Crate oxide_batch_repository

Expand description

Internal implementation crate for OxideBatch.

This crate is implementation detail. Use oxide-batch instead.

It exists on crates.io only because the published oxide-batch facade depends on it. Its API carries no stability promise: items may be added, changed, or removed in any release, without a deprecation period. It has no supported-configuration matrix, no compatibility ledger row, and no independent release cadence.

Everything here that OxideBatch supports is re-exported from oxide-batch under a stable path.

The crate holds the metadata repository, unit-of-work, clock, identifier, explorer, operator, retention, and recovery ports, the durable partition, flow-decision, audit, retention, and recovery values those ports exchange, the bounded operator request envelope, and the keyset pagination vocabulary the explorer port pages with. It depends on no async runtime, database driver, command-line framework, telemetry SDK, broker client, or web framework, and on no OxideBatch crate other than oxide-batch-core.

Metadata adapters, the services that drive these ports, and the execution engines live above this crate. The plan compiler is an independent sibling in oxide-batch-plan, which this crate may not depend on.

§Items marked `#[doc(hidden)]`

Some items exist as #[doc(hidden)] pub only because the facade’s own code was split from these types by the extraction boundary: private access that one crate resolved by module privacy now crosses a crate boundary. They are not part of any surface, supported or otherwise, and the facade never re-exports one under its own name. The staged crate-extraction contract records each one.

Structs§

ActorRef: Deployment-supplied opaque reference to the authorized caller.
Cursor: An opaque keyset continuation token.
DefinitionDescriptor: A redacted description of the definition bound to one execution.
ExecutionControl: The owning runtime’s bounded observation of one durable execution control.
FlowDecision: One append-only, repository-authoritative selected transition.
FlowDecisionId: Opaque durable identifier of one selected transition.
FlowDecisionRequest: A validated transition awaiting repository allocation and commit.
FlowDecisionSequence: Positive, execution-local ordering of selected transitions.
FlowStepState: Latest durable attempt for one logical step, used to reconstruct restart.
JobExecutionProjection: A redacted job execution projection.
JobInstanceProjection: A redacted logical job instance projection.
MaxClockSkew: A bounded repository/local wall-clock skew tolerance.
MonotonicInstant: A runtime-neutral reading of one monotonic clock.
OperationId: Caller-supplied idempotency key for one mutating action.
OperatorRecord: One append-only operator audit and idempotency record.
OperatorRecordDraft: The bounded audit row an adapter appends.
OperatorRequest: One validated mutating operator request.
OwnerToken: A per-process 16-byte execution-owner token.
Page: One bounded page and its continuation token.
PageRequest: One bounded page request.
PageSize: A validated page size in 1..=500.
ParameterDescriptor: A redacted description of one job parameter.
PartitionAggregate: The deterministic result of aggregating one complete durable partition plan.
PartitionKey: A stable byte-compared key within one partitioned step execution.
PartitionPlanEntry: One validated entry in a partition plan before durable identity assignment.
PartitionResult: A validated terminal result published by one assigned partition worker.
PurgeBatchBound: A validated purge batch bound in 1..=1000.
PurgeCandidate: One purge candidate and the version observed while planning.
PurgeCounts: Per-table row counts of one purge plan or applied batch.
PurgePlan: One bounded, digest-guarded purge plan.
PurgePlanRequest: One bounded purge planning request.
PurgeSurvey: The bounded candidate survey one adapter produces while planning.
QueryWindow: The bounded keyset window one adapter statement must honour.
ReasonCode: Bounded closed-set machine reason code.
RecoveryDecision: One append-only recovery audit record.
RecoveryEvidence: Canonical evidence retained by one recovery proposal.
RecoveryMarkers: Closed boolean recovery markers retained as one bounded bit set.
RecoveryProposal: A validated, evidence-bound recovery proposal.
RecoveryRequest: Bounded, value-redacted request for one audited recovery decision.
RecoveryResult: Result of atomically appending an audit decision and changing execution state.
RecoverySnapshot: One adapter-owned recovery snapshot gathered with repository server time.
RecoveryStepEvidence: Redacted evidence for the latest durable step execution.
RepositoryDescriptor: The versioned capability descriptor a durable adapter publishes.
RequestDigest: A framework-computed SHA-256 digest of one canonical request.
RetentionHold: One active retention hold on a logical instance.
RetentionRecord: One append-only retention audit record.
RetentionRecordDraft: The bounded retention audit row an adapter appends.
SequentialIdGenerator: A thread-safe nonzero identifier sequence suitable for local execution.
StaleThreshold: A bounded stale-execution threshold.
StateEnvelopeDescriptor: A redacted description of one durable state envelope.
StepExecutionProjection: A redacted step execution projection.
StepPartition: A durable partition plan row and its latest result snapshot.
StepPartitionProjection: A redacted durable partition projection.
SystemClock: An explicitly injected wall-clock implementation.
SystemMonotonicClock: An application-owned system monotonic clock.
TerminalStatusSet: A non-empty set of terminal statuses a purge may target.

Enums§

AuthorizationClass: The separately authorizable class of a service call.
CursorError: A rejected continuation token.
CursorKey: The immutable ordering key of the last row returned by a page.
ExplorerError: A stable inspection failure independent of a database or async runtime.
ExplorerQuery: The closed set of paginated explorer queries.
FlowTransitionKind: Why one transition was selected.
IdGenerationError: Failure from an injected identifier source.
JobInstanceSelection: The result of selecting the canonical instance for an identifying key.
OperatorAction: A mutating action a deployment authorizes and the core guards.
OperatorOutcomeClass: The durable class of one recorded operator request.
OperatorRejection: The typed reason one guard rejected an operator action.
OwnerObservation: The durable owner-token observation relative to the inspecting process.
PartitionAggregationError: A deterministic partition plan could not be aggregated safely.
PartitionValueError: Invalid public partition input.
RecoveryDirective: The disposition of one recovery decision together with the evidence that disposition requires.
RecoveryDisposition: Explicit operator disposition for an orphaned or ambiguous execution.
RecoveryError: A typed recovery-proposal failure.
RecoveryField: Recovery request field category.
RecoveryRequestError: Invalid bounded recovery request.
RepositoryCapability: A separately negotiated durable repository capability.
RepositoryError: A stable repository failure independent of a database or async runtime.
RequestField: A bounded request-envelope field category.
RequestFieldError: An invalid bounded request-envelope field.
RetentionAction: One audited retention action.
RetentionError: A typed retention failure.
RetentionOutcome: The durable class of one recorded retention action.

Constants§

DEFAULT_MAX_CLOCK_SKEW: Default repository/local clock-skew bound.
DEFAULT_PAGE_SIZE: Page size used when a caller does not choose one.
DEFAULT_PURGE_AGE: Minimum age used when a caller does not choose one.
DEFAULT_STALE_THRESHOLD: Default stale-execution threshold.
MAX_ACTOR_REF_BYTES: Maximum accepted UTF-8 bytes of an opaque actor reference.
MAX_CLOCK_SKEW: Maximum accepted repository/local clock-skew bound.
MAX_CURSOR_BYTES: Maximum size of one opaque cursor token.
MAX_OPERATION_ID_BYTES: Maximum accepted UTF-8 bytes of a caller-supplied idempotency key.
MAX_PAGE_SIZE: Maximum rows one page may contain.
MAX_PARTITION_CONTEXT_BYTES: Maximum serialized byte length of one durable partition context.
MAX_PARTITION_KEY_BYTES: Maximum UTF-8 byte length of one durable partition key.
MAX_PURGE_BATCH: Maximum executions one purge batch may target.
MAX_REASON_CODE_BYTES: Maximum accepted UTF-8 bytes of a closed-set reason code.
MAX_RESPONSE_BYTES: Maximum estimated encoded size of one page.
MAX_STALE_THRESHOLD: Maximum accepted stale-execution threshold.
MIN_CLOCK_SKEW: Minimum accepted repository/local clock-skew bound.
MIN_PURGE_AGE: Smallest accepted minimum age of a purge candidate.
MIN_STALE_THRESHOLD: Minimum accepted stale-execution threshold.
MIN_UNRESOLVED_AGE: Smallest age bound accepted by the unresolved-execution query.

Traits§

Clock: Supplies instants to repository and runtime operations.
ExplorerRepository: A bounded read port one metadata adapter implements.
IdGenerator: Supplies facade-owned opaque identifiers.
JobRepository: Starts isolated repository units of work.
MonotonicClock: Supplies monotonic readings for bounded recovery observations.
RecoveryRepository: Adapter port for one bounded, server-time recovery observation.
RepositoryUnitOfWork: Transaction-scoped metadata operations required by the executable kernel.

Functions§

aggregate_step_partitions: Aggregates a complete partition plan independently of input or completion order.

Type Aliases§

BoxFuture: An owned, dynamically dispatched future used by public asynchronous ports.