Struct GuardedToolRuntime 

pub struct GuardedToolRuntime<S> { /* private fields */ }

In-process Host reference monitor and execution gate.

The policy ceiling, registry, call ledger, and approval verifier are all Host-owned. Callers can grant less authority per Run but cannot replace the ceiling or a registered descriptor.

Implementations

impl<S: ApprovalCapabilityStore> GuardedToolRuntime<S>

pub async fn freeze_model_observations( &self, run_id: &RunId, observations: &ModelToolObservations, pending_calls: &[ToolCallId], ) -> Result<FrozenToolObservations, ToolOutcome>

impl<S: ApprovalCapabilityStore> GuardedToolRuntime<S>

pub fn new( host_ceiling: HostToolPolicy, approval_verifier: HostApprovalVerifier<S>, ) -> Result<Self, ToolRuntimeError>

pub fn new_with_effect_journal( host_ceiling: HostToolPolicy, approval_verifier: HostApprovalVerifier<S>, effect_journal: Arc<dyn ToolEffectJournalStore>, ) -> Result<Self, ToolRuntimeError>

pub fn new_with_effect_journal_and_artifacts( host_ceiling: HostToolPolicy, approval_verifier: HostApprovalVerifier<S>, effect_journal: Arc<dyn ToolEffectJournalStore>, artifact_store: ToolArtifactStore, ) -> Result<Self, ToolRuntimeError>

pub fn with_permission_policy( self, policy: Arc<dyn ToolPermissionPolicy>, ) -> Self

Replaces the immutable invocation permission policy before the runtime is shared or registered with an Agent composition root.

pub fn register( &self, descriptor: ToolDescriptor, executor: Arc<dyn GuardedToolExecutor>, ) -> Result<(), ToolRuntimeError>

Registers an immutable descriptor and policy-aware executor.

pub fn execution_contract_digest(&self) -> Result<Digest, ToolRuntimeError>

Digests only the declared execution boundary. Executor pointers, approval signing material, and mutable invocation state are intentionally excluded.

pub fn project_model_output( &self, invocation: &ToolInvocation, output: &Value, ) -> Result<Value, ToolRuntimeError>

pub fn model_tool_schemas( &self, ) -> Result<Vec<ModelToolSchema>, ToolRuntimeError>

Projects only the model-facing schema. Host policy, effect declarations, approval state, and executor details cannot enter this return type.

pub fn resolve_tool_id( &self, model_name: &str, ) -> Result<Option<ToolId>, ToolRuntimeError>

pub fn activity_evidence( &self, invocation: &ToolInvocation, outcome: Option<&ToolOutcome>, ) -> Result<Vec<ToolActivityEvidence>, ToolRuntimeError>

pub async fn recover_outcome( &self, invocation: ToolInvocation, run_grant: RunToolGrant, ) -> Result<Option<ToolOutcome>, ToolOutcomeRecoveryError>

Replays only durable Tool state. This path can close an Observed result or classify an orphaned Invoked effect as unknown, but it never creates Prepared/Invoked records and never enters an executor.

pub async fn invoke( &self, invocation: ToolInvocation, run_grant: RunToolGrant, approval: Option<ApprovalCapability>, run_cancellation: CancellationToken, ) -> GuardedToolResult

Executes the fixed guarded pipeline:

invocation/input schema → effective policy → operation planning → permission decision/approval → concurrency gate/executor → output schema and output limit.

pub async fn invoke_with_yield( &self, invocation: ToolInvocation, run_grant: RunToolGrant, approval: Option<ApprovalCapability>, run_cancellation: CancellationToken, yield_requested: CancellationToken, ) -> GuardedToolResult

Runs the same guarded, journaled invocation while allowing an executor to yield an observation when new Host input arrives.

pub async fn invoke_with_observations( &self, invocation: ToolInvocation, run_grant: RunToolGrant, approval: Option<ApprovalCapability>, run_cancellation: CancellationToken, yield_requested: CancellationToken, observations: &FrozenToolObservations, ) -> GuardedToolResult

pub async fn inspect_effect( &self, key: &ToolEffectKey, ) -> Result<Option<ToolEffectProjection>, ToolOutcomeRecoveryError>

Loads a durable Tool effect without closing Observed or classifying Invoked. This is deliberately read-only so a workflow can perform a global recovery preflight before it dispatches any new work.

pub fn forget_run(&self, run_id: &RunId) -> Result<(), ToolRuntimeError>

Releases replay and per-Run gate state once the owning Agent Run is no longer resumable in this process.

Trait Implementations

impl<S> AgentToolRuntime for GuardedToolRuntime<S>

where S: ApprovalCapabilityStore + 'static,

fn project_model_output( &self, invocation: &ToolInvocation, output: &Value, ) -> Result<Value, ToolRuntimeError>

fn freeze_model_observations<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, run_id: &'life1 RunId, observations: &'life2 ModelToolObservations, pending_calls: &'life3 [ToolCallId], ) -> Pin<Box<dyn Future<Output = Result<FrozenToolObservations, ToolOutcome>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

fn execution_contract_digest(&self) -> Result<Digest, ToolRuntimeError>

Stable identity of the Host-side execution contract used to decide whether a private Agent checkpoint may continue after restart.

fn model_tool_schemas(&self) -> Result<Vec<ModelToolSchema>, ToolRuntimeError>

fn resolve_tool_id( &self, model_name: &str, ) -> Result<Option<ToolId>, ToolRuntimeError>

fn activity_evidence( &self, invocation: &ToolInvocation, outcome: Option<&ToolOutcome>, ) -> Result<Vec<ToolActivityEvidence>, ToolRuntimeError>

fn inspect_effect<'life0, 'life1, 'async_trait>( &'life0 self, key: &'life1 ToolEffectKey, ) -> Pin<Box<dyn Future<Output = Result<Option<ToolEffectProjection>, ToolOutcomeRecoveryError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Reads one durable effect projection without changing its phase. Workflow recovery uses this to reject an entire replay before any new sibling Tool is dispatched when one prior invocation is unresolved.

fn recover_outcome<'life0, 'async_trait>( &'life0 self, invocation: ToolInvocation, run_grant: RunToolGrant, ) -> Pin<Box<dyn Future<Output = Result<Option<ToolOutcome>, ToolOutcomeRecoveryError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Recovers an already-started invocation from the durable Effect Journal without ever calling its executor or creating a fresh effect record. Ok(None) means no durable outcome exists. Callers must establish exclusive recovery ownership before using this operation.

fn invoke<'life0, 'async_trait>( &'life0 self, invocation: ToolInvocation, run_grant: RunToolGrant, approval: Option<ApprovalCapability>, run_cancellation: CancellationToken, ) -> Pin<Box<dyn Future<Output = GuardedToolResult> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

fn invoke_with_yield<'life0, 'async_trait>( &'life0 self, invocation: ToolInvocation, run_grant: RunToolGrant, approval: Option<ApprovalCapability>, run_cancellation: CancellationToken, yield_requested: CancellationToken, ) -> Pin<Box<dyn Future<Output = GuardedToolResult> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Invoke with a Host signal for cooperative waits. Implementations that do not support yielding retain their normal execution semantics.

fn invoke_with_observations<'life0, 'life1, 'async_trait>( &'life0 self, invocation: ToolInvocation, run_grant: RunToolGrant, approval: Option<ApprovalCapability>, run_cancellation: CancellationToken, yield_requested: CancellationToken, observations: &'life1 FrozenToolObservations, ) -> Pin<Box<dyn Future<Output = GuardedToolResult> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Uses only observations from the Host’s already-dispatched model request. Runtimes without observation resolution preserve their existing path.