Module dispatch 

Deciding whether a flight may fly, and what starting it would mean.

Why this is separate from spawning

Everything here is a refusal that should happen before a process exists. A flight down an edge the route map does not permit, a chain with no Hops left, an itinerary out of Fuel — each of those is cheaper to catch now than after a CLI has started and begun spending.

Keeping the decision apart from the act also means it can be tested exhaustively without a process in sight, which matters because this is where the safety rails actually bite. A rail that is only exercised through a real spawn is a rail tested a handful of times.

The order the checks run in

Ground Stop, then route, then rails. Not arbitrary:

• Ground Stop first, because when everything is meant to have stopped, the reason a flight was refused should be “everything is stopped” and not a detail about that particular flight.
• Route before rails, because “that edge does not exist” is a fact about the factory’s definition and will be true on every attempt, whereas “no Fuel left” is a fact about this chain right now. Reporting the permanent problem first saves somebody re-triggering work that was never going to be permitted.

Structs

Authorised

A flight that may fly, and what it costs the chain.

Enums

Refusal

Why a flight will not be flown.

Functions

authorise

Decides whether flight may be flown, and against which agent.

declared_env

Resolves the environment an agent needs: its own CLI’s credentials and its MCP servers’.

declared_values

Explicit values an agent’s MCP servers set, as opposed to names they read from the environment.