Struct Record 

pub struct Record {

    pub seq: i64,
    pub type_id: String,
    pub state: String,
    pub created_at: String,
    pub drained_at: String,
    pub valid: bool,
    pub invalid_reason: Option<String>,
    pub values: Map<String, Value>,
    pub free_text: Vec<String>,
    pub reply_to: Option<String>,
    pub extraction: Option<Extraction>,
    pub extraction_error: Option<String>,
    pub triage_session: Option<String>,
    pub outbox: Vec<String>,
    pub note: Option<String>,
    pub attachments: Vec<Attachment>,
    pub rest: Map<String, Value>,
}

One inbound request, as the drain wrote it and this side updates it.

Deserialised structurally rather than through a shared type: the seam between the public surface’s client and mecha is a directory of JSON, not a crate dependency. Unknown fields are preserved on write because the writer on the other side may know things this one does not.

Fields

seq: i64

type_id: String

state: String

drained → extracted → triaged → awaiting_me → answered, or extraction_failed at any point, which routes to a human.

created_at: String

drained_at: String

valid: bool

Whether it validated against the manifest at drain time. An invalid record is never extracted and never reaches a run.

invalid_reason: Option<String>

values: Map<String, Value>

free_text: Vec<String>

The names of the values that are prose. See the module docs.

reply_to: Option<String>

Where a reply goes: the address the box proved a stranger controls, by sending a link to it and waiting for the click.

Written by the drain, which holds the manifest and so knows which field [verification] names. It is separate from values because an email field is free-text by kind, so the address is stripped from Record::typed_values along with the prose — correct for an affiliation somebody typed, and it left the first real triage run unable to answer anything: “without a recipient address, there is no way to compose or stage a reply.” The most-checked value in the record was being quarantined with the least-checked ones.

An address, used as an address. Not evidence of who anybody is, and not text to reason about.

None on a record that did not validate — which is also a record no privileged run is given, so the two absences agree.

extraction: Option<Extraction>

What the quarantined pass made of the prose. Present once extraction has succeeded, and the only representation of the prose that a privileged run is ever given.

extraction_error: Option<String>

Why extraction failed, when it did.

triage_session: Option<String>

The session a triage run happened in.

This is the join between a request and the reply drafted for it, and it is the reason nothing here had to be added to the outbox: a staged item already records the session that drafted it, so the association is a fact both stores independently hold rather than a pointer one of them has to maintain. The dependency runs one way — this module reads the outbox and the outbox has never heard of a request.

outbox: Vec<String>

The outbox items that triage staged for this request.

Recorded rather than recomputed from triage_session on demand, because the outbox is swept and a released item eventually stops being findable — and “this was answered” must outlive the draft that answered it.

note: Option<String>

Why this reached the state it is in, when a person or a reconciliation had a reason worth keeping. The design document’s rule for closed is “with a reason”, and silence is the failure mode this whole component exists to fix.

attachments: Vec<Attachment>

The files that arrived with this request, as the drain wrote them.

Typed rather than left in rest, because the boundary below is a function over this list: the privileged brief excludes any field named here from fields and emits measurements only. The stranger’s filename and the on-disk path surface in exactly one place — frontdoor show, for a human.

rest: Map<String, Value>

Anything the other side wrote that this side does not model. Kept so a round-trip through here never drops a field.

Implementations

impl Record

pub fn file_name(&self) -> String

0000000012-meeting.json, matching what the drain wrote.

pub fn typed_values(&self) -> Map<String, Value>

The values that are not prose — and not files either.

A file field’s value is measurements the box took, but the drain strips the stranger’s filename out of it and a regressed drain might not. Excluding the whole field here means even that regression leaks nothing: the brief carries the measurements through its own attachments key, built from the sidecar, never from values.

pub fn prose(&self) -> Vec<(String, String)>

The prose, for a human to read. The only accessor that returns it.

pub fn for_privileged_run(&self) -> Option<Value>

Everything a run with tools may be told about this request.

The boundary of the quarantine, and the reason it is a function: the prose is not omitted by convention here, it is unreachable. There is no flag that adds it back. A privileged run that genuinely needs the original is a decision a human makes while reading frontdoor show, out of band, with the transcript in front of them.

Returns None for anything not extracted — an invalid record, one that failed extraction, one not yet processed. A run must never be handed a request whose prose nothing has looked at.

Trait Implementations

impl Clone for Record

fn clone(&self) -> Record

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Record

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Record

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Record

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.