Module binding 

Binding format v2 — one record per pipeline.

This is the live binding shape: crate::pipeline_store::load_pipeline_configs reads it (version-gated), the projection CLI tree writes it, and the resolve / brief / status / advance paths consume it. A v2 Binding alone fully defines a pipeline: intent, inline sources (each carrying what the retired standalone medium + facet records carried), reference mems, destination, deny paths, coverage semantics, and operations. The 2026-07 consolidation (operator directive, 2026-07-18) removed the three-file store: the engine reads only this format; memstead projection migrate converts prior generations, and there is no compatibility layer.

Three things live here:

1. Binding — the versioned record: one file per pipeline, collapsing the medium / facet / binding split into a single record with inline Source entries and an operations { build, sync, verify } block.
2. hash_binding — hash(D): the lowercase-hex SHA-256 of the canonical JSON of the binding’s content-defining projection. Scheduling knobs (trigger / batch_size / post_actions, the sync/verify blocks, prune) are excluded by construction; a source’s selection pattern or pointer changing — now inputs inside the one record — changes the hash.
3. medium_capabilities + validate_binding — the medium-capability matrix (the medium half of a source description keeps the medium vocabulary) and the validation entry point: capability refusals plus in-record source validation (empty / duplicate source names).

The findings store (crate::ingest::findings) keys on hash(D), so the consolidation’s shape change invalidates prior findings by construction — accepted and disclosed (findings are re-derivable measurements).

Structs

Binding

A binding, format version 2 — one record per pipeline. The single versioned file at projections/<mem>/<name>.json that alone fully defines the obligation: intent, inline Source entries (each carrying the medium and facet halves the retired standalone records held), reference_mems, destination_mem, deny_paths, coverage_semantics, rules, prune, and the operations { build, sync, verify } block.

BuildOperation

The build operation — the only operation carrying a mode. Grows new coverage (or runs a one-shot lens). trigger / batch_size / post_actions are scheduling attributes, excluded from hash_binding.

EffectiveCoverage

The effective coverage of a binding plus its provenance — whether the value was declared by the author or resolved from the sources’ media. The fidelity report renders the distinction; every other consumer reads only Self::value.

MediumCapabilities

What a medium can support — the row of the capability matrix for a MediumType (the medium half of a source description). Pure data; validate_binding reads it to refuse operations a medium cannot support.

Operations

The operations block of a Binding: every operation is optional. An absent build / sync block makes that mutating operation refuse at run time with a projection enable <op> remedy; an absent verify block means engine defaults (verify is read-only — never a refusal). build is optional in serde so an absent block yields the remedy-bearing refusal rather than a generic “missing field” parse error.

PruneConfig

The prune configuration of a Binding (F1) — additive, optional. An absent prune block means prune is not enabled for the binding (no deletion proposals are produced). Prune has no independent schedule: it rides the sync brief (the sole maintenance-writer channel), so it carries no trigger / batch_size — only the requested PruneGuarantee. Like the sync / verify blocks it is excluded from hash_binding: a maintenance policy never changes what the mem claims.

SyncOperation

The sync operation — the (future) sole maintenance writer. Optional: an absent sync block makes that mutating operation refuse at run time. Carries no mode.

VerifyOperation

The verify operation — read-only measurement. Optional: an absent verify block means engine defaults, never a refusal (verify is read-only). Carries no mode.

Enums

BuildMode

How a BuildOperation engages its binding. refinement is deleted from the vocabulary — it is neither a variant here nor migrated, so deserializing "mode": "refinement" fails as an unknown value.

CapabilityError

A validation-time refusal: a capability the source’s medium half cannot support, or a malformed in-record source declaration. Every refusal names the offending source so it is diagnosable without re-reading the store.

CoverageSemantics

Coverage semantics — whether the binding claims to cover everything in its declared scope (exhaustive) or a deliberately partial slice (curated).

Operation

A binding operation subject to capability validation.

PruneGuarantee

The prune guarantee a binding requests (bundle plan 05-verify-sync-engine, F1). Prune produces deletion proposals surfaced in the sync brief (it never mutates the mem); the guarantee governs how a prune proposal treats a model-side edit that races a source removal.

Constants

BINDING_VERSION

The current binding format version. A v2 binding carries version: 2.

DEFAULT_ADJUDICATION_CAP

Default per-run tier-3 adjudication cap (bundle plan 05-verify-sync-engine, D1/D4). Dogfood-tuned against the live engine/graph binding (524 source artifacts): a fully-drifted mem of that scale clears its adjudication backlog in ~11 verify runs while each run’s asserted-drift work stays bounded and its token cost predictable. 0 disables the cap (adjudicate every candidate).

DEFAULT_FULL_RESYNC_EVERY

Default full_resync_every (bundle plan 05-verify-sync-engine, D3/D4): fire a guaranteed full-enumeration coverage sweep every N verify runs. Dogfood-tuned against engine/graph (524 artifacts, sample batch 20 → a rotation completes in ~27 runs): a sweep every 20 runs guarantees a complete coverage picture without waiting on the rotation to happen to finish. 0 disables scheduled full walks (rotating sample only).

DEFAULT_SCAFFOLD_DENY_PATHS

Default deny_paths scaffolded onto a fresh enumerable (codebase / filesystem) binding: ordinary platform/tooling debris that would otherwise flood a first denominator. A default, not an invariant — the scaffold materialises the list into the binding record, so an author who wants one of these in scope deletes the entry and gets the files back; bindings created before the default existed keep their recorded (empty) list. Engine state (.memstead/, .memstead.cache/, mount storage) is NOT on this list — its exclusion is unconditional in the strategy layer, never a deletable record entry.

PREPARATION_IMPL_VERSION

The engine’s current preparation-implementation version — the single source of truth for “which preparation implementation is live”.

Functions

effective_coverage_semantics

Resolve a binding’s effective coverage semantics. A declared value wins (validation has already refused an illegal exhaustive). An undeclared value resolves per binding, not per source: all sources on enumerable media → exhaustive; at least one non-enumerable source → curated — a mixed binding can only honestly claim the weaker of its parts, because coverage is an obligation of the binding as a whole (the artifact that is measured, reported, and keyed).

hash_binding

Compute hash(D) — the lowercase-hex SHA-256 of the canonical JSON of a binding’s content-defining projection.

medium_capabilities

The capability-matrix row for a medium type. The single source of truth the fidelity report also renders.

prune_guarantee_for_medium

The strongest prune guarantee a medium can support (F1), derived from the capability matrix: a base-leg-retrievable medium (git-backed — codebase / filesystem / git / graph) supports the full never-clobber three-way merge; a non-retrievable medium (web) supports only conflict-flag degradation. Validation refuses a request that exceeds this.

validate_binding

Validate a binding against the medium-capability matrix and the in-record source rules, returning every refusal (empty Err never returned — Ok means clean). The v2 record needs no external resolution: everything validated lives inside the one record.