Struct Coder 

pub struct Coder { /* private fields */ }

The coder. Holds the inference backend the orchestrator uses for each run call; the backend is Arc<dyn …> so callers can share one backend across coder + non-coder paths.

Issue #93 — operator-rooted parent key

Coder optionally holds the worker’s operator-rooted parent AgentKey (from WorkerIdentity::Operator { root }). When a dispatch needs to spawn a subprocess plugin (today: future ProviderPluginBackend::complete), it derives a delegated child via AgentKey::delegate so the child’s cert chain roots back to the operator’s UserKey from ~/.newt/identity.pem — never a synthetic key.

Implementations

impl Coder

pub fn new(backend: Arc<dyn InferenceBackend>) -> Self

Build a coder bound to backend.

pub fn with_parent_key(self, parent: Arc<AgentKey>) -> Self

Builder: attach the operator-rooted parent AgentKey the coder will use to delegate per-spawn children for subprocess plugins (issue #93).

The acp-worker plumbs this in from WorkerIdentity::Operator { root } via [WorkerIdentity::parent_key]; the AllowNoKey debug fallback leaves it None. When present, Self::plugin_envelope_for can be called by future dispatch paths that need to spawn a provider plugin without first synthesizing a key.

pub fn parent_key(&self) -> Option<&Arc<AgentKey>>

Borrow the parent AgentKey, if one is configured. Tests use this to assert the operator-rooted threading; future dispatch paths that spawn provider plugins use it to delegate per-spawn children.

pub fn plugin_envelope_for( &self, role: &str, child_caveats: Caveats, ) -> Option<Result<String, EnvelopeError>>

Mint a plugin-side envelope for a subprocess running under role with child_caveats, by delegating from the coder’s operator-rooted parent key.

Returns:

• Some(Ok(envelope)) on the happy path — the envelope’s cert chain roots back to the operator’s UserKey (issue #93).
• Some(Err(_)) if delegation refused (child_caveats would amplify the parent’s authority, etc.).
• None when no parent key is configured (the WorkerIdentity::AllowNoKey debug path or a legacy test that didn’t thread identity).

The returned envelope is the same shape newt-mesh’s plugin_envelope::serialize_for_plugin produces — base64’d JSON of an agent_mesh_protocol::CertChain — so plugins decode it identically.

pub async fn run( &self, workspace: &Path, task: &str, caveats: &Caveats, ) -> Result<CoderRun>

Run one turn against workspace under the authority carried by caveats.

caveats is the peer’s signed, verified attenuated authority — see docs/decisions/agentic_object_capability_security.md and the 35a caveats_for_peer extractor in newt-mesh. Every tool dispatch this method makes (fs_read for the prompt scan, net for the inference call, fs_write for the apply, plus the max_calls budget for inference turns) goes through the enforcement helpers below — no path bypasses the check, even when caveats == Caveats::top(). That symmetry is load-bearing: 35c will tighten authority per peer, and a “skip checks if top” shortcut would silently break that tightening.

On any caveat refusal we return CoderError::CapabilityDenied carrying the axis name and the concrete target the dispatch tried to touch — enough context for the arbiter scorecard to count this as a scrubbed sortie rather than a model failure.

Happy path: build prompt -> infer -> normalize -> apply.

Weak-model fallback: when the model emits a Emission::UnifiedDiff (even under the whole-file directive) and that diff fails to apply — its line numbers / context are too far off even for the fuzzy matcher in newt-tools::apply_patch — we issue exactly ONE re-prompt asking for the COMPLETE file(s) in FILE:/END-FILE form, then apply via the hardened apply_whole_files path. The retry counts as a second inference call against the max_calls budget; if that budget would be exhausted we return the original apply error rather than escalating to a denial.