Struct OperatorSessionRecord 

pub struct OperatorSessionRecord {
    pub sid: SessionId,
    pub token_digest: String,
    pub capability_manifest: Option<AgentProviderManifest>,
    pub joined_at_secs: u64,
    pub desc: Option<String>,
    pub observed: Vec<ObservedAssignment>,
    pub observed_total: u64,
}

One persisted Operator login-flow session.

Field-for-field the durable subset of the server’s LoginSession — everything except the process-lifetime WS adapter state, which is rebuilt empty on reconnect.

The bearer token is never stored

token_digest holds hex(SHA-256(bearer)) — the same fingerprint shape the /v1/sessions path already keys its store by, for the same reason (“the sid handed to the client is the token nonce itself (a bearer secret), so the server never uses it as a map key”; see mse_server::SessionStore). Every consumer of this record only ever compares a presented bearer (verify_bearer), so nothing downstream needs the plaintext — it exists only inside POST /v1/operators, between minting and the mint response.

Fields

sid: SessionId

Server-minted session id (S-<hex>).

token_digest: String

hex(SHA-256(bearer)) of the auth token required on the WS upgrade and admin routes. Derive with Self::digest_of; compare with Self::verify_bearer. The plaintext bearer is deliberately absent (see the type doc).

capability_manifest: Option<AgentProviderManifest>

Provider-owned effective capability manifest submitted at join.

joined_at_secs: u64

Unix epoch seconds when POST /v1/operators minted this session.

desc: Option<String>

The confirmed part of this session’s 記名 (model §4.2, D1): roughly 50 characters the joining AI wrote about what it is working on, fixed at join and never rewritten afterwards.

It is what the observed part cannot supply. Two drivers in the same worktree produce the same project_root / work_dir and can hold Runs of the same Blueprint; the sentence one of them wrote at join exists only in that conversation, which is what makes it an identifier (§4.2: 観測部分だけでは足りない).

None = the session joined without one. Kept as an absence rather than an empty string so a reader can tell “nothing was written” from “something was written and it was blank” — POST /v1/operators does not reject a missing desc (unlike A9 on the assignment side, D1-D5 name no 400), so the absence is a real and readable state.

D4: nothing matches on this. It is read by humans and AIs to tell sessions apart, never by the server to decide identity.

Additive with #[serde(default)] — rows persisted before the 記名 existed decode as None.

observed: Vec<ObservedAssignment>

The observed part of this session’s 記名 (model §4.2, D2): one entry per seat this session was assigned, appended by the server at each Assign and never removed by any API.

Oldest first. Bounded by OBSERVED_CAP and de-duplicated per (run_id, slot) — see Self::record_observed.

Additive with #[serde(default)].

observed_total: u64

How many Assigns have been recorded onto Self::observed over this session’s life, including the ones the ring has since dropped and the re-assignments folded into an existing entry.

Monotone. observed_total > observed.len() is the visible signal that the reader is looking at a window rather than the whole history.

Additive with #[serde(default)].

Implementations

impl OperatorSessionRecord

pub fn record_observed(&mut self, entry: ObservedAssignment)

Append one Assign to the observed part (D2).

Two shaping rules, both about keeping the log readable rather than about deleting anything:

• One entry per (run_id, slot). Re-acquiring a seat this session already holds is the same fact with a newer timestamp, so the existing entry is replaced and moved to the newest position instead of accumulating a row per acquire. A driver that re-acquires after every reconnect would otherwise fill the whole window with one Run.
• Newest OBSERVED_CAP kept. Past the cap the oldest entry is dropped.

Self::observed_total counts every call regardless, so a reader can tell that folding or dropping happened.

pub fn last_activity_secs(&self) -> u64

When this session was last seen doing something — the newest ObservedAssignment::at_secs, or Self::joined_at_secs for a session that has never been assigned anything.

D5’s default ordering key. Derived rather than stored: a separate column would be a second thing to keep in step with the log, and the ring only ever drops entries older than the newest one, so the derivation cannot go stale.

pub fn digest_of(bearer: &str) -> String

Digest a plaintext bearer into the at-rest shape (Self::token_digest).

Callers mint a bearer with operator_bearer_token and keep the plaintext only long enough to answer the mint request.

pub fn verify_bearer(&self, bearer: &str) -> bool

Constant-time check of a presented bearer against Self::token_digest.

The comparison runs over the two digests (fixed-width hex), so it carries no timing signal about the bearer itself.

Trait Implementations

impl Clone for OperatorSessionRecord

fn clone(&self) -> OperatorSessionRecord

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OperatorSessionRecord

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for OperatorSessionRecord

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for OperatorSessionRecord

fn eq(&self, other: &OperatorSessionRecord) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for OperatorSessionRecord

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for OperatorSessionRecord