Expand description
Context Gateway v1 — the canonical, public decision contract.
Every governed piece of context carries a ContextObjectPassportV1; the
gateway records one ContextDecisionV1 per object and summarises a
delivery in one ContextDecisionReceiptV1, which is the single source for
audit, HUD and SDK surfaces. The contract never carries content, secret
values or detector matches — only digests, counts and reason codes.
Field-level invariants (principal, coverage, reason codes) are enforced at
construction and deserialization; cross-field invariants by validate(),
which derive and canonical_digest call. All of them fail closed:
- an unknown principal is explicit and never carries an identity;
- classification only ever rises through derivation (
ClassificationV1::join); - destination constraints only accumulate;
- a detector may not report more coverage than it inspected;
- a receipt’s security counts must equal its per-object decisions.
Structs§
- Context
Decision Receipt V1 - One governed delivery: who asked, for what, what was considered, what was withheld and why, what reached which destination under which policy.
- Context
Decision V1 - The gateway’s decision about one object. Anything but a plain
Allowmust say why. - Context
Object Passport V1 - Security and optimisation metadata that travels with one object. Content is referenced by digest, never embedded.
- Context
Quality Section V1 - Deterministic context-quality evidence for one round.
- Destination
V1 - Where the compiled context is delivered. Models LeanCTX itself uses (detectors, summarisers) are destinations too.
- Detector
Coverage V1 - What a detector actually looked at. A result never implies more coverage than recorded here.
- Detector
RefV1 - Detector
Signal V1 - One detector’s normalised result. Carries counts only — never the matched value — so telemetry and receipts cannot leak what was detected.
- Egress
Admission Receipt V1 - A versioned, content-addressable admission record for outbound request bytes.
- Egress
Transport Observation V1 - Append-only observation of one transport attempt, linked to its admission receipt.
- Policy
RefV1 - The exact policy that decided: identity, optional version, content digest.
- Principal
V1 - Who requested the context.
Unknownnever carries an id; every other kind must. - Quality
Recovery V1 - Quality
Retention V1 - Reason
Code V1 - Stable, machine-readable reason:
[a-z][a-z0-9_.]{2,63}. - Receipt
Object Digest V2 - The key a version 2 receipt’s decision objects are digested under: its algorithm and a public identifier, never the key.
- Retention
Counts V1 - Security
Counts V1 - Source
Counts V1 - Source
RefV1 - Token
Account V1 - Transformation
Record V1 - One step in an object’s lineage: which transformation turned which input digest into which output digest, and what it cost or saved.
Enums§
- Classification
V1 - The one classification lattice:
Public < Internal < Confidential < Restricted. - Context
Disposition V1 - Per-object outcome, ordered from least to most restrictive.
- Coverage
Kind V1 - Delivery
Outcome V1 - Destination
Constraint V1 - Placement constraints that only ever accumulate through derivation.
- Destination
Locality V1 - Detector
Category V1 - Detector
Status V1 - Egress
Admission Outcome V1 - The admission lifecycle for one exact request body. This does not change the legacy ContextDecisionReceiptV1 wire format or its outcome semantics.
- Egress
Transport Failure V1 - Bounded error classes only; raw transport errors may contain sensitive data.
- Egress
Transport Observer V1 - Egress
Transport Result V1 - Egress
Transport V1 - Gateway
Mode V1 - Operating posture of the gateway.
- Object
Digest Algorithm V2 - How the decision objects of a version 2 receipt are digested.
- Principal
Kind V1 - Quality
Evidence Tier V1 - How strong the quality evidence is, weakest first.
- Quality
Probe Kind V1 - Kinds of critical facts a retention probe checks — kinds only, never values.
- Quality
State V1 - Severity
V1 - Source
Kind V1 - Transformation
Kind V1 - Trust
Level V1 - How far the source is trusted, least trusted first.
Constants§
- MAX_
DECISIONS - MAX_
LINEAGE - MAX_
POLICY_ REFS - MAX_
REASON_ CODES - Bounds keep untrusted receipts from growing without limit.
- MAX_
SIGNALS - RECEIPT_
V2_ SCHEMA_ VERSION - Receipt schema version 2 (AP10-C4,
context-gateway-v2.md): everydecisions[].objectis keyed under the installation’s receipt key and the receipt names that key inContextDecisionReceiptV1::object_digest. Version 1 receipts (plain SHA-256 objects) stay readable and valid.
Functions§
- project_
via_ classification - Projection of the VIA classification onto the two gateway axes. VIA mixes
sensitivity with placement (
LocalOnly,EnterprisePrivate); the gateway keeps placement as aDestinationConstraintV1so locality never depends on a sensitivity estimate.