Module types 

Fundamental types: Role / Verb / RoleVerbGate / CapToken / IDs.

Structs

CapToken

Capability token. max_uses picks between OneTime / Session / Limited.

RoleVerbGate

Role × Verb gate table. Const-style storage.

SessionId

Opaque session identifier, e.g. S-<hex>. See TaskId for the newtype rationale.

TaskId

Opaque task identifier, e.g. T-<hex>. Newtype over String so task, session, and worker ids can’t be swapped by accident at call sites.

TokenSigner

Server-side machinery for minting and verifying tokens.

WorkerId

Opaque worker identifier, e.g. W-<hex>. See TaskId for the newtype rationale.

WorkerPayload

Response body for HTTP /v1/worker/prompt — the shape that lets a SubAgent pull its task input in a single round-trip.

Enums

CapTokenDecodeError

Error returned when CapToken::decode fails.

Role

The four participant roles in the swarm. Every Verb a caller wants to invoke must be allow-listed for its role in a RoleVerbGate.

Verb

Every action a participant can request. Grouped by the Role that typically performs it (see the // operator / // worker / … section comments below); the grouping is documentation only — actual authorization is decided by RoleVerbGate::is_allowed.

Constants

OBSERVER_VERBS

Verbs an Observer may invoke — strictly read-only (event subscription and trace/state reads, no mutation).

OPERATOR_VERBS

Verbs an Operator may invoke — covers task lifecycle, session, and senior interactions.

SENIOR_VERBS

Verbs a Senior may invoke — human/oversight actions: answering queries, overriding verdicts, and pausing/resuming/injecting into the dispatch loop.

WORKER_LEAF_VERBS

The Worker verbs shared across all workers — the minimum a leaf needs, with no sub-task spawning. If we introduce Role::WorkerLeaf in the future, that role gets allowed against this slice.

WORKER_SWARM_VERBS

Worker verbs for recursive swarming: sub-task spawn and observation. When Role::WorkerSwarm splits out in the future, that role gets allowed against WORKER_LEAF_VERBS plus this slice. The safety valves are EngineCfg.max_spawn_depth today, and a task-ownership gate down the line.

Functions

default_role_verb_table

The default Role × Verb table.

secure_hex

OS-RNG hex, safe for bearer credentials.

uid_hex

In-process-unique, restart-decorrelated hex id.