deepstrike_core/runtime/kernel/
wire.rs

1//! Canonical Kernel ABI — wire contract (revision 3).
2//!
3//! One envelope, five input classes, one root entry, strict tagged unions and cross-language
4//! scalar rules. This is the only host/kernel input contract; no compatibility adapter or
5//! inferred revision exists.
6//!
7//! Layout:
8//!
9//! | module | contract |
10//! | --- | --- |
11//! | [`scalar`] | §7.1.1 cross-language scalar and projection rules |
12//! | [`envelope`] | §7.1 envelope, §7.2 five-class taxonomy, decode boundary |
13//! | [`config`] | §7.3 configuration's position in the taxonomy (fields: Task 5) |
14//! | [`root`] | §7.4 root entry, execution focus, logical start payloads |
15//! | [`command`] | §7.5 host control plane |
16//! | [`syscall`] | §7.6 P1 syscall requests and derived causation |
17//! | [`event`] | §7.7 external events |
18//! | [`effect`] | §7.9 effect outcome's position in the taxonomy (fields: Task 4) |
19//! | [`checkpoint`] | §12.1 logical checkpoint + bounded tail |
20//! | [`restore`] | §12.2 bounded-tail restore |
21
22use serde::{Deserialize, Serialize};
23
24pub mod binding;
25pub mod checkpoint;
26pub mod command;
27pub mod config;
28pub mod driver;
29pub mod effect;
30pub mod envelope;
31pub mod event;
32pub mod fault;
33pub mod projection;
34pub mod record;
35pub mod restore;
36pub mod root;
37pub mod scalar;
38pub mod syscall;
39pub mod terminal;
40pub mod transaction;
41
42#[cfg(test)]
43mod crash_point;
44
45#[cfg(test)]
46mod tests;
47
48pub use binding::CanonicalKernel;
49pub use checkpoint::*;
50pub use command::*;
51pub use config::*;
52pub use driver::{CanonicalOperationDriver, PlannedStep};
53pub use effect::*;
54pub use envelope::*;
55pub use event::*;
56pub use fault::*;
57pub use projection::*;
58pub use record::*;
59pub use restore::*;
60pub use root::*;
61pub use scalar::*;
62pub use syscall::*;
63pub use terminal::*;
64pub use transaction::*;
65
66/// The single supported wire revision. Bindings export this core-owned value so host SDKs do not
67/// maintain independent ABI constants.
68pub const KERNEL_ABI_VERSION: u32 = 3;
69
70/// Absolute structural boundary applied **before** any JSON is parsed (§7.3).
71///
72/// These are build/construction-time safety limits, not operation configuration:
73/// `OperationConfig.kernel_limits` may only tighten them, never widen them. Enforcing them
74/// pre-parse is the point — a bound checked after `serde_json` has already materialised the
75/// document is a bound the attacker already spent.
76#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
77#[serde(deny_unknown_fields)]
78pub struct KernelBootstrapLimits {
79    pub absolute_max_input_bytes: u32,
80    pub absolute_max_json_depth: u16,
81    pub absolute_max_collection_entries: u32,
82}
83
84impl KernelBootstrapLimits {
85    /// 16 MiB matches the historical kernel input ceiling; depth and per-container entry bounds
86    /// are explicit and required by the canonical decode path.
87    pub const DEFAULT: Self = Self {
88        absolute_max_input_bytes: 16 * 1024 * 1024,
89        absolute_max_json_depth: 64,
90        absolute_max_collection_entries: 65_536,
91    };
92}
93
94impl Default for KernelBootstrapLimits {
95    fn default() -> Self {
96        Self::DEFAULT
97    }
98}
deepstrike_core/runtime/kernel/wire.rs

deepstrike_core/runtime/kernel/
wire.rs
