Struct MobBootstrapSpec 

pub struct MobBootstrapSpec {
    pub definition: MobDefinition,
    pub storage: MobStorage,
    pub session_service: Arc<dyn MobSessionService>,
    pub binary_blob_store: Option<Arc<dyn BinaryBlobStore>>,
    pub options: MobBootstrapOptions,
    pub runtime_adapter: Option<Arc<MeerkatMachine>>,
    pub resolved_storage: Option<ResolvedStorageSummary>,
    pub committed_boundary_recoverer: Option<Arc<dyn CommittedBoundaryRecoverer>>,
    /* private fields */
}

Specification for bootstrapping a mob runtime from a definition, storage, and session service.

Fields

definition: MobDefinition

storage: MobStorage

session_service: Arc<dyn MobSessionService>

binary_blob_store: Option<Arc<dyn BinaryBlobStore>>

options: MobBootstrapOptions

runtime_adapter: Option<Arc<MeerkatMachine>>

Strong runtime authority shared by the session service and every runtime host installed for it.

Keeping the adapter here is significant for ephemeral services: their upstream adapter cache is weak, so an installed host would otherwise be lost before bootstrap asks the service for its adapter again.

resolved_storage: Option<ResolvedStorageSummary>

Composition-time storage durability resolution (H1/H2), surfaced by the runtime health surfaces. The stock constructors record it; externally-composed specs (MobBootstrapSpec::new — both gateway binaries roll their own session services) should set it beside their own store composition, and None renders as an absent declaration.

committed_boundary_recoverer: Option<Arc<dyn CommittedBoundaryRecoverer>>

Committed-boundary heal authority for the identity-first continuity repair supervisor (2026-07-29 heal/re-Break incident). The stock persistent constructors record the concrete meerkat-backed recoverer; externally-composed specs may leave it None (no heal seam — the repair supervisor falls back to plain reconcile retries).

Implementations

impl MobBootstrapSpec

pub fn new( definition: MobDefinition, storage: MobStorage, session_service: Arc<dyn MobSessionService>, ) -> Self

pub fn dispatch_taint_slot(&self) -> DispatchTaintSlot

The late-bound §10.1 dispatch-time taint slot every member session create built from this spec consults (see crate::memory::dispatch_taint). Compositions that assemble the full agent-memory stack fill the returned slot with the stack’s crate::SessionTaintTracker; unfilled it costs nothing.

pub fn with_resolved_storage(self, summary: ResolvedStorageSummary) -> Self

Record the composition-time storage durability resolution for a spec whose stores were composed externally (see resolved_storage).

pub fn with_options(self, options: MobBootstrapOptions) -> Self

pub fn with_agent_mob_tools( self, mob_tools_slot: Arc<RwLock<Option<Arc<dyn MobToolsFactory>>>>, ) -> Self

Install the agent-facing mob tool surface (spawn/delegate + the schedule mob-target authority) for externally-constructed specs.

The stock persistent()/ephemeral constructors do this internally; specs built via MobBootstrapSpec::new (both gateway binaries roll their own session services) previously skipped it, which left agent_mob_mcp_state() None — members still got mob tools through meerkat-mob’s INTERNAL default state, but mobkit’s schedule host had no mob authority: spawn_schedule_host fell back to the Noop mob host, so agent-authored schedules could neither rewrite to mob-member targets at authoring nor deliver identity/mob targets at fire time (“scheduled identity targets are not supported by this session host”, the HomeCore 0.7.26 last-link failure).

Call AFTER any session-service wrapping (with_session_runtime_adapter) so the installed tools hold the final wrapped service, and AFTER with_workgraph_service so child mobs inherit the workgraph authority. mob_tools_slot is the agent factory builder’s default_mob_tools slot.

pub fn with_workgraph_service(self, service: Option<WorkGraphService>) -> Self

Thread a realm-scoped WorkGraph service into the mob runtime.

MobRuntime::bootstrap forwards it to MobBuilder::with_workgraph_service, which turns on apply-time attention overlay injection for every mob-executor turn. Call BEFORE with_agent_mob_tools — the agent mob state snapshots the service at install time so agent-spawned child mobs inherit it.

pub fn with_workgraph_admission_slot(self, slot: WorkGraphAdmissionSlot) -> Self

Register a tool-plane admission slot (returned by workgraph_wiring::install_workgraph_tools / attach_workgraph_tools*) to be filled at bootstrap with the runtime-wide WorkGraphAdmission. Every builder whose members can call workgraph_attention_reassign must have its slot registered here, or those members bypass the duplicate-binding admission guard the RPC surfaces enforce.

pub fn with_workgraph_admission_sidecar(self, state_dir: &Path) -> Self

Serialize admissions cross-process through the sidecar lock database under state_dir (see workgraph_admission_sidecar_path). Call for SQLite-backed workgraph stores — the store file is shareable by a gateway and a library-mode runtime on one state dir, and each process’s in-process gate cannot see the other. Memory-backed runtimes must not set this.

pub fn with_default_external_tools_provider( self, provider: ExternalToolsProvider, ) -> Self

Install a mob-wide external-tools provider (e.g. MCP-backed callback tools). Unlike the per-spawn SpawnMemberSpec.external_tools overlay — which member revival silently drops — this provider is consulted on every spawn AND every revival, so the tools are durable for the member’s whole lifecycle. The profile’s tools.mcp allowlist gates what each member sees; an empty allowlist means the full surface.

pub fn with_session_runtime_adapter(self, adapter: Arc<MeerkatMachine>) -> Self

Expose a runtime adapter through the session-service facade.

Custom embedders that construct their own MobSessionService still need MobKit’s session-service surface to report the same runtime authority that MobBuilder::with_runtime_adapter(...) receives. This keeps autonomous-host comms, runtime inspection, and control paths pointed at one machine without forcing embedders through the stock factory helpers.

pub fn with_after_create_hook(self, hook: AfterCreateHook) -> Self

Wrap the session service with an after-create hook that fires after each successful create_session. The hook is best-effort: errors are not propagated. Uses AfterCreateMobSessionService which wraps the inner service without a pre-build hook, so any pre-build mutations from inner wrappers are fully reflected in the context.

pub fn with_session_write_epochs( self, epochs: &SessionWriteEpochsHandle, ) -> Self

Install the write-epoch witness produced by epoch_tracking_runtime_store on an externally-composed spec.

Self::new leaves the witness absent, which disables the console session-history epoch gate and whole-document read absorption — on gateway compositions that was the 0.8.4 idle driver: the 5s console discovery loop re-read and re-validated every member’s full session document forever (~0.3 core per idle durable member at production document sizes). Both gateway binaries compose through Self::new, so they must wrap their runtime store with epoch_tracking_runtime_store and hand the witness here.

Also wraps the session service with the [SessionDocumentReadAbsorber] so repeated authoritative whole-document loads are served from the last decoded document while the session’s write epoch is unchanged.

pub fn with_runtime_archived_terminal_authority( self, runtime_store: Arc<dyn RuntimeStore>, ) -> Self

Overlay the RuntimeStore-owned archived terminal onto resume-seam reads on an externally-composed spec (both gateway binaries roll their own session services, so the stock persistent constructor’s wiring does not reach them).

At meerkat 0.8.11 archive never rewrites session bodies; the absorbing terminal lives in the runtime store’s catalog entry or its Retired/Destroyed lifecycle row. Without this overlay, load_session_for_resume on a runtime-archived session returns Revivable with no archived terminal and hosts rotate identities off intact preserved transcripts. Hand it the SAME store the machine and session service share.

pub fn ephemeral( definition: MobDefinition, storage: MobStorage, store_path: PathBuf, max_sessions: usize, session_store: Option<Arc<dyn AgentSessionStore>>, ) -> Self

Build an ephemeral session service with a correctly wired AgentFactory.

If session_store is provided, it is set on the FactoryAgentBuilder so that agents use the given store instead of falling back to JSONL.

pub fn ephemeral_with_hook( definition: MobDefinition, storage: MobStorage, store_path: PathBuf, max_sessions: usize, session_store: Option<Arc<dyn AgentSessionStore>>, hook: impl Fn(&mut CreateSessionRequest) -> Pin<Box<dyn Future<Output = Result<(), SessionError>> + Send + '_>> + Send + Sync + 'static, ) -> Self

Like ephemeral, but with a pre-build hook that is called before each agent is constructed. Use this to inject external tools, augment system prompts, or set per-agent labels.

pub fn persistent( definition: MobDefinition, storage: MobStorage, store_path: PathBuf, max_sessions: usize, session_store: Arc<dyn SessionStore>, ) -> Result<Self, StorageResolutionError>

Build a persistent session service with a correctly wired AgentFactory.

The session_store is used in two places:

1. As the persistence backend for PersistentSessionService (checkpoint/restore).
2. Adapted via StoreAdapter and set on FactoryAgentBuilder.default_session_store so that agents use it directly instead of falling back to JSONL.

Errors

Fails closed when the local blob directory or the runtime store under store_path cannot be opened — persistent mode never silently falls back to in-memory stores.

pub fn persistent_with_hook( definition: MobDefinition, storage: MobStorage, store_path: PathBuf, max_sessions: usize, session_store: Arc<dyn SessionStore>, hook: impl Fn(&mut CreateSessionRequest) -> Pin<Box<dyn Future<Output = Result<(), SessionError>> + Send + '_>> + Send + Sync + 'static, ) -> Result<Self, StorageResolutionError>

Like persistent, but with a pre-build hook that is called before each agent is constructed. Use this to inject external tools, augment system prompts, or set per-agent labels.

Errors

Fails closed when the local blob directory or the runtime store under store_path cannot be opened — persistent mode never silently falls back to in-memory stores.