Struct MeerkatMachine 

pub struct MeerkatMachine { /* private fields */ }

Session-scoped execution kernel for the Meerkat runtime.

Owns per-session runtime state (driver, ops registry, completion waiters, comms drain, epoch bindings) and routes all internal mutations through one canonical command reducer, with smaller group handlers retained only as implementation detail helpers.

Implementations

impl MeerkatMachine

pub async fn update_peer_ingress_context( self: &Arc<Self>, session_id: &SessionId, keep_alive: bool, comms_runtime: Option<Arc<dyn CommsRuntime>>, ) -> Result<bool, RuntimeDriverError>

pub async fn maybe_spawn_comms_drain( self: &Arc<Self>, session_id: &SessionId, keep_alive: bool, comms_runtime: Option<Arc<dyn CommsRuntime>>, ) -> Result<bool, RuntimeDriverError>

Manage the comms drain lifecycle for a session based on keep_alive intent.

When keep_alive is true, spawns a drain if one is not already running. When keep_alive is false, aborts any running drain for the session. Returns true if a new drain was spawned.

pub async fn refresh_session_owned_peer_ingress( self: &Arc<Self>, session_id: &SessionId, ) -> Result<bool, RuntimeDriverError>

Refresh a session-owned peer ingress drain without re-attaching ownership.

This is intentionally narrower than MeerkatMachine::update_peer_ingress_context: callers that only need the existing authorized session-owned transport to be healthy can respawn a missing/respawnable drain task without staging AttachSessionIngress with a possibly different runtime handle. Mob-owned ingress and missing cached session runtimes are left untouched.

pub async fn maybe_spawn_mob_comms_drain( self: &Arc<Self>, session_id: &SessionId, comms_runtime: Arc<dyn CommsRuntime>, mob_id: MobId, ) -> Result<bool, RuntimeDriverError>

Mob-owned variant of MeerkatMachine::maybe_spawn_comms_drain (W2-G / issue #264).

Shell calls this from the mob provisioning path to claim peer-ingress ownership as MobOwned { comms_runtime_id, mob_id }. The DSL transition permits promotion from Unattached or SessionOwned, so a mob can take over a session-owned drain at spawn; silent downgrades back to SessionOwned are impossible by construction.

pub async fn peer_ingress_owner( &self, session_id: &SessionId, ) -> PeerIngressOwner

Read the current peer-ingress owner from DSL state.

Returns PeerIngressOwner::Unattached for sessions that have no registered DSL state (unknown / destroyed sessions). Used by the session-runtime to refuse reconfiguration of mob-owned drains at turn-start.

The peer_ingress_owner_consistency invariant guarantees that companion fields are populated for non-Unattached kinds, but if the invariant were ever violated at runtime, we gracefully degrade to Unattached rather than panic.

pub async fn notify_comms_drain_exited( self: &Arc<Self>, session_id: &SessionId, reason: DrainExitReason, ) -> Result<(), RuntimeDriverError>

Notify the authority that a drain task has exited with the given reason.

Called from drain task exit paths (or by wrappers that detect task completion). The generated NotifyDrainExited input owns whether the exit enters ExitedRespawnable or Stopped; this method only projects the accepted authority state into task-handle mechanics.

pub async fn abort_comms_drains(&self) -> Result<(), RuntimeDriverError>

Abort all active comms drain tasks.

pub async fn abort_comms_drain( &self, session_id: &SessionId, ) -> Result<(), RuntimeDriverError>

Abort the comms drain task for a specific session.

pub async fn wait_comms_drain( &self, session_id: &SessionId, ) -> Result<(), RuntimeDriverError>

Wait for a session’s comms drain task to finish.

Returns immediately if no drain is active for the session. If the task already notified the authority (normal exit), this is a no-op for authority state. If the task panicked without notifying, this submits TaskExited { Failed } as a safety net.

pub async fn supervisor_binding( &self, session_id: &SessionId, ) -> SupervisorBinding

Read the current supervisor binding from DSL state (Wave 3 D Row 21).

Returns SupervisorBinding::Unbound for sessions that have no registered DSL state (unknown / destroyed sessions). The supervisor_binding_consistency invariant guarantees the four companion fields are populated exactly when the kind is Bound; if that invariant were ever violated at runtime, we gracefully degrade to Unbound rather than panic.

pub async fn stage_local_endpoint_for_comms_runtime( &self, session_id: &SessionId, comms_runtime: &dyn CommsRuntime, ) -> Result<(), SupervisorBindingStageError>

Publish the target runtime’s own endpoint into MeerkatMachine before generated trust handoffs mint authority scoped to that trust store.

pub async fn stage_supervisor_bind( &self, session_id: &SessionId, name: String, peer_id: String, address: String, signing_public_key: String, epoch: u64, ) -> Result<MeerkatMachineTransition, SupervisorBindingStageError>

Stage a DSL BindSupervisor input (Wave 3 D Row 21).

Returns the classified result from the DSL mutator so callers can surface typed rejections (e.g. “already bound”). The shell uses this after validating the incoming bridge request’s bootstrap token; the DSL is the authority that flips Unbound → Bound.

pub async fn supervisor_trust_publish_freshness_authority( &self, session_id: &SessionId, ) -> Result<SupervisorTrustFreshnessAuthority, SupervisorBindingStageError>

pub async fn supervisor_trust_revoke_freshness_authority( &self, session_id: &SessionId, ) -> Result<SupervisorTrustFreshnessAuthority, SupervisorBindingStageError>

pub async fn stage_supervisor_authorize( &self, session_id: &SessionId, name: String, peer_id: String, address: String, signing_public_key: String, epoch: u64, ) -> Result<MeerkatMachineTransition, SupervisorBindingStageError>

Stage a DSL AuthorizeSupervisor input (Wave 3 D Row 21).

Rotates the current binding to a new supervisor + epoch. The shell must have already verified the rotation is authorized by the current supervisor before calling this method.

pub async fn stage_supervisor_trust_publish_request( &self, session_id: &SessionId, name: String, peer_id: String, address: String, signing_public_key: String, epoch: u64, ) -> Result<MeerkatMachineTransition, SupervisorBindingStageError>

Stage a DSL RequestSupervisorTrustPublish input.

Used when the current supervisor binding is already correct but the shell still needs a fresh generated publish obligation before repairing or reasserting the concrete trust edge.

pub async fn stage_supervisor_revoke( &self, session_id: &SessionId, peer_id: String, epoch: u64, ) -> Result<MeerkatMachineTransition, SupervisorBindingStageError>

Stage a DSL RevokeSupervisor input (Wave 3 D Row 21).

Returns to Unbound. The DSL guard enforces that the supplied peer_id and epoch match the current binding exactly; a stale revoke cannot tear down a freshly rotated binding.

pub async fn stage_supervisor_trust_published( &self, session_id: &SessionId, peer_id: String, epoch: u64, ) -> Result<(), SupervisorBindingStageError>

Stage a DSL SupervisorTrustEdgePublished feedback input (C-F2 / wave-d D-d).

Invoked by try_handle_supervisor_bridge_command after a successful Router::add_trusted_peer call. The epoch passed through is the one observed on the originating PublishSupervisorTrustEdge effect (i.e. the epoch of the BindSupervisor / AuthorizeSupervisor commit that triggered the publication). The DSL guard rejects the ack if the binding has since rotated forward — a stale ack cannot close the outstanding obligation for the newer epoch.

pub async fn stage_supervisor_trust_publish_failed( &self, session_id: &SessionId, peer_id: String, epoch: u64, reason: String, ) -> Result<(), SupervisorBindingStageError>

Stage a DSL SupervisorTrustEdgePublishFailed feedback input (C-F2 / wave-d D-d).

Invoked when Router::add_trusted_peer returns an error. The epoch comes from the originating producer effect; the DSL guard rejects a stale-epoch ack arriving after the binding has rotated forward.

pub async fn stage_supervisor_trust_revoked( &self, session_id: &SessionId, peer_id: String, epoch: u64, ) -> Result<(), SupervisorBindingStageError>

Stage a DSL SupervisorTrustEdgeRevoked feedback input (C-F2 / wave-d D-d).

Invoked after a successful Router::remove_trusted_peer call. Epoch guard semantics mirror stage_supervisor_trust_published.

pub async fn stage_supervisor_trust_revoke_failed( &self, session_id: &SessionId, peer_id: String, epoch: u64, reason: String, ) -> Result<(), SupervisorBindingStageError>

Stage a DSL SupervisorTrustEdgeRevokeFailed feedback input (C-F2 / wave-d D-d).

Invoked when Router::remove_trusted_peer returns an error. Epoch guard semantics mirror stage_supervisor_trust_published.

impl MeerkatMachine

pub async fn direct_peer_endpoints( &self, session_id: &SessionId, ) -> Result<BTreeSet<PeerEndpoint>, PeerEndpointStageError>

Return the generated MeerkatMachine-owned direct peer endpoint set for callers that must target an exact RemoveDirectPeerEndpoint input.

pub async fn stage_add_direct_peer_endpoint( &self, session_id: &SessionId, endpoint: PeerEndpoint, comms_runtime: Arc<dyn CommsRuntime>, ) -> Result<(), PeerEndpointStageError>

D-track-b: stage an AddDirectPeerEndpoint DSL input and drive trust reconciliation against the caller-supplied runtime.

Closes the emitter→consumer gap documented in docs/wave-d-prep/track-b-producer-wiring.md: the DSL owns the declarative peer set (direct_peer_endpoints + mob_overlay_peer_endpoints) and emits CommsTrustReconcileRequested; the reconciler consumes that effect and mechanically reconciles the underlying meerkat_core::agent::CommsRuntime trust store.

The caller supplies the session’s current CommsRuntime. Reconciliation reads that runtime’s canonical trust-store snapshot every pass, so rebinds do not pin peer projection to an older transport instance.

pub async fn stage_remove_direct_peer_endpoint( &self, session_id: &SessionId, endpoint: PeerEndpoint, comms_runtime: Arc<dyn CommsRuntime>, ) -> Result<(), PeerEndpointStageError>

D-track-b: stage a RemoveDirectPeerEndpoint DSL input and drive trust reconciliation. See Self::stage_add_direct_peer_endpoint for the architectural contract.

pub async fn stage_repair_remove_direct_peer_id( &self, session_id: &SessionId, peer_id: String, comms_runtime: Arc<dyn CommsRuntime>, ) -> Result<(), PeerEndpointStageError>

Stage the generated absent-endpoint repair path for a direct peer id.

This is used when machine state already says the direct endpoint is absent, but the caller needs to re-emit the generated reconciliation effect so stale trust-store projection rows cannot stay behaviorally active.

pub async fn stage_authorized_supervisor_mob_peer_overlay( &self, session_id: &SessionId, supervisor_peer_id: String, supervisor_epoch: u64, recipient_peer_id: String, overlay_epoch: u64, endpoints: BTreeSet<PeerEndpoint>, endpoint_count: u64, command_peer_id: String, command_endpoint: PeerEndpoint, command_kind: MobPeerOverlayCommandKind, comms_runtime: Arc<dyn CommsRuntime>, ) -> Result<(), PeerEndpointStageError>

Stage a supervisor-observed mob peer overlay through generated MeerkatMachine authority before driving trust reconciliation.

impl MeerkatMachine

pub async fn input_requires_active_pre_admission( &self, session_id: &SessionId, input: &Input, ) -> Result<bool, RuntimeDriverError>

Preview generated admission feedback for shell capacity mechanics.

The caller does not classify policy/defaults itself; it only observes whether generated ResolveAdmissionPlan would ask the runtime to wake, interrupt, or process immediately.

pub async fn input_requires_active_pre_admission_without_wake( &self, session_id: &SessionId, input: &Input, ) -> Result<bool, RuntimeDriverError>

Preview generated admission feedback for no-wake shell capacity mechanics.

This mirrors accept_input_without_wake: the shell supplies only the command mode, while generated ResolveAdmissionPlan owns the semantic pre-admission answer.

impl MeerkatMachine

pub async fn hard_cancel_current_run( &self, session_id: &SessionId, reason: impl Into<String>, ) -> Result<(), RuntimeDriverError>

impl MeerkatMachine

pub async fn resolve_runtime_completion_cleanup( &self, session_id: &SessionId, observation: CompletionCleanupObservation, archived_by_authority: bool, live_session: RuntimeCompletionLiveSessionObservation, ) -> Result<RuntimeCompletionCleanupAuthority, RuntimeDriverError>

pub async fn resolve_runtime_completion_wait_failure( &self, session_id: &SessionId, error: &CompletionWaitError, ) -> Result<RuntimeCompletionWaitFailureAuthority, RuntimeDriverError>

pub async fn stop_runtime_executor( &self, session_id: &SessionId, reason: impl Into<String>, ) -> Result<(), RuntimeDriverError>

Stop the attached runtime executor through the out-of-band control channel. When no loop is attached yet, a stop command is applied directly against the driver so queued work is still terminated consistently.

pub async fn accept_input_with_completion( &self, session_id: &SessionId, input: Input, ) -> Result<(AcceptOutcome, Option<CompletionHandle>), RuntimeDriverError>

Accept an input and return a completion handle that resolves when the input reaches a terminal state (Consumed or Abandoned).

Returns (AcceptOutcome, Option<CompletionHandle>):

• (Accepted, Some(handle)) — await handle for result
• (Accepted, None) — input reached a terminal state during admission
• (Deduplicated, Some(handle)) — joined in-flight waiter
• (Deduplicated, None) — input already terminal; no waiter needed
• (Rejected, _) — returned as Err(ValidationFailed)

pub fn accept_input_with_completion_boxed<'a>( &'a self, session_id: &'a SessionId, input: Input, ) -> Pin<Box<dyn Future<Output = Result<(AcceptOutcome, Option<CompletionHandle>), RuntimeDriverError>> + Send + 'a>>

pub fn accept_boxed_input_with_completion<'a>( &'a self, session_id: &'a SessionId, input: Box<Input>, _input_id: InputId, ) -> Pin<Box<dyn Future<Output = Result<(AcceptOutcome, Option<CompletionHandle>), RuntimeDriverError>> + Send + 'a>>

pub async fn accept_input_without_wake( &self, session_id: &SessionId, input: Input, ) -> Result<AcceptOutcome, RuntimeDriverError>

Accept an input but intentionally do not wake the runtime loop.

This is reserved for explicitly queued-only surface contracts that stage work for the next turn boundary instead of waking an idle session immediately.

pub async fn ops_lifecycle_registry( &self, session_id: &SessionId, ) -> Option<Arc<RuntimeOpsLifecycleRegistry>>

Get the shared ops lifecycle registry for a session/runtime instance.

pub async fn prepare_bindings( &self, session_id: SessionId, ) -> Result<SessionRuntimeBindings, RuntimeBindingsError>

Prepare canonical runtime bindings for a session.

This is the single canonical helper that replaces the hand-rolled register_session() + ops_lifecycle_registry() + manual threading dance. All runtime-backed surfaces should call this instead.

The method is idempotent: if the session is already registered, it returns bindings from the existing entry. The epoch_id is stable across repeated calls for the same session.

pub async fn prepare_local_session_bindings( &self, session_id: SessionId, ) -> Result<SessionRuntimeBindings, RuntimeBindingsError>

Prepare factory-consumable session runtime resources without emitting cross-machine binding signals.

Mob provisioning uses this to pre-create the session-owned handle bundle before MobMachine::Spawn has committed the member runtime id. The authoritative mob binding is routed later through RequestRuntimeBinding -> PrepareBindings, which emits the typed RuntimeBound signal with the mob-owned AgentRuntimeId and fence.

impl MeerkatMachine

pub async fn set_session_silent_intents( &self, session_id: &SessionId, intents: Vec<String>, ) -> Result<(), RuntimeDriverError>

Set the silent comms intents for a session’s runtime driver.

Peer requests whose intent matches one of these strings will be accepted without triggering an LLM turn (ApplyMode::Ignore, WakeMode::None).

pub async fn commit_service_turn_terminal_receipt( &self, session_id: &SessionId, ) -> Result<(), RuntimeDriverError>

pub async fn register_session_with_executor( self: &Arc<Self>, session_id: SessionId, executor: Box<dyn CoreExecutor>, ) -> Result<(), RuntimeDriverError>

Register a runtime driver for a session WITH a RuntimeLoop backed by a CoreExecutor. Takes self: &Arc<Self> because executor attachment is routed through the Arc-backed command path that owns runtime-loop spawn.

pub async fn ensure_session_with_executor( self: &Arc<Self>, session_id: SessionId, executor: Box<dyn CoreExecutor>, ) -> Result<(), RuntimeDriverError>

Ensure a runtime driver with executor exists for the session.

If a session was already registered without a loop, upgrade the existing driver in place so queued inputs remain attached to the same runtime ledger and can start draining immediately. See register_session_with_executor for why this takes self: &Arc<Self>.

pub async fn install_prepared_session_interrupt_handle( &self, session_id: &SessionId, handle: Arc<dyn CoreExecutorInterruptHandle>, ) -> Result<(), RuntimeDriverError>

Install a temporary live interrupt handle for a prepared session before its runtime loop executor is attached.

Runtime-backed surfaces use this during eager session materialization: the session service owns the first turn until create_session returns, but explicit user interrupts must still route through MeerkatMachine::hard_cancel_current_run.

pub async fn unregister_session(&self, session_id: &SessionId)

Unregister a session’s runtime driver.

Detaches the executor (Attached → Idle) before removal, then drops the wake channel sender, which causes the RuntimeLoop to exit.

pub async fn contains_session(&self, session_id: &SessionId) -> bool

Check whether a runtime driver is already registered for a session.

pub async fn session_has_executor( &self, session_id: &SessionId, ) -> Result<bool, RuntimeDriverError>

Check whether a session has an active RuntimeLoop or attachment in progress.

Ok(false) means only Queuing (registered via prepare_bindings() with no executor) or unknown. Driver faults are returned explicitly so callers cannot accidentally treat a control-plane fault as absence.

pub async fn wake_runtime_if_active_inputs( &self, session_id: &SessionId, ) -> Result<bool, RuntimeDriverError>

Wake the attached runtime loop when machine-owned input truth already contains active work. This does not mutate lifecycle state; it only replays the mechanical wake effect for callers that observe queued work at a boundary where user input must wait for canonical runtime work to drain.

pub async fn session_has_comms( &self, session_id: &SessionId, ) -> Result<bool, RuntimeDriverError>

Check whether a session already has a comms runtime configured.

Returns true if update_peer_ingress_context was previously called with a non-None comms runtime for this session (e.g., via SessionRuntime::enable_comms_drain).

pub async fn resolve_transcript_edit_admission( &self, session_id: &SessionId, runtime_running: bool, has_active_inputs: bool, ) -> Result<TranscriptEditAdmissionKind, RuntimeDriverError>

Resolve the session-liveness verdict for an attempted transcript edit (fork / rewrite / restore) through MeerkatMachine authority.

The SESSION_BUSY disjunction (runtime_running || has_active_inputs => busy) is a MeerkatMachine-owned fact. The shell extracts the two pure boolean observations it already computes — runtime_running from runtime_state and has_active_inputs from list_active_inputs — and mirrors the verdict emitted here. The classifier is a phase-preserving self-loop, so it never mutates lifecycle state. The caller fails closed (denies the edit) on any error.

pub async fn cancel_after_boundary( &self, session_id: &SessionId, ) -> Result<(), RuntimeDriverError>

Request cancellation at the next safe boundary for the currently-running turn.

pub async fn abandon_retired_pending_inputs( &self, session_id: &SessionId, reason: impl Into<String>, ) -> Result<usize, RuntimeDriverError>

Realize pending-input abandonment after the machine has already entered the Retired terminal phase.

pub async fn stage_persistent_filter( &self, session_id: &SessionId, filter: ToolFilter, witnesses: BTreeMap<ToolName, ToolVisibilityWitness>, ) -> Result<ToolScopeRevision, RuntimeDriverError>

Stage a durable session visibility filter through the machine-owned visibility state.

pub async fn request_deferred_tools( &self, session_id: &SessionId, authorities: Vec<DeferredToolLoadAuthority>, ) -> Result<ToolScopeRevision, RuntimeDriverError>

Record durable deferred-tool visibility intent through the machine seam.

pub async fn publish_committed_visible_set( &self, session_id: &SessionId, visibility_state: SessionToolVisibilityState, ) -> Result<SessionToolVisibilityState, RuntimeDriverError>

Publish the committed visible tool set through the machine dispatch.

Routes the visibility publication through the canonical command path, enforcing session-existence and Destroyed guards per the TLA+ VisibleSurfacesMatchAppliedStateInvariant.

Returns the validated visibility state on success.

pub fn set_session_llm_reconfigure_host( &self, host: Arc<dyn SessionLlmReconfigureHost>, )

Install the runtime-owned shell seam for live LLM reconfiguration.

impl MeerkatMachine

pub async fn retire_runtime_control_plane( &self, runtime_id: &LogicalRuntimeId, ) -> Result<RetireReport, RuntimeControlPlaneError>

impl MeerkatMachine

pub async fn meerkat_machine_archive_snapshot( &self, session_id: &SessionId, ) -> Option<MeerkatArchiveSnapshot>

pub async fn meerkat_machine_spine_snapshot( &self, session_id: &SessionId, ) -> Option<MeerkatMachineSpineSnapshot>

impl MeerkatMachine

pub fn session_control_authority(&self) -> MachineSessionControlAuthority

Capability token for store-only session-control mutations routed through this machine authority.

pub fn shares_runtime_persistence_with(&self, other: &Self) -> bool

Whether this adapter shares the same runtime persistence authority as another adapter. Runtime-backed composition surfaces use this to reject mismatched adapters before visible terminal events can outrun the store that owns their durable commit.

pub fn shares_runtime_store_authority( &self, store: &Arc<dyn RuntimeStore>, ) -> bool

Whether this adapter owns the same runtime persistence authority as a concrete runtime store handle.

pub fn has_runtime_persistence(&self) -> bool

Whether this adapter has a runtime persistence store.

pub fn ephemeral() -> Self

Create an ephemeral adapter (all sessions use EphemeralRuntimeDriver).

pub fn persistent( store: Arc<dyn RuntimeStore>, blob_store: Arc<dyn BlobStore>, ) -> Self

Create a persistent adapter with a RuntimeStore.

pub fn persistent_without_blobs(store: Arc<dyn RuntimeStore>) -> Self

Create a persistent adapter with a RuntimeStore but no blob store.

The driver remains persistent for session state. Blob-backed inputs fail explicitly at the blob-store boundary until a real BlobStore is supplied.

pub fn auth_lease_handle(&self) -> Arc<dyn AuthLeaseHandle>

Shared auth lifecycle handle used by all runtime-backed session bindings created by this adapter.

pub fn generated_auth_lease_handle(&self) -> GeneratedAuthLeaseHandle

Generated-authority-certified auth lifecycle handle used at factory and resolver seams that must reject arbitrary handwritten handles.

pub fn set_auth_lease_handle(&self, handle: Arc<RuntimeAuthLeaseHandle>)

Install the auth lifecycle authority that public surfaces also read.

Surfaces construct the adapter before all state fields are available, so this setter lets them align the adapter’s runtime-backed traffic with the surface-visible status handle without creating a competing registry.

pub fn set_auth_lease_handle_with_oauth_flow_authority( &self, handle: Arc<RuntimeAuthLeaseHandle>, oauth_flows: Arc<dyn OAuthFlowAuthority>, )

Install the runtime credential lifecycle handle together with an explicit OAuth login-flow authority.

The credential side still has to be a generated AuthMachine authority; the explicit OAuth authority only controls login-flow test seams.

pub fn set_runtime_auth_lease_handle(&self, handle: Arc<RuntimeAuthLeaseHandle>)

Install a runtime AuthMachine authority shared by auth leases and OAuth login-flow lifecycle transitions.

pub fn oauth_flow_authority(&self) -> Arc<dyn OAuthFlowAuthority>

Shared OAuth login-flow authority used by all auth surfaces that are backed by this runtime adapter.

pub fn session_claim_handle(&self) -> Arc<dyn SessionClaimHandle>

The canonical session-identity claim handle owned by this MeerkatMachine. Comms runtimes wired through this machine acquire their session-id claim through it; the registry is scoped to this machine instance so tests / parallel runtimes do not collide.

pub fn set_composition_signal_dispatcher( &self, dispatcher: MeerkatCompositionSignalDispatcher, )

Attach the typed composition signal dispatcher used for MeerkatMachine -> MobMachine lifecycle observation routes.

pub async fn register_session( &self, session_id: SessionId, ) -> Result<(), RuntimeControlPlaneError>

Register a runtime driver for a session (no RuntimeLoop — inputs queue but nothing processes them automatically). Useful for tests and legacy mode.

Registration is a control-plane prerequisite: a failed register must not be laundered to success. The inner command can fail recovery, so the typed error is propagated to the caller rather than discarded.

Trait Implementations

impl RuntimeControlPlane for MeerkatMachine

fn ingest<'life0, 'life1, 'async_trait>( &'life0 self, runtime_id: &'life1 LogicalRuntimeId, input: Input, ) -> Pin<Box<dyn Future<Output = Result<AcceptOutcome, RuntimeControlPlaneError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Ingest an input into a specific runtime.

fn publish_event<'life0, 'async_trait>( &'life0 self, event: RuntimeEventEnvelope, ) -> Pin<Box<dyn Future<Output = Result<(), RuntimeControlPlaneError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Publish a runtime event.

fn retire<'life0, 'life1, 'async_trait>( &'life0 self, runtime_id: &'life1 LogicalRuntimeId, ) -> Pin<Box<dyn Future<Output = Result<RetireReport, RuntimeControlPlaneError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Retire a runtime (no new input, drain existing).

fn recycle<'life0, 'life1, 'async_trait>( &'life0 self, runtime_id: &'life1 LogicalRuntimeId, ) -> Pin<Box<dyn Future<Output = Result<RecycleReport, RuntimeControlPlaneError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Recycle a runtime (reset driver and recover state).

fn reset<'life0, 'life1, 'async_trait>( &'life0 self, runtime_id: &'life1 LogicalRuntimeId, ) -> Pin<Box<dyn Future<Output = Result<ResetReport, RuntimeControlPlaneError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Reset a runtime (abandon all pending input).

fn recover<'life0, 'life1, 'async_trait>( &'life0 self, runtime_id: &'life1 LogicalRuntimeId, ) -> Pin<Box<dyn Future<Output = Result<RecoveryReport, RuntimeControlPlaneError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Recover a runtime from crash.

fn destroy<'life0, 'life1, 'async_trait>( &'life0 self, runtime_id: &'life1 LogicalRuntimeId, ) -> Pin<Box<dyn Future<Output = Result<DestroyReport, RuntimeControlPlaneError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Destroy a runtime (terminal state, no recovery possible).

fn runtime_state<'life0, 'life1, 'async_trait>( &'life0 self, runtime_id: &'life1 LogicalRuntimeId, ) -> Pin<Box<dyn Future<Output = Result<RuntimeState, RuntimeControlPlaneError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Get the state of a runtime.

fn load_boundary_receipt<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, runtime_id: &'life1 LogicalRuntimeId, run_id: &'life2 RunId, sequence: u64, ) -> Pin<Box<dyn Future<Output = Result<Option<RunBoundaryReceipt>, RuntimeControlPlaneError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Load a boundary receipt for verification.

impl SessionServiceRuntimeExt for MeerkatMachine

fn accept_input<'life0, 'life1, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, input: Input, ) -> Pin<Box<dyn Future<Output = Result<AcceptOutcome, RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Accept an input for a session.

fn accept_input_with_completion<'life0, 'life1, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, input: Input, ) -> Pin<Box<dyn Future<Output = Result<(AcceptOutcome, Option<CompletionHandle>), RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Accept an input and optionally return a completion handle that resolves when the admitted work reaches a terminal runtime outcome.

fn runtime_state<'life0, 'life1, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, ) -> Pin<Box<dyn Future<Output = Result<RuntimeState, RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Get the runtime state for a session.

fn retire_runtime<'life0, 'life1, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, ) -> Pin<Box<dyn Future<Output = Result<RetireReport, RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Retire a session’s runtime.

fn reset_runtime<'life0, 'life1, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, ) -> Pin<Box<dyn Future<Output = Result<ResetReport, RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Reset a session’s runtime.

fn input_state<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, input_id: &'life2 InputId, ) -> Pin<Box<dyn Future<Output = Result<Option<StoredInputState>, RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Get the state of a specific input, bundled with its DSL-owned seed (phase / run association / boundary sequence).

fn input_state_by_idempotency_key<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, idempotency_key: &'life2 str, ) -> Pin<Box<dyn Future<Output = Result<Option<StoredInputState>, RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Resolve a caller-supplied idempotency key to its admitted input and return that input’s stored state (terminal outcome, last run id, boundary sequence).

fn list_active_inputs<'life0, 'life1, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, ) -> Pin<Box<dyn Future<Output = Result<Vec<InputId>, RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

List all active (non-terminal) inputs for a session.

fn reconfigure_session_llm_identity<'life0, 'life1, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, request: SessionLlmReconfigureRequest, ) -> Pin<Box<dyn Future<Output = Result<SessionLlmReconfigureReport, RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Canonically reconfigure the LLM identity for a registered live session.

fn resolved_session_llm_capabilities<'life0, 'life1, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, ) -> Pin<Box<dyn Future<Output = Result<Option<SessionLlmCapabilitySurface>, RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Get the runtime-owned resolved LLM capability surface for a session.

fn configure_model_routing_baseline<'life0, 'life1, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, baseline_model: ModelId, realtime_capable: bool, ) -> Pin<Box<dyn Future<Output = Result<(), RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn session_model_routing_status<'life0, 'life1, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, ) -> Pin<Box<dyn Future<Output = Result<SessionModelRoutingStatus, RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn request_switch_turn<'life0, 'life1, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, request: SwitchTurnRequest, ) -> Pin<Box<dyn Future<Output = Result<SwitchTurnControlResult, RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn admit_model_routing_assistant_turn<'life0, 'life1, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, ) -> Pin<Box<dyn Future<Output = Result<(), RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn begin_image_operation<'life0, 'life1, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, request: ImageOperationRoutingRequest, ) -> Pin<Box<dyn Future<Output = Result<ImageOperationRoutingResult, RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn deny_image_operation_plan<'life0, 'life1, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, operation_id: ImageOperationId, reason: ImageOperationDenialReason, ) -> Pin<Box<dyn Future<Output = Result<ImageOperationPhase, RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn activate_image_operation_override<'life0, 'life1, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, operation_id: ImageOperationId, ) -> Pin<Box<dyn Future<Output = Result<ImageOperationPhase, RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn complete_image_operation<'life0, 'life1, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, operation_id: ImageOperationId, terminal: ImageOperationTerminalClass, ) -> Pin<Box<dyn Future<Output = Result<ImageOperationPhase, RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn classify_image_operation_terminal<'life0, 'life1, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, operation_id: ImageOperationId, observation: ImageProviderTerminalObservation, provider_text: ProviderTextDisposition, ) -> Pin<Box<dyn Future<Output = Result<ImageOperationTerminalClass, RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn restore_image_operation_override<'life0, 'life1, 'async_trait>( &'life0 self, session_id: &'life1 SessionId, operation_id: ImageOperationId, ) -> Pin<Box<dyn Future<Output = Result<ImageOperationPhase, RuntimeDriverError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,