Struct ModuleContext 

pub struct ModuleContext {
    pub ports: Ports,
    pub config: Arc<dyn Config>,
    pub events: EventBus,
    pub templates: Arc<TemplateRegistry>,
    pub venture: Arc<Venture>,
    pub unprotected_writes_accepted: bool,
    pub personal_data: Arc<PersonalDataCatalog>,
    pub ui_mounted: bool,
}

Everything a module’s router needs: its declared ports, the typed config, the bus, the templates and the venture identity.

Fields

ports: Ports

Only the ports the module declared in requires()/optional().

config: Arc<dyn Config>

Full config; module keys are prefixed (EMAIL_SIGNUP_CONFIRM_TTL_DAYS).

events: EventBus

templates: Arc<TemplateRegistry>

venture: Arc<Venture>

unprotected_writes_accepted: bool

Whether an operator has recorded an explicit acceptance that this deployment serves guarded routes it cannot fully protect (HARNESS_ALLOW_UNPROTECTED_WRITES, issue #143).

It exists because the acceptance has to mean the same thing at both layers. The boot gate honours it and serves; if the per-request gate did not, the deployment would refuse every write anyway — the same outage, with a different status code. A module enforcing an abuse control passes this to verify_human_form rather than deciding from the environment alone.

personal_data: Arc<PersonalDataCatalog>

Every personal-data declaration in this composition, composed once at build (issue: privacy module). A module reads it to export or erase a subject’s data without knowing which other modules the venture chose; most modules ignore it, which costs them an Arc clone per request.

ui_mounted: bool

true when the venture mounted a UI renderer (ADR 0010). A module then defaults its landing redirects (confirmed, expired, unsubscribed, status) to <api base>/ui/<module>/<action>/<page> instead of pages the venture site has to provide.