deepstrike_core/governance/
quota.rs

1//! Declarative resource quotas evaluated at the single syscall trap (M2 资源配额).
2//!
3//! The syscall gate ([`crate::scheduler::state_machine::LoopStateMachine::gate_syscall`]) is the
4//! one chokepoint where effectful requests (`Invoke`/`Spawn`/`WriteMemory`/…) are adjudicated.
5//! Governance rules already gate tool *invocation*; this adds the OS notion of **resource
6//! quotas** to the *same* gate — without a new ABI shape — so spawning and memory writes become
7//! bounded resources rather than unconditional `Allow`s.
8//!
9//! The kernel stays pure: a quota is declarative config + the facts the kernel already tracks
10//! (running child tasks in the `TaskTable`, write timestamps from the observed clock). No I/O.
11
12use serde::{Deserialize, Serialize};
13
14/// Opt-in resource limits. An unset field imposes no limit; an unset `ResourceQuota` (the default,
15/// when [`crate::scheduler::state_machine::LoopStateMachine::set_resource_quota`] is never called)
16/// preserves the pre-M2 behavior of unconditional `Allow` for spawn / memory syscalls.
17#[derive(Debug, Clone, Default, Serialize, Deserialize)]
18pub struct ResourceQuota {
19    /// Max sub-agents in the `Running` state at once. Further `Spawn`s are denied while at cap.
20    /// *Instantaneous* — vehicle-scoped (cannot span stateless replicas; spec §2.5).
21    #[serde(default, skip_serializing_if = "Option::is_none")]
22    pub max_concurrent_subagents: Option<u32>,
23    /// L1 (RunGroup): max sub-agents spawned *cumulatively* over the whole governance domain. Unlike
24    /// `max_concurrent_subagents` this counts every spawn ever (running + completed), seeded across
25    /// members via `group_spawns_base`, so it spans N stateless top-level runs. A hard `Deny` at cap
26    /// (a completed sibling never frees a cumulative slot).
27    #[serde(default, skip_serializing_if = "Option::is_none")]
28    pub max_total_subagents: Option<u32>,
29    /// Max sub-agent nesting depth (direct children of the root loop are depth 1).
30    #[serde(default, skip_serializing_if = "Option::is_none")]
31    pub max_spawn_depth: Option<u32>,
32    /// Rolling-window memory-write rate limit as `(max_writes, window_ms)`: at most `max_writes`
33    /// successful `WriteMemory` syscalls may occur within any `window_ms` span.
34    #[serde(default, skip_serializing_if = "Option::is_none")]
35    pub memory_writes_per_window: Option<(u32, u64)>,
36    /// R3-1: max total nodes a single workflow DAG may grow to via runtime `SubmitNodes`. Once the
37    /// DAG (existing + submitted) would exceed this, the submission is denied — a backstop against an
38    /// unbounded loop-until-done. `None` = no cap.
39    #[serde(default, skip_serializing_if = "Option::is_none")]
40    pub max_workflow_nodes: Option<usize>,
41}
deepstrike_core/governance/quota.rs

deepstrike_core/governance/
quota.rs
