Expand description
Context Gateway v1 — the canonical, public decision contract.
Every governed piece of context carries a ContextObjectPassportV1; the
gateway records one ContextDecisionV1 per object and summarises a
delivery in one ContextDecisionReceiptV1, which is the single source for
audit, HUD and SDK surfaces. The contract never carries content, secret
values or detector matches — only digests, counts and reason codes.
Field-level invariants (principal, coverage, reason codes) are enforced at
construction and deserialization; cross-field invariants by validate(),
which derive and canonical_digest call. All of them fail closed:
- an unknown principal is explicit and never carries an identity;
- classification only ever rises through derivation (
ClassificationV1::join); - destination constraints only accumulate;
- a detector may not report more coverage than it inspected;
- a receipt’s security counts must equal its per-object decisions.
Structs§
- Context
Decision Receipt V1 - One governed delivery: who asked, for what, what was considered, what was withheld and why, what reached which destination under which policy.
- Context
Decision V1 - The gateway’s decision about one object. Anything but a plain
Allowmust say why. - Context
Object Passport V1 - Security and optimisation metadata that travels with one object. Content is referenced by digest, never embedded.
- Context
Quality Section V1 - Deterministic context-quality evidence for one round.
- Destination
V1 - Where the compiled context is delivered. Models LeanCTX itself uses (detectors, summarisers) are destinations too.
- Detector
Coverage V1 - What a detector actually looked at. A result never implies more coverage than recorded here.
- Detector
RefV1 - Detector
Signal V1 - One detector’s normalised result. Carries counts only — never the matched value — so telemetry and receipts cannot leak what was detected.
- Policy
RefV1 - The exact policy that decided: identity, optional version, content digest.
- Principal
V1 - Who requested the context.
Unknownnever carries an id; every other kind must. - Quality
Recovery V1 - Quality
Retention V1 - Reason
Code V1 - Stable, machine-readable reason:
[a-z][a-z0-9_.]{2,63}. - Retention
Counts V1 - Security
Counts V1 - Source
Counts V1 - Source
RefV1 - Token
Account V1 - Transformation
Record V1 - One step in an object’s lineage: which transformation turned which input digest into which output digest, and what it cost or saved.
Enums§
- Classification
V1 - The one classification lattice:
Public < Internal < Confidential < Restricted. - Context
Disposition V1 - Per-object outcome, ordered from least to most restrictive.
- Coverage
Kind V1 - Delivery
Outcome V1 - Destination
Constraint V1 - Placement constraints that only ever accumulate through derivation.
- Destination
Locality V1 - Detector
Category V1 - Detector
Status V1 - Gateway
Mode V1 - Operating posture of the gateway.
- Principal
Kind V1 - Quality
Evidence Tier V1 - How strong the quality evidence is, weakest first.
- Quality
Probe Kind V1 - Kinds of critical facts a retention probe checks — kinds only, never values.
- Quality
State V1 - Severity
V1 - Source
Kind V1 - Transformation
Kind V1 - Trust
Level V1 - How far the source is trusted, least trusted first.
Constants§
- MAX_
DECISIONS - MAX_
LINEAGE - MAX_
POLICY_ REFS - MAX_
REASON_ CODES - Bounds keep untrusted receipts from growing without limit.
- MAX_
SIGNALS
Functions§
- project_
via_ classification - Projection of the VIA classification onto the two gateway axes. VIA mixes
sensitivity with placement (
LocalOnly,EnterprisePrivate); the gateway keeps placement as aDestinationConstraintV1so locality never depends on a sensitivity estimate.