.session.auto_title, catalog:150, D-9): auto-title / session summary — a small-model side-call that titles a session, mirroring crate::reduce::summarize’s plumbing exactly: an injectable trait (real implementations call out to a model; this crate’s own tests only ever inject deterministic fakes — no real network/model call anywhere in this crate, same posture as crate::reduce::summarize::SpanSummarizer), a fixed versioned prompt, and a “never blocks, never fails the caller” contract.
session_tree: Compatibility path for canonical session trees.
sessions_control: Controlled-tier conversations (Domain 11, concept 5) — new, reset, archive, delete over one uniform door.
sidecar: Compatibility path for native interchange sidecars.
skills: ORCH-11 (observed tier): read-only enumeration of the skill packages each harness has installed.
skills_control: Controlled-tier skills (Domain 11, concept 15) — install and remove, each through the door the harness itself publishes.
store: A directory-backed store for supercode’s own sessions — naming, titles, listing, archiving, and deletion. The analog of claude --name / the Codex resume/archive/delete session lifecycle.
subagents: P5-3 (COMPOSABLE-HARNESS-DESIGN.md §2 module 9 subagents: “D1 spawn tool; D3 sub-agents/named-defs/background+resume/teams; D5 subagent transcripts”; §2.1 D-1 “subagents → core.session(lineage), core.tools; background-mode → permissions.approvals”; §2.2 C6): the data shapes and pure-function resource-bound checks the spawn/join/background machinery in crate::agent::Agent builds on. Kept separate from agent.rs so the depth/concurrency-cap arithmetic and the lineage record shape are unit-testable without a full Agent/mock-Provider harness — the same “pure config → set, testable without the loop” precedent P3’s crate::modules module documents for itself.
support: Canonical implementation inventory for external coding harnesses.
tokens: Compatibility path for native runtime token budgeting.
tools: Tools the agent can call.
triggers: ORCH-16 (observed tier): the inbound-trigger noun — an HTTP route or hook mapping that opens a turn when something outside the harness fires.
trust: BP-10 (COMPOSABLE-HARNESS-DESIGN.md §2 module 14 trust, catalog row “Project/workspace trust gate”): the workspace-trust DECISION — the prompt, its per-project persistence, and the three surfaces it gates.
tui: P5-4 (COMPOSABLE-HARNESS-DESIGN.md §2 module 30 tui; §1.9 recorded deviation; §2.1 tools.question/permissions.approvals(ask-UI) → tui|server): the full-screen interactive TUI, AND — because §2.1 names it as the interactive surface three EARLIER phases explicitly deferred here — the home for the three handlers that close those deferred chains:
turn_record: BP-7 (catalog §4a “Turn/step bracketing records”, “Interrupt/abort with state preserved”, “Auto-retry on transient provider errors”): the persisted per-round-trip marker log — cc’s turn_duration/api_retry system records and cx’s turn_context/turn_aborted/responses_retry rows, in one typed shape.
usage_log: P4b (COMPOSABLE-HARNESS-DESIGN.md §5.2 “P4”, §1.6/§3.1, catalog §4a “Turn/step usage records surfaced per turn”): persisted per-turn token/usage records. crate::AgentEvent::Usage already streams this data live (UX-23); this module makes it DURABLE session data — a typed, serde-round-trippable record, not a lossy display-only channel (§1.13’s lossless/sidecar discipline: this is typed session data, exactly like crate::reduce::ReductionLog, not a text notice).
watch: Compatibility path for passive session following.
workflow_doors: The workflow layer’s read door: harness.v1.workflow.load, the same code the supercode workflow load verb calls. A harness’s board is read as one typed Workflow value; the board is written only through the harness’s own door (hermes kanban …), never here.

Structs§

AcpFrontendCheckpoint: Durable delivery cursor for restarting an ACP frontend without replaying events it already consumed.
AcpFrontendConnectOptions: Connection parameters for one ACP frontend attachment.
AcpFrontendRuntime: ACP transport implementing the same SdkRuntime consumed by local and HTTP frontends.
AcpRuntimeBackend: Generic ACP v1 client backend for any ACP agent command.
Agent
ApprovalOption: One answer the door that raised this request accepts.
ApprovalRegistry: The live pending requests held by one service’s open runtime connections.
ApprovalResolution: Everything harness.v1.runtimes.respond needs to answer one request.
ApprovalRow: One approval request, in the vocabulary shared by every harness.
ApprovalsQuery: harness.v1.approvals.list request.
ApprovalsResolveParams: harness.v1.approvals.resolve request.
BearerToken: Bearer credential whose Debug output never contains the secret.
ChannelRow: One transport + account a harness is reachable on, uniform across harnesses.
ChatMessage: A single message in a conversation.
ChatRequest: A single model-completion request.
ClaudeBackgroundChild: Latest known state of a Claude Agent tool call.
ClaudeCodeRuntimeBackend: Claude Code live-runtime backend using bidirectional stream-json print mode with supercode registered as the CLI’s permission handler.
ClaudeCronJob: One active Claude Cron job.
ClaudePeerDelivery: Successful hand-off of one message to a live session.
ClaudePeerEndpoint: Opaque addressing string published on a discovered descriptor.
ClaudePeerRefusalError: A refusal paired with the detail that names it.
ClaudePeerSession: One live Claude Code session: a registry record whose pid answered kill(pid, 0) during the read that produced this value.
ClaudePeerSettings: The user-settings portion Supercode can inspect without pretending to know a target process’s complete managed/project/CLI precedence stack.
ClaudeQueueState: End-of-transcript queue state.
ClaudeRuntimeManifest: A pure, serializable reconstruction of runtime state in a Claude transcript.
ClaudeRuntimePosture: Latest Claude CLI mode and permission posture.
ClaudeRuntimeResidue: Verbatim evidence for one runtime-affecting source record.
ClaudeWakeup: One scheduled one-shot wakeup that has not yet observably fired.
CodexRuntimeBackend: Codex live-runtime backend using the official codex app-server JSONL protocol (initialize, thread/start|resume, turn/start|interrupt).
Config: Everything that shapes an crate::Agent: the model and endpoint, the credentials, sampling parameters, the system prompt, and per-tool overrides.
ConfigBuilder: Fluent builder for Config.
ConfigFile: A config file: a set of named profiles (the analog of Codex -p/--profile). This is the SDK/embedder config surface (JSON, via Config::from_profile_file). BP-9 gave the same named-bundle mechanism a launch-time selector on the CLI side: supercode --profile <name> selects a [profiles.<name>] bundle out of the user’s TOML config.toml (userconfig::FileConfig), applied as its own layer between the user layer and the project layer (cx§6’s user → profile → project order).
ConfigProfile: The serializable subset of a Config that can live in a config file. (Callbacks/handlers are code-only and are not represented here.)
ContextInjectionBlock: P4e (§1.4/§3.1 core.context_injections): one named ambient context block – see Config::context_injection_blocks.
ContextUsage: BP-4 (catalog:109 “Context-usage introspection”): the live context-window accounting Agent::context_usage reports — cc’s /context grid and cx’s /status + get_context_remaining in one shape, over the numbers resume --dry-run’s preflight already computes.
CoordinatedRuntime: Shared transport-neutral owner of a runtime and its client leases.
CoordinatedRuntimeClient: Authenticated client projection of one coordinated SDK runtime.
CrossSurface: ORCH-3: a conversation moved to another surface (Hermes handoff_*).
DiscoveryPage: One stable newest-first discovery page.
DiscoveryQuery: Filters and roots used for one catalog scan.
DoorAnswer: One answered operator call.
FidelityMetric: Result of measuring one actual translation cell.
FidelityResidue: Measured residue of one actual export/reload cell.
FrontendActions: Actions the current runtime adapter can actually perform.
FrontendAttachSnapshot: Serializable half of an attachment returned by an out-of-process runtime. The live receiver is transport-owned and joined to this snapshot locally.
FrontendAttachment: Atomic history/replay/live attachment to one runtime.
FrontendCommandDescriptor: One runtime-provided command surfaced by a composer.
FrontendDisplayCapabilities: Display semantics emitted by the runtime.
FrontendEvent: Canonical event before a wire transport adds subscription metadata.
FrontendOperationDescriptor: One operation the runtime can genuinely invoke.
FrontendRequest: One pending interactive request, emitted as a sequenced frontend event.
FrontendRuntimeDescriptor: Complete frontend-facing description of one SDK-owned runtime.
FrontendRuntimeMetadata: Source/emulation identity supplied by the session-loading surface.
FunctionCall: The function payload of a ToolCall.
GeneratedFrontendClient: Generated typed Rust client over any facade transport.
HarnessAuthenticationLaunch: Process launch that an embedding host must run in a user-visible terminal.
HarnessAuthenticationMethod: One verified native authentication mechanism supported by a harness.
HarnessAuthenticationPlan: Host-executable plan for one selected authentication method.
HarnessAuthenticationReport: Redacted native authentication readiness and available methods.
HarnessCatalog: Read-only entry point for discovering, loading, and following persisted harness sessions.
HarnessConfig: The top-level schema (§3.1): one TOML/JSON document that fully determines the harness’s shape (§3.0: “Everything the harness does is a function of the resolved file”).
HarnessEvent: Protocol-neutral envelope around a native live event.
HarnessHomes: Configurable session roots for the built-in harnesses.
HarnessId: Extensible identifier for a coding harness.
HarnessInteropAdvisory: Actionable finding derived from native harness configuration.
HarnessInteropControl: One harness-owned setting that Supercode can inspect or configure.
HarnessInteropSettingsReport: Canonical, revisioned snapshot shared across CLI, RPC, SDK, and UI.
HarnessRun: Hard stop on how far a compression chain is followed from a fire’s own session to the readable tip. Hermes chains are short; a cycle in a corrupted store must not spin. One fire of one scheduled job, projected onto the uniform Domain 11 row.
HarnessSessionService: Stateful persisted-session service. Each instance owns its follow subscriptions; discovery and loading remain read-only.
HarnessSettingChange: Requested change to one stable interoperability control.
HarnessSettingChoice: One allowed value for an interoperability control.
HarnessSettingRecommendation: Concrete, reviewable remediation for an advisory.
HarnessSupportDescriptor
HttpFrontendRuntime: Authenticated HTTP implementation of FrontendRuntime.
JobDeliver: Where a fire’s output is delivered.
JobDeliverSpec: Uniform delivery for a create/update.
JobMutation: One mutating request, in the uniform Domain 11 vocabulary.
JobMutationOutcome: What one mutation did, with the harness’s own row read back afterwards.
JobPayload: What a fire actually does.
JobPayloadSpec: Uniform payload for a create/update.
JobSchedule: A job’s firing rule, with the native expression preserved.
JobScheduleSpec: Uniform firing rule for a create/update.
JobSource: One store the listing consulted, and what it found there.
JobsListing: Result of a jobs.list: the rows plus every store that was consulted.
JobsQuery: Filters for a scheduled-job read.
Lease: The lease <home>/orchestrator.lock holds: which process is serving this home, and since when.
LiveRuntimeEndpoint: Browser-safe reference to a trusted local runtime receipt.
LiveRuntimeMetadata: Static runtime metadata recorded at registration. Dynamic state, actions, controller, and observers are queried from the authenticated SDK endpoint.
LiveRuntimeRecord: Browser-safe inventory record for one reconciled live receipt.
LiveRuntimeRegistration: RAII registration for one live runtime. Dropping it removes only the receipt created by this registration, leaving persisted chat data intact.
LiveRuntimeSource: Stable source identity through which a hosted continuation is discovered.
LocalRuntimeRegistry: Local authenticated registry backed by harness discovery and private live-runtime receipts.
McpServerLaunch: One stdio MCP server the caller wants mounted into the session it is starting. Uniform shape; each backend translates it into whatever its own harness accepts (the ACP backend into session/new’s mcpServers).
MemoryDocument: One memory document, as one harness holds it.
MemoryMatch: One line of one memory document that matched a search.
MemoryQuery: harness.v1.memory.show request.
MemorySearchQuery: harness.v1.memory.search request.
ModuleActivation: The resolved activation set for all 35 modules (§5.2 P3: “a resolved activation set on Config”) — pure HarnessConfig → set, no loop required (§5.3 risk 2’s testability mitigation). Also carries tools_search’s three per-tool sub-flags, since crate::tools::ToolRegistry::from_config needs them to decide which of glob/search/list_dir to register — and (P4c) tools_web’s two, for web_fetch/web_search.
NativeSupport: Persisted-session and translation implementation facts.
OpenAiProvider: An OpenAI-compatible HTTP provider. The composition layer supplies its endpoint, credentials, and headers from runtime configuration.
OpenCodeRuntimeBackend: OpenCode live-runtime backend using its official HTTP API and SSE event stream. OpenCodeRuntimeBackend::connect can join the server embedded in an already-running TUI when that TUI was launched with a known host/port.
OrchestrationNouns: ORCH-6: the ORCH-3 conversation nouns as one additive wire block, carried by harness.v1.sessions.discover / sessions.load rows and by crate::catalog::SessionDescriptor. Every field is optional so an older client sees exactly the shape it already knows.
PiRuntimeBackend: Pi live-runtime backend using pi --mode rpc JSONL.
PreToolOutcome: BP-10: everything a pre-tool hook can say about one call — a decision, a human-readable reason, and (the rewrite half of the row) REPLACEMENT arguments.
ProcessCourierRunner: Real courier spawner.
ProfileMutation: One mutating request, in the uniform Domain 11 vocabulary.
ProfileMutationOutcome: What one mutation did, with the harness’s own row read back afterwards.
ProfileRow: One named config home, uniform across harnesses.
PromptTokensDetails: The cache portion of Usage::prompt_tokens_details.
Recurrence: ORCH-3: the job a recurring session belongs to.
ResolvedLiveRuntime: Secret host-side information recovered from a verified receipt.
ResolvedRuntimeConnection: Endpoint and credential resolved from a RuntimeConnectLaunch.
RetryLog: A shared, drainable buffer of RetryNotices.
RetryNotice: BP-7 (catalog §4a “Auto-retry on transient provider errors”): one transient failure the transport retried.
RouteMatch: The match side of a route, in the shared-noun vocabulary.
RouteRow: One routing entry.
RpcEngine: The out-of-process RPC driver: wraps one already-constructed crate::Agent with the submit/interrupt/status/shutdown method set (§ module doc). Shared by both transports (run_stdio, run_http) so the method semantics — including the fail-closed permission behavior — can never drift between them.
RunDelivery: A fire’s delivery outcome (ORCH-13).
RunSource: One store the listing consulted, and what it found there.
RunsListing: Result of a runs.list: the rows plus every store that was consulted.
RunsQuery: Filters for a run-history read.
RuntimeAttachRequest: Request to resume or attach through a new adapter connection.
RuntimeAuthorization: Permissions carried by one authenticated runtime client.
RuntimeCapabilities: Mechanical facts an adapter can guarantee.
RuntimeClientId: Opaque identity scoped to one authenticated frontend connection.
RuntimeConnectLaunch: Connect to an already-running harness endpoint instead of spawning one.
RuntimeControllerLease: Controller lease visible through runtime describe/list operations.
RuntimeHandle: Identity returned after a live session is started or resumed.
RuntimeInput: User input accepted by a live runtime.
RuntimeLaunch: Executable configuration used to launch one adapter endpoint.
RuntimeLeaseCoordinator: One-controller, many-observer coordination state for a live runtime.
RuntimeLeaseSnapshot: Serializable ownership snapshot included in registry descriptors.
RuntimeObserverLease: One attached observer and its last authenticated activity.
RuntimeRegistryEntry: Stable joined descriptor returned by the registry.
RuntimeRegistryOwner: Process and controller ownership for one live entry.
RuntimeRegistryQuery: Filters controlling one joined live/persisted inventory read.
RuntimeRegistryWatch: Bounded watch subscription. Dropping it stops the polling task.
RuntimeStartRequest: Request to create a fresh runtime session.
RuntimeSupport: Live runtime wiring known without launching the real executable.
ScheduledJob: One harness’s scheduled job, projected onto the uniform Domain 11 row.
SdkAgent: SDK-owned emulation runtime component.
SdkCapabilities: Capability inventory for the complete v1 SDK, independent of transport.
SdkEvent: Canonical event before a wire transport adds subscription metadata.
SdkRequest: One typed SDK request before a transport adds its envelope.
SdkRuntimeEvent: One runtime event paired with its durable SDK identity.
ServiceState: What the platform’s service manager says about the orchestrator unit.
ServiceUnit: A rendered service unit: what setup prints and writes.
Session: A normalized, replayable conversation loaded from a tool’s session log.
SessionActivity: Normalized lifecycle state for one harness-native session.
SessionActivityEvidence: Provenance for one normalized activity observation.
SessionDescriptor: Lightweight metadata returned by catalog discovery.
SessionFollower: Poll-based follower for one persisted Claude Code, Codex, Pi, OpenCode, or Grok session.
SessionIndexDelta: One subscription poll result. Revisions start at one for the initial snapshot and increase by exactly one for each non-empty delta batch or committed window resize. They describe the visible window, not changes to out-of-window inventory totals returned by a same-limit read.
SessionIndexKey: Stable public identity for a session-index change. Persistence paths remain inside the trusted host and are sent only as part of complete descriptors.
SessionInfo: Lightweight metadata about a stored session.
SessionLocator: Stable identity for a persisted harness session.
SessionMeta
SessionMutation: One mutating request, in the uniform Domain 11 vocabulary.
SessionMutationOutcome: What one mutation did, with the conversation re-read afterwards.
SessionStore: A filesystem session store rooted at a directory.
SkillHomes: Config homes the skill roots hang off. Defaults follow each harness’s own environment contract; a caller may override any of them (tests, probes).
SkillMutation: One mutating request, in the uniform Domain 11 vocabulary.
SkillMutationOutcome: What one mutation did, with the harness’s own row read back afterwards.
SkillRow: One installed skill package, as one harness holds it.
SkillsQuery: harness.v1.skills.list request.
SupercodeHttpRuntimeBackend: Adapter that joins one authenticated Supercode SDK runtime without taking ownership of the process or creating a second model loop.
SupportRegistryReport: Machine-readable compiled support inventory.
SurfaceKey: ORCH-3: the conversation identity on a surface. Full tuple on a channel; degenerate (all None) on a terminal.
ToolCall: A request from the model to invoke a tool.
ToolContext: Ambient context passed to every tool invocation.
ToolOverride: Per-tool customization: enable/disable a tool and/or override the description the model sees for it.
ToolOverrideProfile: A single tool’s file-settable overrides — the ConfigProfile mirror of ToolOverride (COMPOSABLE-HARNESS-DESIGN.md §3.1 [core.tools.<name>], §3.2 mapping row core.tools.enabled + [core.tools.<n>].*).
ToolRegistry: An ordered set of tools offered to the model.
ToolSchema: A tool advertised to a model.
TriggerRow: One inbound trigger.
Usage: Token accounting returned with a completion.
WorkspaceRef: ORCH-6: the wire form of [SessionMeta::workspace] — a typed workspace carried on a discovered or loaded row. The D2 precedence that produces it lives in workspace() (ORCH-3’s contract); this only names the result.

Enums§

AgentEvent: Streaming events emitted by a native runtime agent as a turn unfolds.
ApprovalChoice: What a caller asked for, once the params have been validated.
ApprovalDecision: The uniform decision harness.v1.approvals.resolve takes, in the vocabulary shared by every harness rather than any one door’s spelling.
ApprovalDoor: Which protocol door raised a live request.
ApprovalKind: Where a row came from.
ApprovalPolicy: When the agent must seek approval before running a tool — the analog of Codex’s -a untrusted|on-request|never and Claude’s permission modes.
ApprovalResolveError: Why one resolve could not be planned.
ApprovalStatus: Lifecycle state of one approval row.
CachePlan: Prompt-caching plan applied while building a provider request.
ChannelError: Read-only channel failures.
ChannelStatus: Whether a live probe answered, and what it said.
ClaudeBackgroundState: Lifecycle state recovered for a Claude background child.
ClaudeCrossSessionInbound: User-level policy Claude Code applies to messages from other sessions.
ClaudePeerRefusal: Why a message could not be delivered into a live session.
ClaudePeerSettingsError: Failure to read or safely update Claude Code’s user settings.
ClaudePeerStatus: Activity a live Claude Code session reports for itself.
Door: Which door answered.
DoorError: Why an operator call could not be answered.
Error: Errors that can arise while configuring or running an crate::Agent.
Fidelity: How faithfully a reconstruction reproduces its source.
FrontendApprovalDecision: Typed approval decision accepted by FrontendRuntime::respond.
FrontendConnectionState: Frontend-visible runtime connection state.
FrontendElicitationAction: MCP elicitation outcome accepted by a frontend response.
FrontendFacadeMethod: One method in the versioned language-neutral frontend facade.
FrontendOperationInvocation: Typed invocation accepted by FrontendRuntime::invoke.
FrontendOperationKind: Stable family for an explicitly invocable frontend operation.
FrontendOperationResult: Typed result returned by FrontendRuntime::invoke.
FrontendRequestKind: Kind of interactive request surfaced by the SDK runtime.
FrontendResponse: Typed response to one SDK-owned interactive request.
FrontendRuntimeError: Typed failure returned by every SDK adapter and compatibility projection.
FrontendTurnState: Whether a model/tool turn currently owns the runtime.
HarnessAdvisorySeverity: Importance of an interoperability advisory.
HarnessAuthenticationEnvironment: Environment in which the native authentication interaction must work.
HarnessAuthenticationError: Failure to construct a truthful native authentication plan.
HarnessAuthenticationInteraction: User interaction presented by an authentication method.
HarnessAuthenticationMethodId: Stable identifier for a harness-native authentication mechanism.
HarnessAuthenticationState: Credential readiness reported without exposing credential material.
HarnessBrowserBehavior: Whether the native CLI itself is expected to open a browser.
HarnessInteropSettingsError: Failure while inspecting or changing harness interoperability controls.
HarnessSettingScope: Native configuration layer from which a control was read.
HookDecision: BP-10 (catalog row “Hook/plugin permission veto”, semantics “Programmatic allow/deny/rewrite before the user sees it”): what a pre-tool hook decided about one call.
ImplementationKind: How a primitive is wired into the compiled core.
JobControlError: Why a mutation could not be performed.
JobScope: Whether a job belongs to one conversation or to the whole install.
JobVerb: One uniform mutating verb.
LifecycleEvent: A loop lifecycle moment an embedder may observe (BP-11, catalog “Lifecycle hooks, config-registered”): the compaction and subagent boundaries the CLI’s pre_compact/post_compact/subagent_start/ subagent_stop hook events are fired from. Observational only — a lifecycle hook can never veto the moment it observes.
LiveRuntimeReceiptError: Receipt registration or resolution failure.
LiveRuntimeSupervisor: Optional local process supervisor for an attachable runtime.
MemoryError: Read-only memory failures.
MemoryScope: Which config home a memory document belongs to, in the vocabulary shared by all three harnesses.
ModuleId: The 35 §2 capability modules, numbered exactly as the design’s module table (§2, rows 1-35).
OrchestratorError: Why an operator verb could not do its work.
ProfileControlError: Why a profile mutation could not be performed.
ProfileError: Read-only profile failures.
ProfileKind: Which harness concept a row came from.
ProfileVerb: One uniform mutating verb over the profile noun.
Role: Who authored a ChatMessage.
RouteError: Why a listing was refused.
RuntimeEndpoint: Observable endpoint backing a runtime connection.
RuntimeLeaseError: Stable coordination failure shared by every transport projection.
RuntimePermission: Capability independently granted to an authenticated runtime client.
RuntimeRegistryEvent: Change emitted by RuntimeRegistryWatch.
RuntimeRegistryState: Reconciled lifecycle state reported by list/describe/watch.
RuntimeSubmitError: Typed turn failure shared by local, HTTP, ACP, CLI, and language adapters.
SandboxEnvPolicy: capabilities.permissions.sandbox.env_policy (§3.1): child-process environment sanitization for the spawned bash/shell subprocess. Inherit (the default) is today’s behavior — the parent’s environment (plus core.shell_env_snapshot, if configured) passes through unchanged. Filtered strips a sensitive-variable denylist (tokens, keys, cloud credentials). None keeps only PATH and a couple of universally-needed variables (HOME, TERM, LANG) — nearest to a bare-metal shell with nothing extra.
SandboxEscalation: capabilities.permissions.sandbox.escalation (§3.1): what happens when a confining fs tier is requested but this platform/kernel cannot actually enforce it. Deny (the default) refuses to run the subprocess at all — the cardinal “never silently unsandboxed” rule. Ask routes the decision through crate::permissions::PermissionsApprovalHandler (P5-1’s permissions.approvals seam, wired here per this module’s build brief). Allow auto-permits an unconfined run with a loud, one-time warning.
SandboxPolicy: Filesystem confinement applied to write-capable tools — the analog of Codex’s read-only / workspace-write / danger-full-access sandbox modes.
SchemaTier: How verbose an advertised tool schema is. Full is today’s behavior — byte-identical to the tool’s own description()/parameters(). Builtins default to Full (small, load-bearing); the win target is fat activated MCP tools (set via the global knob or a per-tool override, see crate::Config::tool_schema_tier / crate::config::ToolOverride::schema_tier).
SdkError: Typed failure returned by every SDK adapter and compatibility projection.
SdkErrorCode: Stable machine-readable SDK failure categories.
SdkOperation: One operation owned by the SDK facade.
SessionControlError: Why a mutation could not be performed.
SessionDoor: The door one (harness, verb) pair goes through.
SessionFormat: An on-disk session format supercode can both read and write.
SessionIndexChange: One complete replacement in a revisioned index delta.
SessionPresence: Whether a durable session currently has a proven live owner.
SessionSnapshotReason: Why a watcher emitted a complete session snapshot.
SessionSource: Which tool produced a session log.
SessionTurnState: Turn activity, independent of presence and frontend attention.
SessionVerb: One uniform conversation-lifecycle verb.
SessionWatchEvent: A normalized event emitted while following a local session.
SkillControlError: Why a mutation could not be performed.
SkillScope: Where a skill package was found, in the vocabulary shared by all six harnesses.
SkillVerb: One uniform mutating verb.
SteeringMode: How queued steering/follow-up messages are drained (S1.7, pi3 steeringMode/followUpMode).
StorageLocator: Durable storage address for a persisted session.
ToolAdvertising: How tools are advertised to the model (B6, D16).
ToolOutcome: The structural outcome known for a tool-result message.
Trigger: ORCH-3: why a session exists (the trigger noun; docs/HERMES-IDEAL-SUPPORT-DESIGN.md §3).
TriggerError: Why a listing was refused.
TriggerKind: What kind of trigger a row is.
WorkspaceKind: ORCH-3 / UNI-9: the typed workspace, derived — never stored.

Constants§

CHANNELS_SCHEMA: Stable row schema shared by Rust, JSON-RPC, the SDKs, and the CLI.
CHANNEL_HARNESSES: Harnesses with a channel concept supercode reads, in product order. Every other harness id is ChannelError::UnsupportedHarness.
CLAUDE_CROSS_SESSION_INBOUND_KEY: Stable key for Claude Code’s native crossSessionInbound preference.
CLAUDE_RUNTIME_MANIFEST_VERSION: Version of the persisted Claude runtime-state manifest schema.
CLAUDE_SESSION_SCAN_LIMIT: Newest-first cap on Claude Code sessions examined when no session filter is given. Claude’s jobs are session state, so an unfiltered listing would otherwise walk the whole history; the scan is reported in JobsListing::sources so a truncated answer is never silent.
CONTROLLED_JOB_HARNESSES: Harnesses whose scheduled jobs supercode can MUTATE through their own CLI verb. Strictly narrower than crate::jobs::JOB_HARNESSES: Claude Code is readable but not controllable.
CONTROLLED_PROFILE_HARNESSES: Harnesses whose profiles supercode can MUTATE through their own CLI verb. Strictly narrower than crate::profiles::PROFILE_HARNESSES: Codex profiles and supercode presets are readable but not controllable.
CONTROLLED_SESSION_HARNESSES: Harnesses whose conversations supercode can mutate through at least one of their own doors. Strictly narrower than the set it can READ.
CONTROLLED_SKILL_HARNESSES: Harnesses whose installed skills supercode can MUTATE through a door the harness publishes. Identical to SKILL_HARNESSES today: the two CLI harnesses have a verb, the core four have their loader’s directory.
DAEMON_ENTRY: The daemon entry inside the sdk/orchestrator package.
DEFAULT_RUNTIME_LEASE_TTL_MS: Default controller duration. Successful mutations and explicit heartbeats renew it; disconnect and detach release it immediately.
DEFAULT_SYSTEM_PROMPT: A default, deliberately small system prompt. Override it freely.
FRONTEND_REPLAY_CAPACITY: Maximum sequenced events retained between canonical history snapshots.
FRONTEND_RUNTIME_SCHEMA_VERSION: Frontend contract schema version.
HARNESS_AUTHENTICATION_SCHEMA: Stable schema identifier shared by authentication reports and launch plans.
HARNESS_INTEROP_SETTINGS_SCHEMA: Stable report schema shared by Rust, JSON-RPC, SDKs, and UIs.
HARNESS_SERVICE_VERSION: Protocol namespace implemented by this service.
HERMES_DEFAULT_PROFILE: Hermes’s implicit profile: HERMES_HOME itself, the profile_name IS NULL partition of state.db and the target when no route matches.
JOB_HARNESSES: Harnesses that have a scheduled-job concept at all. Every other harness answers jobs.list / jobs.get with UnsupportedAction, never an empty list — an absent verb and an empty inventory are different answers.
LOCK_FILE: Lease file the daemon writes while it serves a home, relative to the home.
MEMORY_HARNESSES: Harnesses with a memory store supercode reads, in product order. Every other harness id is MemoryError::UnsupportedHarness.
MEMORY_SCHEMA: Stable row schema shared by Rust, JSON-RPC, the SDKs, and the CLI.
NODE_BIN_ENV: Environment variable overriding the node used for the cold path (tests).
PROFILES_SCHEMA: Stable row schema shared by Rust, JSON-RPC, the SDKs, and the CLI.
PROFILE_HARNESSES: Harnesses that have a profile concept supercode reads, in product order. Every other harness id is ProfileError::UnsupportedHarness.
ROUTES_SCHEMA: Wire schema of harness.v1.routes.list.
ROUTE_HARNESSES: Harnesses with a routing concept.
RUNTIME_EVENT_METHOD: Notification method emitted for live runtime events.
RUN_HARNESSES: Harnesses that keep a run store at all. Every other harness answers runs.list / runs.get with UnsupportedAction, never an empty list — an absent store and an empty history are different answers.
SDK_SCHEMA_VERSION: Current language-neutral SDK schema.
SERVED_MODEL_KEY: Metadata key carrying the model the PROVIDER said served a response — distinct from "model", which every caller sets to the model it REQUESTED. Present only when the response actually reported one.
SERVICE_DIR: Directory setup writes the rendered service unit into.
SERVICE_NAME: launchd label / systemd unit name for the orchestrator daemon.
SESSION_ACTIVITY_EVENT_METHOD: Notification method emitted for normalized session-activity transitions.
SESSION_EVENT_METHOD: Notification method emitted for followed-session changes.
SESSION_INDEX_EVENT_METHOD: Notification method emitted for revisioned session-list changes.
SKILL_HARNESSES: Every harness that has a skills root, in product order.
SOCKET_FILE: The daemon’s local socket inside one orchestrator home.
SUPPORT_REGISTRY_SCHEMA: Schema emitted by harness_support_registry.
TOOL_ERROR_METADATA_KEY: Canonical metadata key marking a tool result as a structured error.
TOOL_OUTCOME_UNKNOWN_METADATA_KEY: Canonical metadata key marking a tool result whose outcome is unknown.
TRIGGERS_SCHEMA: Wire schema of harness.v1.triggers.list.
TRIGGER_HARNESSES: Harnesses with an inbound-trigger concept supercode can read.
UNKNOWN_MODEL_CONTEXT_FLOOR: Conservative fallback context limit for an unrecognized model.

Traits§

CourierRunner: Spawner seam for the courier process.
FrontendFacadeTransport: Transport seam consumed by the generated Rust facade client.
FrontendRuntime: Canonical live-runtime contract owned by the SDK.
Provider: Legacy provider abstraction preserved by the composition facade.
RuntimeBackend: Factory for starting, resuming, and (where the native protocol permits it) joining one harness’s already-running runtime endpoint.
RuntimeConnection: One connected harness-native runtime session.
SdkPromptSource: Renderable prompt source configured on an SDK emulation component.
SdkRuntime: Canonical live-runtime contract owned by the SDK.
SdkService: Stateful SDK facade consumed by public transport adapters.
Tool: A callable capability.
WriteObserver: P5-9 (design §2 module 20 checkpoint, §2.1 D-5 “write-path interception seam shared with formatters”): the ONE well-defined interception point around every file-mutating built-in tool (write_file/edit_file/apply_patch) — installed on ToolContext::write_observer, None by default. Both hooks fire AFTER ToolContext::check_write has already approved the call (so an observer never sees a write the sandbox itself refused) and BEFORE/AFTER the actual mutation:

Functions§

approval_harnesses: Every harness id approvals.list accepts, in registry order.
channel_status: Read one channel’s row by harness and name. status is ChannelStatus::Unknown at this tier for every harness; the verb exists so the noun is complete and the driven tier has one door to fill.
claude_user_settings_path: Claude Code’s user settings file for the configured Claude home.
clear_lease: Remove the lease file. A missing file is not an error — stop is idempotent by design.
configure_harness_interop_settings: Apply a revision-checked set of changes and return the resulting snapshot.
controlled_verbs: Every uniform verb harness can actually perform, in declaration order. Empty for a harness with no door at all.
core_messages: Canonical messages participating in cross-format fidelity scoring.
create_agent: Construct the emulation component inside the SDK ownership boundary.
daemon_entry: Locate the Node daemon entry (sdk/orchestrator/bin/orchestrator.mjs).
daemon_is_live: Whether a LIVE daemon is serving this home right now.
declared_skill_name: A skill package’s own declared name: SKILL.md frontmatter name, else the directory’s own name — exactly the rule list_skills applies, so a row installed here is found again by the name the loader will report.
discover_live_runtime: Find the newest live receipt matching a discovered source session.
discover_session_page: Discover one persisted-session page with its opaque successor cursor.
discover_sessions: Discover persisted sessions through the canonical SDK catalog owner.
find_live_runtime: Resolve one stable runtime id, requiring an explicit choice if stale or concurrent registrations would otherwise make attachment ambiguous.
forget_live_runtime: Remove only a stale attachment receipt. Canonical, sidecar, source-native, and exported session data are never addressed by this operation.
format_reply: Format an agent’s final reply for output. json wraps it as {"result": "..."}; otherwise the reply is returned as-is. The stream-json form is the live AgentEvent stream via an EventSink.
get_job: Read one job by harness and id, with the verbatim native record beside the uniform row. Ok(None) means the harness has no such job.
get_profile: Read one profile by harness and name.
get_run: Read one fire by harness and id, with the verbatim native record beside the uniform row. Ok(None) means the harness’s stores hold no such run.
harness_authentication_methods: Return the verified native authentication methods for a harness.
harness_authentication_plan: Select a method for the requested environment and create its host-owned launch plan.
harness_program
harness_support: Look up one harness in the compiled registry.
harness_support_registry
inspect_harness_authentication: Inspect redacted sign-in status using the harness’s own bounded status command.
inspect_harness_interop_settings: Inspect the interoperability controls exposed by one harness adapter.
install_service: Render the unit, hand it to the platform’s service manager, and start it.
is_tool_error: Whether a message carries the canonical structured-error marker.
landlock_available: Whether real Landlock filesystem confinement is available on THIS process’s kernel — a genuine, side-effect-free (beyond dropping one ruleset file descriptor) PARENT-PROCESS probe: it builds a CompatLevel::HardRequirement ruleset requiring exactly the write-access rights apply_linux_confinement would later request and checks whether Ruleset::create() succeeds — it deliberately never calls restrict_self() (that confines the CALLING process/thread permanently and every future child of it — calling it here would confine supercode ITSELF, exactly the “confinement targets the child, not supercode” invariant this module must never violate). Cached for the process lifetime (the kernel’s Landlock support can’t change at runtime).
list_channels: List every channel supercode can see, optionally restricted to one harness. Rows are ordered by harness (as in CHANNEL_HARNESSES) then by name.
list_jobs: Read every scheduled job the query selects.
list_live_runtimes: List every reconciled live runtime without exposing its bearer token or loopback address. Dead-process receipts are removed as part of the read.
list_profiles: List every profile supercode can see, optionally restricted to one harness. Rows are ordered by harness (as in PROFILE_HARNESSES) then by name.
list_routes: List routes, optionally for one harness and/or one target.
list_runs: Read every fire the query selects.
list_skills: List every installed skill package the query selects.
list_triggers: List inbound triggers, optionally for one harness.
lists_approvals: Whether supercode can list approvals for this harness id at all.
live_lease: The lease of a daemon that is actually alive right now.
load_session: Load one durable locator through the canonical SDK catalog owner.
load_session_path: Load an explicit transcript/store path through the SDK import boundary. An OpenCode selector is accepted only for its SQLite store.
lock_path: The lease path for one home.
mark_tool_error: Stamp a tool-result message as a structured error.
mark_tool_outcome_unknown: Stamp a tool-result message as having no structurally known outcome.
measure_fidelity: Measure an export/reload cell without applying a regression floor.
message_claude_peer: Resolve session_id in the registry and deliver text into it.
messages_equal: Compare semantic message fields shared by the supported harnesses.
messages_equal_multimodal: Compare semantics plus multimodal parts and tool names.
model_context_limit: Look up a model’s context-window size by its full provider slug.
mutate: Perform one mutation: translate to the harness’s own verb, run it, then re-read the row through the ORCH-7 loader.
mutate_skill: Perform one mutation through the harness’s own door, then re-read the row.
netns_available: Whether an unprivileged, self-contained network namespace cut-off is available on THIS process’s kernel — a real probe, but one that (unlike landlock_available) genuinely can’t be done risk-free in the calling process itself (unshare(2) acts on the CALLING process/thread, so probing it directly would isolate supercode’s own network, not just check availability). Instead this forks a disposable, single-purpose child that does nothing but attempt the unshare and immediately _exit() with the result — never touches the allocator, locks, or any other state the parent might hold mid-fork (the standard safe shape for a post-fork child that never execs), so it carries none of pre_exec’s usual multi-threaded-fork hazards. Cached for the process lifetime.
orchestrator_profile_dirs: Every profile folder under an orchestrator home, in listing order: the root (the implicit default profile) then each profiles/<name>/.
plan_reply: Translate one caller’s choice into the token and envelope a request’s own door accepts.
project_root_for: BP-9 (§3.1 core.project_root_markers, catalog:232 “Project-root detection markers”, cx§6, oc§6): the project root for cwd — the NEAREST ancestor (starting at cwd itself) that directly contains any entry named by markers. None when no ancestor carries a marker, or when markers is empty (an empty marker list is an explicit “don’t do root detection”, not an invitation to walk to /).
read_claude_peer_registry: Read every LIVE session from a Claude registry directory.
read_claude_peer_settings: Inspect only the user-level inbound setting. The report deliberately does not claim to be Claude’s effective value because managed, project, and command-line settings can have higher precedence in a particular target.
read_lease: Read the lease, whether or not its process is still alive.
register_live_runtime: Register an authenticated loopback runtime and return its opaque endpoint.
register_live_runtime_with_metadata: Register a runtime with the static fields used by list/describe output.
replay_eligible: The replayable subsequence of a canonical transcript.
resolve_live_runtime: Resolve an opaque endpoint and verify that it belongs to expected.
resume_agent: Resume canonical history inside a fresh SDK-owned emulation component.
search_memory: Search the same documents show_memory reports, line by line.
service_status: Ask the platform’s service manager about the orchestrator unit.
service_unit: Render the per-platform service unit for one home.
shell_sandbox_unenforceable: True when the requested sandbox policy cannot be enforced for shell subprocesses: a confining policy, a platform without an OS sandbox primitive wired up (only macOS/seatbelt is, via sandbox-exec), and at least one shell tool ("bash" or "shell") enabled.
show_memory: Read the memory documents the query selects.
show_model_input: BP-5 (catalog D2 “Prompt-input debugging”): render the exact model-visible input prompt would produce, as JSON, without sending anything.
skill_roots: Every (scope, root) a harness’s own loader would consult, restricted to the roots that exist right now.
socket_path: The daemon socket path for one home.
submit_agent: Submit one text turn through the SDK-owned emulation loop.
submit_agent_with_images: Submit one multimodal turn through the SDK-owned emulation loop.
supports_job_control: Whether harness can have its scheduled jobs mutated at all.
supports_jobs: Whether harness has a scheduled-job concept.
supports_memory: Whether supercode reads a memory store for this harness.
supports_profile_control: Whether harness can have its profiles mutated at all.
supports_runs: Whether harness keeps a run store.
supports_session_control: Whether harness publishes a door for at least one conversation verb.
supports_skill_control: Whether harness has any skills door supercode can drive.
tool_outcome: Return the canonical structural outcome for a tool-result message.
uninstall_service: Stop and unregister the unit, and remove the rendered file setup wrote.
update_claude_peer_settings: Set or reset Claude Code’s user-level inbound policy. expected_revision prevents an explicit UI action from overwriting settings inspected before another process changed the file.
writable_skill_roots: The roots supercode may WRITE a skill package into, in the harness’s own precedence order — the same table skill_roots reads, narrowed to the two scopes a client may address and NOT filtered by existence (an install creates the root the harness’s loader would then read).
write_claude_peer_settings: Explicitly update Claude Code’s user-level inbound policy while preserving every unrelated setting. The write is atomic, refuses symlinks, and aborts when it observes an edit between its initial read and commit.
write_lease: Write the lease for a running daemon.
write_unit: Write a rendered unit under <home>/service/.

Type Aliases§

EventSink: A sink for AgentEvents.
LifecycleHook: A lifecycle observer: receives every LifecycleEvent (observational).
Result: Result alias used throughout the crate.
StopGateHook: A stop-gate hook: receives the would-be-final assistant message; returns Some(reason) to veto termination and continue the loop (the reason is injected as a new user message), or None to allow the stop. See Config::stop_gate.

Crate supercode

Crate supercode Copy item path

Modules§

Structs§

Enums§

Constants§

Traits§

Functions§

Type Aliases§

Crate supercode