Module record

Expand description

The durable kernel record, its canonical bytes and its digest chain (spec §8.1, §8.2, §12.1, §15.2).

Three properties define this module, and every public item exists to make one of them unrepresentable-if-violated rather than merely documented:

Core is the only implementation of canonical bytes and digests (§15.2). A record is built by KernelRecord::chain, which computes every digest itself; the fields are private and read-only, so a host cannot hand-assemble a record or re-serialise one to recompute a hash. Decoding a record re-verifies it, which is why a tampered journal entry fails at the boundary instead of somewhere deep in a replay.
The durable record never carries the planned step (§8.1, §22.12). It stores the normalised input plus a step_digest; a rebuild re-runs the deterministic transition over the canonical input and compares digests. That is what keeps rendered provider contexts and large action payloads out of the journal, so record size is a function of the input, never of the step it produced.
The chain is the operation’s identity (§12.1). The genesis record binds the ResolvedOperationConfig — not the sparse config, and not “whatever this binary defaults to today” — and carries no previous digest at all; its record_digest is the operation’s genesis_digest.

Structs§

ChainAnchor: Everything a chain successor needs to know about its predecessor.
KernelRecord: One durable transition (§8.1).
NormalizedInput: One accepted envelope after normalisation — the shape whose canonical bytes the record stores (§12.1 calls the serialised form a CanonicalInput).
ResolvedConfiguration

NormalizedPayload: The five input classes after normalisation. Same tag vocabulary as KernelInput — a record does not invent a second name for an input class.
RecordError: Why a record could not be built, decoded or verified.

CANONICAL_MAX_DEPTH: Nesting bound of the canonical writer. Well above the §7.3 bootstrap depth ceiling: this is a stack guard for a recursive writer, not a second contract limit.
DIGEST_ALGORITHM: Digest algorithm label. Carried in every Digest as an explicit sha256: prefix so a future algorithm change is a visible wire change rather than a silent reinterpretation.
RECORD_ERROR_MARKER: Prefix of every record-layer rejection, so all four hosts can classify on one marker.

canonical_bytes: Serialise a value to canonical bytes.
canonical_digest: SHA-256 over exactly these bytes, projected as sha256:<64 lowercase hex digits>.
verify_record_chain: Verify a whole chain and return the operation’s genesis_digest (§12.1).

RecordPreparation: The §7.13 preparation result once its durable half is known: KernelRecord is the Record instance of [KernelPreparation], and Task 7 fills in the ephemeral planned step.