deepstrike_core/runtime/kernel/
wire.rs

1//! Canonical Kernel ABI — wire contract (revision 3).
2//!
3//! One envelope, five input classes, one root entry, strict tagged unions and cross-language
4//! scalar rules. This is the only host/kernel input contract; no compatibility adapter or
5//! inferred revision exists.
6//!
7//! Layout:
8//!
9//! | module | contract |
10//! | --- | --- |
11//! | [`scalar`] | §7.1.1 cross-language scalar and projection rules |
12//! | [`envelope`] | §7.1 envelope, §7.2 five-class taxonomy, decode boundary |
13//! | [`config`] | §7.3 configuration's position in the taxonomy (fields: Task 5) |
14//! | [`root`] | §7.4 root entry, execution focus, logical start payloads |
15//! | [`command`] | §7.5 host control plane |
16//! | [`syscall`] | §7.6 P1 syscall requests and derived causation |
17//! | [`event`] | §7.7 external events |
18//! | [`effect`] | §7.9 effect outcome's position in the taxonomy (fields: Task 4) |
19//! | [`checkpoint`] | §12.1 logical checkpoint + bounded tail |
20//! | [`restore`] | §12.2 bounded-tail restore |
21
22use serde::{Deserialize, Serialize};
23
24pub mod binding;
25pub mod checkpoint;
26pub mod command;
27pub mod config;
28pub mod driver;
29pub mod effect;
30pub mod envelope;
31pub mod event;
32pub mod fault;
33pub mod record;
34pub mod restore;
35pub mod root;
36pub mod scalar;
37pub mod syscall;
38pub mod terminal;
39pub mod transaction;
40
41#[cfg(test)]
42mod tests;
43
44pub use binding::CanonicalKernel;
45pub use checkpoint::*;
46pub use command::*;
47pub use config::*;
48pub use driver::{CanonicalOperationDriver, PlannedStep};
49pub use effect::*;
50pub use envelope::*;
51pub use event::*;
52pub use fault::*;
53pub use record::*;
54pub use restore::*;
55pub use root::*;
56pub use scalar::*;
57pub use syscall::*;
58pub use terminal::*;
59pub use transaction::*;
60
61/// The single supported wire revision (§16.2). There is no negotiation, no adapter and no
62/// inference from missing fields: anything else is a structured rejection.
63///
64/// Single source of truth — the bindings export this constant instead of each host hard-coding
65/// its own copy.
66pub const KERNEL_ABI_VERSION: u32 = 3;
67
68/// Revision of the logical checkpoint format, carried on the wire as `checkpoint_version`.
69///
70/// This remains a separate revision axis so retired recovery-format values cannot collide with the
71/// logical checkpoint boundary check.
72pub const KERNEL_CHECKPOINT_VERSION: u32 = 1;
73
74/// Absolute structural boundary applied **before** any JSON is parsed (§7.3).
75///
76/// These are build/construction-time safety limits, not operation configuration:
77/// `OperationConfig.kernel_limits` may only tighten them, never widen them. Enforcing them
78/// pre-parse is the point — a bound checked after `serde_json` has already materialised the
79/// document is a bound the attacker already spent.
80#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
81#[serde(deny_unknown_fields)]
82pub struct KernelBootstrapLimits {
83    pub absolute_max_input_bytes: u32,
84    pub absolute_max_json_depth: u16,
85    pub absolute_max_collection_entries: u32,
86}
87
88impl KernelBootstrapLimits {
89    /// 16 MiB matches the historical kernel input ceiling; depth and per-container entry bounds
90    /// are new — the legacy decode path had neither.
91    pub const DEFAULT: Self = Self {
92        absolute_max_input_bytes: 16 * 1024 * 1024,
93        absolute_max_json_depth: 64,
94        absolute_max_collection_entries: 65_536,
95    };
96}
97
98impl Default for KernelBootstrapLimits {
99    fn default() -> Self {
100        Self::DEFAULT
101    }
102}
deepstrike_core/runtime/kernel/wire.rs

deepstrike_core/runtime/kernel/
wire.rs
