deepstrike_core/runtime/kernel/
wire.rs

1//! Canonical Kernel ABI — wire contract (revision 3).
2//!
3//! One envelope, five input classes, one root entry, strict tagged unions and cross-language
4//! scalar rules. This is the only host/kernel input contract; no compatibility adapter or
5//! inferred revision exists.
6//!
7//! Layout:
8//!
9//! | module | contract |
10//! | --- | --- |
11//! | [`scalar`] | §7.1.1 cross-language scalar and projection rules |
12//! | [`envelope`] | §7.1 envelope, §7.2 five-class taxonomy, decode boundary |
13//! | [`config`] | §7.3 configuration's position in the taxonomy (fields: Task 5) |
14//! | [`root`] | §7.4 root entry, execution focus, logical start payloads |
15//! | [`command`] | §7.5 host control plane |
16//! | [`syscall`] | §7.6 P1 syscall requests and derived causation |
17//! | [`event`] | §7.7 external events |
18//! | [`effect`] | §7.9 effect outcome's position in the taxonomy (fields: Task 4) |
19//! | [`checkpoint`] | §12.1 logical checkpoint + bounded tail |
20//! | [`restore`] | §12.2 bounded-tail restore |
21
22use serde::{Deserialize, Serialize};
23
24pub mod binding;
25pub mod checkpoint;
26pub mod command;
27pub mod config;
28pub mod driver;
29pub mod effect;
30pub mod envelope;
31pub mod event;
32pub mod fault;
33pub mod projection;
34pub mod record;
35pub mod restore;
36pub mod root;
37pub mod scalar;
38pub mod syscall;
39pub mod terminal;
40pub mod transaction;
41
42#[cfg(test)]
43mod tests;
44
45pub use binding::CanonicalKernel;
46pub use checkpoint::*;
47pub use command::*;
48pub use config::*;
49pub use driver::{CanonicalOperationDriver, PlannedStep};
50pub use effect::*;
51pub use envelope::*;
52pub use event::*;
53pub use fault::*;
54pub use projection::*;
55pub use record::*;
56pub use restore::*;
57pub use root::*;
58pub use scalar::*;
59pub use syscall::*;
60pub use terminal::*;
61pub use transaction::*;
62
63/// The single supported wire revision. Bindings export this core-owned value so host SDKs do not
64/// maintain independent ABI constants.
65pub const KERNEL_ABI_VERSION: u32 = 3;
66
67/// Absolute structural boundary applied **before** any JSON is parsed (§7.3).
68///
69/// These are build/construction-time safety limits, not operation configuration:
70/// `OperationConfig.kernel_limits` may only tighten them, never widen them. Enforcing them
71/// pre-parse is the point — a bound checked after `serde_json` has already materialised the
72/// document is a bound the attacker already spent.
73#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
74#[serde(deny_unknown_fields)]
75pub struct KernelBootstrapLimits {
76    pub absolute_max_input_bytes: u32,
77    pub absolute_max_json_depth: u16,
78    pub absolute_max_collection_entries: u32,
79}
80
81impl KernelBootstrapLimits {
82    /// 16 MiB matches the historical kernel input ceiling; depth and per-container entry bounds
83    /// are explicit and required by the canonical decode path.
84    pub const DEFAULT: Self = Self {
85        absolute_max_input_bytes: 16 * 1024 * 1024,
86        absolute_max_json_depth: 64,
87        absolute_max_collection_entries: 65_536,
88    };
89}
90
91impl Default for KernelBootstrapLimits {
92    fn default() -> Self {
93        Self::DEFAULT
94    }
95}
deepstrike_core/runtime/kernel/wire.rs

deepstrike_core/runtime/kernel/
wire.rs
