Module scalar 

Cross-language scalar and projection rules (spec §7.1.1).

Every rule here exists because the same value has to mean the same thing in Rust, Python, Node and WASM:

• logical u64 travels as a canonical decimal string (WireU64) so a JS number can never silently round a step sequence or a millisecond clock;
• authoritative policy ratios travel as fixed-point parts-per-million (Ppm) so no branch depends on a language’s default float;
• observation-only floats are FiniteF64 — NaN/Infinity are rejected at the boundary;
• canonical bytes are CanonicalBytes, whose JSON projection is an explicit base64 envelope rather than a bare string or a number array;
• identities, digests and opaque references are branded newtypes, never bare integers.

Structs

AttemptId

One execution attempt of a logical task.

BoundedJson

Opaque, host-supplied JSON (signal payloads, task metadata) with a bound on how much of it the kernel is willing to carry. Unbounded free-form JSON is the one shape that can defeat every downstream size budget, so the bound lives at the boundary type, not at each callsite.

CallId

Logical tool/provider call identity.

CanonicalBytes

Canonical record/checkpoint bytes.

DeliveryId

Host delivery identity for one signal delivery attempt.

EffectId

Kernel-minted identity of one pending effect.

FiniteF64

An observation-only float. NaN and ±Infinity never cross the boundary: they are not representable in JSON, they break canonical bytes, and they turn any comparison into a silent false.

HandleId

P3 context handle identity.

InputId

Caller-suppliable idempotency key for one envelope (DEC-2). Retrying the same intent with the same input_id must reach the same durable record.

MemoryBindingId

Opaque memory access binding. Never a tenant, namespace or path.

NodeId

Node identity inside a workflow DAG.

OperationId

Identity of one kernel operation. Minted once, immutable after the first accepted input.

Ppm

A ratio in [0, 1] expressed as fixed-point parts-per-million.

SignalId

Logical signal identity.

TaskId

Logical task identity. Never a host session id.

WireScalarError

A scalar rejected by a wire rule.

WireU64

A logical u64 that travels as a canonical decimal string.

WorkflowId

Logical workflow identity.

Constants

BOUNDED_JSON_MAX_DEPTH

Maximum nesting depth of an opaque JSON payload carried on the wire.

BOUNDED_JSON_MAX_ENTRIES

Maximum number of entries in any single container of an opaque JSON payload.

JS_SAFE_INTEGER_MAX

Largest integer a IEEE-754 double represents exactly. WireU64 values above it are exactly the reason logical u64 never travels as a JSON number.

MAX_ID_BYTES

Absolute byte bound for any branded identity on the wire.

SCALAR_ERROR_MARKER

Prefix of every scalar-rule rejection. WireRejection classifies on it, so all four host languages can map “this value broke a scalar rule” onto one structured error.