Module object 

Core object primitives extracted from the monolith.

Re-exports

pub use manifest::BuiltManifest;

pub use manifest::FsckFinding;

pub use manifest::FsckOptions;

pub use manifest::FsckReport;

pub use manifest::FsckRule;

pub use manifest::ManifestBinding;

pub use manifest::ManifestBuildError;

pub use manifest::ManifestFacet;

pub use manifest::ManifestKey;

pub use manifest::ManifestNode;

pub use manifest::ManifestNodeSource;

pub use manifest::ManifestObject;

pub use manifest::ManifestObjectKind;

pub use manifest::ManifestOwnerKind;

pub use manifest::PackRangeAudit;

pub use manifest::PackRangeClaim;

pub use manifest::PackRecord;

pub use manifest::build_manifest;

pub use manifest::expand_manifest;

pub use manifest::fsck_manifest;

pub use manifest::fsck_manifest_with;

pub use manifest::fsck_pack_range;

pub use tree_walk::TreeIntegrityEvent;

pub use tree_walk::walk_tree_integrity;

pub use collaboration::*;

Modules

collaboration

manifest

Canonical manifest/object encodings and fsck rules for the immutable CAS.

tree_walk

Tree integrity walking — single traversal for reference and content checks.

Structs

Action

An action records an operation between states.

ActionId

Unique identifier for an action (derived from content).

Agent

AI agent identity that performed changes on behalf of a principal.

AnnotatedTag

A byte-exact annotated Git tag object.

AnnotatedTagMarker

The native marker that owns an outer annotated-tag object.

Annotation

A stable logical annotation with revision history.

AnnotationRevision

A single revision of a logical annotation.

Attribution

Attribution for a change (who did it).

BindingDelta

Content-addressed state binding delta.

Blob

A blob stores raw file contents.

BranchCreatedV1

Branch creation operation body.

ByteSpan

Half-open byte range in the source blob. Spans are provenance metadata: they are encoded for navigation, but excluded from semantic digests.

ChangeId

A rewrite-stable logical change identifier (16 bytes / 128 bits).

ChangeLineage

ConflictRange

Zero-based, half-open line range (start_line..end_line).

ConflictRegion

One independently addressable conflict region in a file.

ConflictSide

Provenance and integrity information for one side of a conflict region.

ContentHash

A BLAKE3 content hash (32 bytes / 256 bits).

ContextBlob

A collection of logical annotations for a single target.

ContextSuggestion

CursorMovedV1

Cursor movement operation body.

Discussion

DiscussionReference

One durable entity reference embedded in a discussion turn.

DiscussionTurn

DiscussionsBlob

FileBindingDelta

Complete replacement edges for one source file in a binding delta.

FileChange

A single file change with path and kind.

FileChangeSet

A collection of file changes with convenience accessors.

FileProvenance

ImportBinding

One name introduced by an import, in canonical source order.

ImportEntry

One unresolved, source-local import record.

KeyBinding

A signing key’s role within an identity’s provenance chain.

KeyBindingRegistry

Versioned, authority-signed checkpoint of the key-binding registry.

LineSpan

MarkerName

Name of a heddle marker (tag-like construct).

NativeToolCallRefV1

Native harness tool-call identity.

OccurrenceEntry

One unresolved symbol occurrence, numbered in source order.

OperationId

Origin

OriginSet

Principal

Human identity accountable for changes.

ProducerId

Identifies the producer that fired this signal. The version lets budgeting and signal-health surfaces age out signals from old producer versions without re-running computation — important when we tune a producer’s heuristics and want to compare apples to apples.

PurgeEvidence

Separately signed evidence authorizing irreversible byte deletion.

Redaction

A redaction declaration on a single blob in a single state.

RedactionsBlob

On-disk blob containing all redactions for a single blob hash. One file per redacted blob, encoded with rmp-serde — matches the ReviewSignaturesBlob pattern.

ReservedRefNameError

Rejection when a user thread or marker name occupies heddle/.

ResolvedSemanticEdge

A resolved occurrence-to-definition edge.

ResolvedTreeTarget

Successful resolution of a path within a tree.

ReverseDependencyIndex

Content-addressed file → importers map for one state.

ReviewSignature

ReviewSignaturesBlob

RiskSignal

RiskSignalBlob

Top-level encoded blob referenced by a risk-signal state attachment.

Scope

Checkout/lane scope identifier for scoped operations.

ScopeEntry

A deterministic source-local scope. local_id is assigned in preorder.

SemanticFileFacts

Canonical source-local facts assembled into a SemanticFileNode.

SemanticFileNode

The per-file semantic node: deterministic source-local facts extracted from one source blob plus their reformat-stable digest.

SemanticGraphQueryRequest

weft#451 Tier-2 request body. Hosted RPC names remain residual in weft.

SemanticGraphQueryResponse

weft#451 Tier-2 response body. index_present is false when the state has no attached semantic index; the query then returns empty collections and never computes one.

SemanticGraphRef

One persisted reference to a definition, reconstructed without parsing.

SemanticIndexRoot

Root of a state’s semantic index. Attached to a state via StateAttachmentBody::SemanticIndex.

SemanticTreeEntry

One child edge of a SemanticTreeNode.

SemanticTreeNode

A semantic directory node mirroring a source Tree.

Session

SessionSegment

SignalAnchor

Where in the change a signal fires. Symbol-level is preferred — symbols are durable across renames; line ranges are computed at fire time and drift as code is reformatted.

SpoolId

SpoolIdParseError

State

Immutable source-history state. state_id is recomputed from every encoded field; mutable repository metadata lives in StateAttachment objects.

StateAttachment

StateAttachmentId

StateId

Content-addressed identity of an immutable state core.

StateSignature

Signature information for a state.

StateVisibility

A visibility-tier declaration on a single state.

StateVisibilityBlob

On-disk blob containing all visibility records for a single state. One file per state, encoded with rmp-serde — mirrors the RedactionsBlob sidecar pattern.

StructuredConflict

SuggestionInputs

SuggestionSignal

SymbolAnchor

Durable symbol-level anchor: a file path plus a symbol name. No line range — line numbers move under reformatting; symbols do not.

SymbolEntry

One symbol defined in a source file.

SyntheticFrontierName

Type-distinct name of a synthetic frontier root.

ThreadName

Name of a heddle thread (branch-like construct).

TimelineBranchId

TimelineOperationEnvelope

A v1 timeline operation envelope.

TimelineOperationId

Content-addressed identifier for a timeline operation envelope.

TimelineStepId

TimelineToolPayloadMetadata

Scrubbed metadata for native tool payloads.

ToolCallFinishedV1

Tool-call finish operation body.

ToolCallStartedV1

Tool-call start operation body.

Tree

TreeEntry

Verification

Verification information for a state.

Enums

AnnotatedTagError

AnnotationKind

The canonical annotation taxonomy the product surfaces.

AnnotationScope

What part of a file an annotation targets.

AnnotationStatus

ChangeIdParseError

Error parsing a ChangeId.

ChangeImportance

How important is this change for review.

ChangeLineageKind

ConflictError

ContextError

ContextSuggestionTier

ContextTarget

A typed target for context entries.

DiffKind

Kind of file change.

DiscussionError

DiscussionReferenceKind

Kind of entity named by a DiscussionReference.

DiscussionResolution

EntryType

FileMode

ImportKindTag

Source-level import form. Resolution to repository paths happens later.

KeyBindingError

KeyRole

Capability granted to a key by an authority-signed registry checkpoint.

LeafPolicy

How a tree-path walk classifies and materializes the terminal entry.

ModificationKind

What kind of modification was made to a file.

OccurrenceRole

Role played by a source-level symbol occurrence.

Operation

Type of operation performed.

OperationIdParseError

ProvenanceError

RedactionError

Errors produced while encoding/decoding redactions.

ReviewKind

Reviewer roles. New variants append at the tail; the wire format stays backwards compatible because serde emits the snake-case discriminant.

ReviewScope

Reviewer signed off on the whole change, or on a specific list of symbols.

ReviewSignatureError

RiskSignalError

RiskSignalKind

Why a signal fired. Variants are wire-stable; new variants are appended.

ScopeKind

Source-local lexical scope classification.

SemanticChange

A semantic change description.

SemanticEdgeKind

The relationship represented by a resolved source occurrence.

SemanticEntryKind

The kind of a SemanticTreeEntry’s target.

SemanticGraphQueryKind

Graph primitive selected by heddle semantic refs and the weft#451 wire.

SemanticIndexError

SignatureStatus

Signature verification result.

StalenessStatus

Result of checking an annotation’s freshness against current code.

StateAttachmentBody

StateAttachmentKind

The kind of a StateAttachmentBody, with the payload projected away.

StateIdParseError

StateVisibilityError

Errors produced while encoding/decoding/validating state visibility.

Status

Lifecycle status of a state.

SymbolKindTag

Durable symbol classification shared by semantic extraction, indexes, and review payloads so types, traits, enums, modules and the rest remain first-class without conversion tables.

SymbolNamespace

Namespace in which a binding or occurrence participates.

SyntheticFrontierNameError

Why a synthetic frontier name could not be built or parsed.

TimelineBranchReason

Why a timeline branch was created.

TimelineCodecError

Timeline operation codec error.

TimelineCursorMoveReason

Why the timeline cursor moved.

TimelineLabel

Safety labels attached to timeline operations.

TimelineOperationBodyV1

V1 timeline operation body variants.

TimelineOperationIdParseError

Error parsing a timeline operation id.

TimelineOperationKind

Explicit timeline operation kind stored in every operation envelope.

TimelineToolCallStatus

Tool-call terminal status.

TreeDecodeError

TreeEntryTarget

TreeError

TreePathResolveError

Errors surfaced by resolve_tree_path that callers map to their own messages.

VisibilityTier

Content-side visibility tier. Shared by annotations, discussions, and states so the per-commit visibility tiers and annotation/discussion visibility draw from one vocabulary rather than parallel enums.

Constants

GIT_SYNTHETIC_FRONTIER_PREFIX

Git-side prefix for the same roots. Disjoint from refs/heads/.

HIGH_SUGGESTION_THRESHOLD

KEY_BINDING_REGISTRY_SIGNING_PAYLOAD_VERSION_TAG

Domain separator for authority signatures over registry checkpoints.

KEY_BINDING_SIGNING_PAYLOAD_VERSION_TAG

Domain separator for signatures that authorize a KeyBinding.

MAJOR_REWRITE_THRESHOLD_PCT

MAX_REASON_LEN

Maximum length of RiskSignal::reason, in bytes.

MEDIUM_SUGGESTION_THRESHOLD

PURGE_SIGNING_PAYLOAD_VERSION_TAG

Domain separator for a destructive purge authorization.

REDACTION_SIGNING_PAYLOAD_VERSION_TAG

Stable byte prefix the signing payload begins with. Bumping this invalidates signatures written with an older prefix unless verification also gains explicit version dispatch. Version 3 separates reversible redaction authority from destructive purge authority.

RESERVED_REF_SEGMENT

First path segment reserved for Heddle-internal refs.

STATE_VISIBILITY_SIGNING_PAYLOAD_VERSION_TAG

Stable byte prefix the signing payload begins with. Bumping this versions the payload format itself; old signatures with the old prefix continue to verify exactly as they did when written.

SUGGESTION_WINDOW

SYNTHETIC_FRONTIER_PREFIX

Wire and local-store prefix for synthetic frontier roots.

TIMELINE_OPERATION_SCHEMA_VERSION

Current timeline operation schema version.

Traits

ObjectSource

Read-only object access needed by object graph walkers.

Functions

annotation_status_for_source

Check an annotation’s staleness against already-loaded source bytes.

annotation_status_for_source_with_symbol_resolver

Check an annotation’s staleness with an injected symbol resolver.

compute_dir_semantic_digest

Compute a directory node’s semantic_digest over its entries.

compute_file_scaffold_hash

Hash the file’s scaffold: the residual non-definition top-level token stream (every leaf under the file root not covered by an extracted symbol’s span). This is what binds use-decl swaps, impl Trait headers, attribute edits, macro_rules! bodies and definition-free files (re-export-only libs, top-level statements) into the file digest — semantic content that lives outside any extracted symbol.

compute_file_semantic_digest

Compute a file node’s semantic_digest over its scaffold and canonical source-local facts. Spans are deliberately excluded from this identity.

compute_symbol_semantic_hash

Compute a symbol’s normalization-stable semantic_hash.

diff_trees

Collect all file changes between two trees.

diff_trees_visit

Diff two trees with internal iteration, invoking visitor for each FileChange in traversal order.

extract_line_range

Extract bytes for a line range from source content.

generate_discussion_id

generate_session_id

is_reserved_heddle_namespace

True when name occupies the reserved heddle/ namespace.

parse_commit_extension_headers

Parse the extension headers from a raw git commit object’s content bytes (the bytes git cat-file commit <sha> prints — i.e. gix’s Commit::data), in their exact on-the-wire order, ready to store in State::extra_headers.

resolve_current_symbol

Resolve a symbol using the stored line range.

resolve_tree_path

Walk path from root through nested subtrees and resolve the terminal entry according to policy.

score_suggestions

signing_payload

Build the deterministic byte payload that a ReviewSignature is computed over. Re-implementing this in another language (TypeScript, Python) must produce byte-identical output for verification to round-trip.

split_path

Split a repository-relative path into its first component and the remainder.

validate_tree_entry_name

Type Aliases

DiscussionId

Stable opaque identifier for a discussion. Generated server-side at open time. We use a String rather than ChangeId to leave room for whatever id scheme the discussion service ends up choosing (likely a UUID).