Module effect 

Kernel effects, their resolutions and the payload shapes both sides carry (spec §7.8, §7.9, §7.10).

Three rules shape this module:

1. An effect is something the host must execute and report back. Terminals, observations, synchronous compaction, knowledge sweeps and budget reports left the union (§7.8, §22.7): they are facts, not commands, so they can never sit in the pending-effect table waiting for a resolution that will never come.
2. Every effect has exactly one matching success payload and the same failure path. EffectKindTag::expected_success is a bijection onto EffectSuccessTag, and KernelEffect::accept_outcome refuses any other pairing — a host cannot answer a QueryMemory with a provider message. Milestone evaluation is not special: it fails through the same HostEffectFailure as everything else (B7).
3. The kernel never retries (DEC-5). A Failed outcome triggers exactly one policy decision; retryable is host diagnostics, not an instruction, and a host that wants the same intent attempted again must ask for it with a new causation.

Two omissions are deliberate. No outcome payload carries a wall clock (DEC-2) — the envelope’s accepted time is the only clock fact — and no external payload carries a filesystem path (§7.10 rule 7): PayloadRef is an opaque locator the kernel never interprets.

Structs

ApprovalRequest

ApprovalSuccess

ArchivePageOutEffect

ArchiveReceipt

CallProviderEffect

CanonicalMemoryQuery

CanonicalMemoryWrite

A memory write the kernel authored from a model proposal (§7.6).

CollapsedPayload

Digest

Content digest of a payload or record. Algorithm-prefixed (sha256:…) so a future algorithm change is visible on the wire rather than silently reinterpreted.

EffectFailed

The failure arm — identical for every effect kind (§7.9).

EffectResolutionMismatch

A host answered a pending effect with the success payload of a different effect kind.

EffectSucceeded

The success arm. The effect kind is implied by the effect being resolved and by result’s own tag; the host never restates the effect id’s kind here.

EvaluateMilestoneEffect

ExecuteToolsEffect

ExternalResidency

ExternalToolResult

A tool result whose body the host persisted before submitting.

HostEffectFailure

What the host can say about a failure. No wall clock, no host path, no stack, no raw vendor error — only facts the kernel can act on and replay. Vendor diagnostics belong in the host’s own log, never in a kernel recovery decision.

InlinePayload

A payload the host paged back in. digest and original_size let the kernel verify it is the same body it archived.

InlineToolResult

KernelEffect

One action the kernel published and is now waiting on.

LaunchToken

Kernel-minted idempotency token for one task launch. The host keys its own launch deduplication on it, which is what makes “the kernel does not retry” (DEC-5) safe: a host re-attempt with the same token is the same launch, not a second child.

LoadPayloadEffect

MemoryAccessBinding

The operation’s memory authority, carried on every memory effect so the host never has to infer it. Opaque: never a tenant, a namespace or a path.

MemoryCapabilities

MemoryPersistReceipt

MemoryPersistedSuccess

MemoryQueriedSuccess

MemoryRecall

MemoryRecordRef

Opaque handle for one persisted memory record. Never a tenant, namespace or path.

MilestoneCheckResult

A milestone verdict. Note what is not here: an error field. Milestone execution failures travel the same HostEffectFailure path as every other effect (B7) instead of being folded into the verdict, so “the verifier could not run” and “the verifier said no” stay distinct.

MilestoneEvaluatedSuccess

MilestoneRequest

Which phase of which contract the host must evaluate — and nothing else.

PageOutArchivedSuccess

PageOutPayload

The body the host must archive under pressure, with the facts the kernel keeps afterwards. After the resolution only the handle, digest, size and preview survive in core (§7.10 rule 5).

PagedOutResidency

PayloadLoadedSuccess

PayloadRef

Opaque locator for a payload the host persisted (§7.10 rule 7).

PersistMemoryEffect

PreemptTasksEffect

ProviderCompleted

ProviderContextOverflow

ProviderMessage

A message on the provider boundary. Distinct from LogicalMessage: a rendered/returned message can carry tool calls, an initial-context message cannot.

ProviderSuccess

QueryMemoryEffect

RenderedContext

What the kernel rendered for one provider call.

RequestApprovalEffect

ResidentPayload

SpawnTasksEffect

TaskAlreadyFinished

TaskAttemptRef

TaskLaunch

One child launch the host must perform.

TaskLaunchFailed

TaskLaunchFailure

Per-launch failure. Reuses the cross-effect classification so a launch failure is triaged with the same vocabulary as every other host failure.

TaskLaunchOutcome

The launch acknowledgement. Historically this was an unconditional echo of the ids with a hard-coded empty failure list, so “spawned” and “actually started” were indistinguishable.

TaskLaunchStarted

TaskPreemptFailed

TaskPreemptOutcome

TaskPreempted

TasksPreemptedSuccess

TasksSpawnedSuccess

ToolCall

ToolResult

An inline tool result body. call_id lives on InlineToolResult, not here — one id, one place.

ToolSchema

ToolsSuccess

WorkflowBudget

Enums

EffectKind

The closed set of actions a host must execute and report back.

EffectKindTag

The discriminant of EffectKind, usable without a payload.

EffectOutcome

The single entry point for the outcome of a kernel-owned pending effect.

EffectSuccess

The closed per-effect success union. One variant per EffectKind, no more and no fewer.

EffectSuccessTag

The discriminant of EffectSuccess, usable without a payload.

HostEffectFailureKind

The stable, cross-effect executor failure classification (§7.9).

PayloadResidency

Where a P3 handle’s body currently lives.

ProviderOutcome

A provider call that reached the vendor and came back with something the kernel can reason about. now_ms is gone (DEC-2): the historical field fed the governance rate limiter directly and changed the byte fingerprint of every redelivery, which made idempotent replay unreachable on the highest-frequency path in the system.

ProviderStopReason

Typed stop reason — the canonical vocabulary every provider family maps onto.

TaskLaunchStatus

TaskPreemptStatus

ToolResultDisposition

Can the batch continue past this result?

ToolResultPayload

One tool result, either inline or already persisted by the host.