Module envelope

Expand description

Input envelope and the five-class input taxonomy (spec §7.1, §7.2).

Structs§

AbiRevision: The wire revision marker. Only KERNEL_ABI_VERSION decodes — §16.2 has no negotiation, no adapter and no inference from missing fields, so the revision check belongs in the type, not in one lucky code path.
ConfigureOperation: §7.2 · ConfigureOperation { config }. The 16 historical setup events collapse here.
DeliverExternalEvent: §7.2 · DeliverExternalEvent { event }.
HostControl: §7.2 · HostControl { command }. The 10 historical control events collapse here.
ResolveEffect: §7.2 · ResolveEffect { effect_id, outcome }. The 11 historical result events collapse here.
StartOperation: §7.2 · StartOperation { entry, initial_context }. The five historical start-ish events collapse into this one atomic input; initial_context lives here and only here, never duplicated inside a RootEntry variant.
WireEnvelope: The one shape a host may hand the kernel (spec §7.1 calls it KernelEnvelope).
WireRejection: A structured decode rejection.

InputAuthority: The validation path an input class enters. One per class — the type-level statement that the taxonomy is about authority rather than enum arity.
KernelInput: The closed five-class input taxonomy (§7.2).
OperationLifecycle: Operation lifecycle (§6). Wire-local on purpose: the canonical contract owns its own vocabulary rather than borrowing the legacy protocol’s.
WireRejectionKind: Why an envelope never became a typed input. Every kind is fail-closed: nothing is decoded, nothing is staged, no state moves.

decode_envelope_json: Decode one wire envelope in the mandated order: measure bytes → absolute structural boundary → probe revision → decode (§7.1). Parsing before measuring would let an oversized or pathologically nested document allocate first and be rejected second.
encode_envelope_json: Serialize an envelope back to JSON. Canonical record bytes are a separate, core-owned concern (Task 6); this is the plain wire projection.
scan_structural_boundary: Single pass over the raw bytes enforcing the absolute nesting depth and per-container entry bounds before any parser allocates. This is a boundary check, not a validator: malformed JSON is still the parser’s business.