pub struct DaemonRequestFrame {Show 13 fields
pub ops: String,
pub presentation: Option<String>,
pub presentation_per_op: Option<Vec<Option<String>>>,
pub namespace: String,
pub actor_id: Option<String>,
pub visible_namespaces: Vec<String>,
pub config_id: String,
pub protocol_version: u32,
pub probe_only: bool,
pub metrics_only: bool,
pub format: Option<String>,
pub format_per_op: Option<Vec<Option<String>>>,
pub from_wire: bool,
}Expand description
Request frame sent from a client to the daemon.
Fields§
§ops: String§presentation: Option<String>§presentation_per_op: Option<Vec<Option<String>>>§namespace: StringThe client’s resolved storage/gate default namespace for this request.
As of protocol version 3 (ADR-096) the daemon serves the request under this namespace instead of rejecting on mismatch: a per-request identity input, not a same-process-identity assertion.
actor_id: Option<String>The client’s resolved write-stamp / gate actor identity (ADR-057),
carried on the frame so the warm daemon stamps writes with the
caller’s actor instead of its own baked actor_id (ADR-096). None
mints ActorRef::anonymous(), matching an unconfigured actor.
visible_namespaces: Vec<String>The client’s resolved extra read-visibility namespaces (ADR-007 Rule
3b), carried on the frame so the warm daemon widens read scope to
match the caller’s own configuration rather than its own baked
visible_namespaces (ADR-096). Empty means no extra visibility beyond
namespace itself.
config_id: StringFingerprint of the client’s engine-coherence config: packs, db target,
embedders, backend routing, and construction-baked outbound policy.
Identity fields are carried separately in this frame. The daemon rejects
a request whose config_id differs from its own so a restricted client
(e.g. --pack kg, --db :memory:) never dispatches through the broader
default daemon. See ADR-027 / ADR-049 / ADR-096.
protocol_version: u32IPC protocol version sent by the client. Pre-versioning clients omit
this field (deserializes to 0). The daemon compares against
PROTOCOL_VERSION and rejects mismatches with an explicit error.
probe_only: boolWhen true, the daemon returns an identity frame (ok=true, result=None)
immediately after identity validation — without calling the dispatcher.
Used by the client’s under-lock recovery probe to confirm a daemon is
alive and identity-matching without dispatching any mutating verb.
Pre-probe clients omit this field (deserializes to false → normal dispatch).
metrics_only: boolWhen true, the daemon returns a point-in-time MetricsSnapshot of
its server-side gauges (a read-only measurement surface for the
load/perf harness) instead of dispatching any op. Handled before the
config_id equality reject: a gauge read is process-global and
namespace/config-agnostic, not a namespaced record operation.
READ-ONLY — this field is the only input the frame accepts for a
metrics request; there is no reset or mutation reachable over the
wire. Pre-metrics clients omit this field (deserializes to false →
normal dispatch, unaffected).
format: Option<String>Output format for this request (ADR-078). Forwarded to the daemon’s
serialization seam. None means use the daemon’s resolved default.
format_per_op: Option<Vec<Option<String>>>Per-operation output format overrides (ADR-078).
from_wire: boolWhether this request originated from the agent-facing MCP request
tool (the wire surface). When true, the daemon rejects
Visibility::Subhandler verbs: agents must not invoke internal
subhandlers. When false (the default, and the only value any
operator path sends), subhandlers are allowed: kkernel exec and
other in-process callers are trusted operator surfaces.
This is the origin discriminator, not a daemon-vs-local one: operator requests flow through the daemon by default too, so the gate cannot key on transport.