Struct ComposedSurface 

pub struct ComposedSurface { /* private fields */ }

A generated Surface plus the exact host context identity used to resolve its handles. This identity is checked again immediately before render.

Implementations

impl ComposedSurface

pub fn envelope_digest(&self) -> &str

pub fn resolved_data_ref_count(&self) -> usize

pub fn resolved_action_ref_count(&self) -> usize

pub fn action_authority_expectations(&self) -> Vec<ActionAuthorityExpectation>

Exact host-captured executable identities for the live admission fence.

pub fn validate_current( &self, context: &CompositionContext, ) -> Result<(), CompositionError>

Check that every referenced handle and the complete host context still have the exact identity captured at composition time.

pub fn validate_with_catalog( &self, context: &CompositionContext, host: &HostCapabilities, catalog: &ActionCatalog, ) -> Result<(), CompositionError>

Structural validation plus exact host catalog validation. This is the first point where model-selected action handles meet G1/G2 bindings.

pub fn render_with_store( &self, context: &CompositionContext, host: &HostCapabilities, capabilities: &NegotiatedCapabilities, catalog: &mut ActionCatalog, store: &EventStore, ) -> Result<String, CompositionError>

Durable-state-aware admission and rendering. Callers must use this method (or the existing equivalent renderer API) before displaying a composed Surface with executable actions.

pub fn admit_with_store( &self, context: &CompositionContext, host: &HostCapabilities, capabilities: &NegotiatedCapabilities, catalog: &mut ActionCatalog, store: &EventStore, ) -> Result<AdmittedComposedSurface, CompositionError>

Store-backed negotiated admission. The returned capability token is the safe production rendering surface; unsupported or stale actions have already been revoked by the G1/G2 catalog gate.

pub fn admit_with_store_and_live_fence<F>( &self, context: &CompositionContext, host: &HostCapabilities, _capabilities: &NegotiatedCapabilities, catalog: &mut ActionCatalog, store: &EventStore, live_fence: F, ) -> Result<AdmittedComposedSurface, CompositionError>

where F: FnMut(&ActionCatalog, &EventStore, Option<&LiveAdmissionSnapshot>) -> Result<LiveAdmissionSnapshot, CompositionError>,

Admission variant used by the production Agent path. Bindings are staged on an isolated catalog first; the supplied callback then queries live workspace/MCP/durable authorities before renderer validation and the final catalog commit.

pub fn admit_with_store_and_live_fence_and_publication<F, P>( &self, context: &CompositionContext, host: &HostCapabilities, _capabilities: &NegotiatedCapabilities, catalog: &mut ActionCatalog, store: &EventStore, live_fence: F, publish: P, ) -> Result<AdmittedComposedSurface, CompositionError>

where F: FnMut(&ActionCatalog, &EventStore, Option<&LiveAdmissionSnapshot>) -> Result<LiveAdmissionSnapshot, CompositionError>, P: FnOnce(&mut ActionCatalog, ActionCatalog, LiveAdmissionSnapshot, &mut F, &EventStore) -> Result<(), CompositionError>,

Admission with an explicit publication critical section. The caller owns the authority lock/version protocol in publish: it receives the staged catalog and the final pre-publication token and must perform any commit-time re-read while its guard is held before assigning the staged catalog. This keeps the final fence and publication one atomic authority decision instead of an unlocked read followed by assignment.

Trait Implementations

impl Clone for ComposedSurface

fn clone(&self) -> ComposedSurface

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ComposedSurface

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.