Crate oxide_batch

Expand description

The public facade for OxideBatch.

OxideBatch models a batch job as a named definition launched with typed parameters. Identifying parameters select a logical JobInstance, while each launch or restart receives a distinct JobExecutionId.

use oxide_batch::{
    JobInstanceKey, JobName, JobParameter, JobParameters, ParameterName,
    ParameterRole, ParameterValue,
};

let mut parameters = JobParameters::new();
parameters.insert(
    ParameterName::new("business_date")?,
    JobParameter::new(
        ParameterValue::string("2026-07-29")?,
        ParameterRole::Identifying,
    ),
)?;

let key = JobInstanceKey::new(JobName::new("daily_import")?, &parameters);
assert_eq!(key.identifying_parameter_count(), 1);

Parameter values are sensitive by default. Their Debug representations expose the value kind, but not the underlying value.

Repository operations run inside an explicit RepositoryUnitOfWork. Time and identifiers are injected into the reference InMemoryJobRepository, so tests do not depend on wall-clock time or process-global identifier state. A unit of work publishes changes only after RepositoryUnitOfWork::commit succeeds; dropping it rolls back its staged metadata.

JobLauncher runs one-step TaskletJob definitions on an application-owned executor. Tasklets borrow their call-scoped TaskletContext, receive cooperative StopToken state, and persist completed, failed, panicked, or stopped outcomes through the repository. Synchronous bodies use BlockingTaskletAdapter with an explicit nonzero concurrency bound.

JobExecutionListener and StepExecutionListener callbacks nest around tasklet work with deterministic ordering. LifecycleEvent values are emitted after corresponding metadata commits through a non-authoritative LifecycleEventSink. Their structured fields exclude parameters, contexts, records, credentials, and arbitrary user error payloads.

M2 chunk definitions use ChunkStep, ChunkJob, ItemReader, ItemProcessor, ItemWriter, and ChunkCompletion. The JobLauncher::launch_chunk path reuses job/step lifecycle metadata while ChunkTransaction isolates adapter-owned commit and rollback. End of input, filtering, cooperative stopping, failures, unknown commit, and post-commit acknowledgement remain distinct typed outcomes. An enlisted writer borrows BusinessTransaction for only its call; no database-driver type crosses the facade.

M3 adds runtime-neutral fault-tolerance values. FaultPolicy combines a FaultClassifier over stable FaultPhase and FailureCategory inputs with a bounded RetryLimit, RetryStateLimit, SkipLimit, and a deterministic BackoffPolicy. FaultPolicy::decide is a pure function of the policy, a framework-owned FaultDescriptor, and FaultEvidence, so a restart reproduces the same decision. Waiting uses an injected BackoffSleeper rather than wall-clock time, and RollbackDisposition::CommitSafeSkip still records a skip instead of silently dropping an item.

ItemListenerSet owns the M3 ReadListener, ProcessListener, WriteListener, RetryListener, and SkipListener families. Before callbacks run in registration order and stop at the first failure; the matching completion callbacks run only the entered listeners in reverse order and aggregate every failure. A panic is classified exactly like a returned ListenerError, and no callback receives an error payload.

ChunkStep::with_fault_runtime installs a FaultRuntime and makes that policy executable. A retryable fault rolls the chunk attempt back, reserves its ordinal through a bounded FaultStateStore, runs the retry scope, waits the injected backoff, and replays the chunk from inputs it already read, so a stateful reader never rewinds. An accepted skip is provisional until the commit that records it, and a commit-safe skip additionally requires ChunkDeliveryMode::AtomicSameResource and an enlisted transaction. ChunkExecutionReport returns per-phase RetryCounts and SkipCounts, rollback and no-rollback counts, and redacted ItemListenerFailure values.

Checkpoint and ExecutionContext retain bounded versioned JSON through application-owned VersionedStateCodec implementations. Codec signatures exchange JSON object bytes, keeping serializer types out of the public contract. Their Debug output never includes payloads.

A codec declares its current schema version and the StateSchemaUpgrade edges it can apply. Decoding an older recorded version walks one bounded, deterministic chain of those edges and only then calls VersionedStateCodec::decode, so a codec parses exactly one shape. A recorded version newer than the codec, or one with no declared path to the current version, fails closed rather than being truncated, defaulted, or reinterpreted.

DefinitionManifest reads canonical definition bytes back without guessing. A newer format, a non-canonical encoding, a floating-point value, an out-of-bound graph, or a digest that does not match the supplied bytes fails closed.

use oxide_batch::{
    ComponentRevision, DefinitionIdentity, DefinitionManifest, DefinitionRevision, JobName,
    StepName,
};

let identity = DefinitionIdentity::tasklet(
    &JobName::new("daily_import")?,
    &StepName::new("import")?,
    DefinitionRevision::new("2026-07-31")?,
    &ComponentRevision::new("tasklet-v1")?,
)?;
let manifest = DefinitionManifest::read_verified(
    identity.canonical_manifest(),
    identity.manifest_digest(),
)?;
assert_eq!(manifest.format(), 1);
assert_eq!(manifest.node_count(), None);

A multi-step definition is declared as a FlowGraph of FlowNode values joined by exit-pattern FlowTransition edges and compiled into an immutable CompiledExecutionPlan that owns the canonical manifest and fingerprint:

use oxide_batch::{
    ComponentRevision, DefinitionRevision, ExitPattern, FlowGraph, FlowNode, FlowTarget,
    FlowTransition, JobName, NodeId, StepComponents, StepNode, StepName, TerminalKind,
};

let load = NodeId::new("load")?;
let report = NodeId::new("report")?;
let plan = FlowGraph::new(load.clone())
    .with_node(FlowNode::step(StepNode::new(
        load.clone(),
        StepName::new("load")?,
        StepComponents::Tasklet(ComponentRevision::new("load-v1")?),
    )))
    .with_node(FlowNode::step(StepNode::new(
        report.clone(),
        StepName::new("report")?,
        StepComponents::Tasklet(ComponentRevision::new("report-v1")?),
    )))
    .with_sequence(load, FlowTarget::Node(report.clone()))?
    .with_sequence(report, FlowTarget::Terminal(TerminalKind::Complete))?
    .compile(&JobName::new("daily_import")?, DefinitionRevision::new("v1")?)?;

assert_eq!(plan.manifest_format(), 2);
assert_eq!(plan.node_count(), 2);

ExitPattern selects one of those transitions from the bounded ExitCode a step reports, never from a BatchStatus:

use oxide_batch::{ExitCode, ExitPattern};

let failed = ExitPattern::new("FAILED")?;
let any = ExitPattern::new("*")?;
assert!(failed.matches(&ExitCode::new("FAILED")?));
assert!(!failed.matches(&ExitCode::new("COMPLETED")?));
assert!(any.matches(&ExitCode::new("COMPLETED")?));
assert!(failed.specificity() > any.specificity());

FaultPolicy::decide is a pure function of the policy, a framework-owned FaultDescriptor, and FaultEvidence:

use std::time::Duration;

use oxide_batch::{
    BackoffPolicy, ChunkDeliveryMode, ClassifierRevision, FailureCategory, FailureId,
    FailureSummary, FaultAction, FaultClassifier, FaultDecision, FaultDescriptor,
    FaultEvidence, FaultPhase, FaultPolicy, FaultRule, RetryLimit, RetryOrdinal,
    RetryStateLimit, SkipCounts, SkipLimit,
};

let classifier = FaultClassifier::new(
    ClassifierRevision::new("import_v1")?,
    [FaultRule::new(
        FaultPhase::Write,
        FailureCategory::Timeout,
        FaultAction::retry(),
    )?],
)?;
let policy = FaultPolicy::new(
    classifier,
    RetryLimit::new(3)?,
    RetryStateLimit::new(64)?,
    SkipLimit::NONE,
    BackoffPolicy::exponential(Duration::from_millis(50), 2, Duration::from_secs(5))?,
)?;

let fault = FaultDescriptor::new(
    FaultPhase::Write,
    FailureSummary::new(FailureCategory::Timeout, FailureId::new(1)?),
    RetryOrdinal::INITIAL,
    SkipCounts::ZERO,
    true,
    ChunkDeliveryMode::AtomicSameResource,
);
assert_eq!(
    policy.decide(&fault, FaultEvidence::NONE),
    FaultDecision::Retry {
        ordinal: RetryOrdinal::new(1)?,
        delay: Duration::from_millis(50),
    }
);

Run the complete in-memory example from the workspace root:

cargo run -p oxide-batch --example first_job

The application supplies the async executor; public tasklet and repository contracts use BoxFuture rather than executor- or database-driver types.

Structs§

ActorRef: Deployment-supplied opaque reference to the authorized caller.
BackoffPolicy: A deterministic, jitter-free backoff schedule.
BeforeCallbackOutcome: The outcome of one registration-order before-callback pass.
BlockingTaskletAdapter: Isolates synchronous tasklet work behind a bounded Tokio blocking pool.
BlockingTaskletContext: Owned execution data supplied to an isolated blocking tasklet.
BusinessStatement: A parameterized business write borrowed for one transaction call.
BusinessValue: A stable bound-value type for enlisted business statements.
BusinessWriteResult: Successful effect from one enlisted business statement.
CaCertificate: A bounded, value-redacted PEM certificate-authority bundle.
Checkpoint: A bounded, versioned reader position committed with a chunk.
ChunkCommitReceipt: Evidence returned after one chunk transaction is known to have committed.
ChunkCompletionContext: Read-only evidence passed after the chunk transaction commits.
ChunkCompletionError: chunk completion callback failed
ChunkComponentRevisions: Component revisions for a one-step chunk definition.
ChunkCount: A checked non-negative item or transaction count.
ChunkCounts: Validated item counts within one open chunk.
ChunkExecutionReport: In-memory execution evidence returned by a chunk step.
ChunkFaultProgress: The fault-tolerance progress one chunk commit makes authoritative.
ChunkJob: A validated single-step chunk job definition.
ChunkLaunchReport: Combined repository lifecycle and chunk-orchestration result.
ChunkListenerContext: Read-only state supplied at a chunk-listener boundary.
ChunkListenerError: A value-redacted chunk-listener failure.
ChunkListenerFailure: One redacted chunk-listener failure in callback execution order.
ChunkProgress: Mutable, invariant-preserving progress for one bounded chunk.
ChunkRestartContract: Restart-state schemas and delivery mode for a chunk definition.
ChunkSize: A nonzero item limit for one chunk.
ChunkStep: A validated one-step chunk definition.
ChunkTransactionContext: Repository execution identity for one launched chunk transaction.
ClassifierRevision: An application-owned revision token for one bounded fault classifier.
CompiledExecutionPlan: A validated, immutable execution plan.
ComponentRevision: An application-owned revision token for one opaque executable component.
Cursor: An opaque keyset continuation token.
DeciderError: A value-redacted decider failure.
DeciderRevision: An application-owned revision token for one deterministic decider.
DecisionInput: Immutable, sensitivity-aware input supplied to one decider invocation.
DecisionInputVersion: The version of the durable input contract one decider reads.
DecisionNode: One deterministic decision node of a compiled plan.
DecisionStepInput: Durable preceding-step data supplied to a decider.
DefinitionDescriptor: A redacted description of the definition bound to one execution.
DefinitionIdentity: Canonical restart-relevant identity persisted with every execution.
DefinitionManifest: A validated, read-only view of one canonical definition manifest.
DefinitionRevision: An application-owned audit label for one restart-relevant definition.
DefinitionUpgrade: One explicit, directed definition compatibility edge.
DefinitionUpgradeKey: An application-owned key for one directed definition compatibility edge.
DiagnosticField: A reviewed key/value field suitable for structured logs or spans.
DropReportWindow: A validated throttling window for exporter-drop reporting.
ExecutionAttempt: A nonzero, instance-scoped execution-attempt ordinal.
ExecutionContext: Bounded, versioned application restart state committed with a chunk.
ExecutionControl: The owning runtime’s bounded observation of one durable execution control.
ExecutionCorrelation: Stable, bounded identifiers shared by job and step diagnostics.
ExecutionCounts: Durable item and transaction counters for an execution.
ExecutionMetadata: Validated lifecycle, outcome, timestamps, counters, and failure metadata.
ExecutionTimestamps: Validated creation, start, and end instants for an execution attempt.
ExecutionVersion: A database-agnostic optimistic-lock version for an execution record.
ExitCode: A validated flow- and operator-facing exit code.
ExitPattern: A bounded exit-outcome pattern used to select one transition.
ExitStatus: A flow- and operator-facing result kept separate from BatchStatus.
ExportError: A value-redacted exporter failure.
ExportFlushReport: Flush result that never changes batch correctness.
ExportQueueBound: A validated finite exporter queue bound.
FailureId: An opaque identifier used to correlate a redacted failure.
FailureSummary: A value-redacted failure summary suitable for execution inspection.
FaultAction: The action a classifier rule declares for one phase and category.
FaultClassifier: A bounded, order-independent classifier over phases and categories.
FaultDescriptor: The complete framework-owned classification input for one fault.
FaultEvidence: Framework evidence about one failed unit of work.
FaultPolicy: The validated retry, backoff, skip, and rollback policy for one step.
FaultProgress: The committed fault-tolerance totals one step attempt inherits.
FaultRule: One ordered classifier rule for an exact phase and category.
FaultRuntime: The validated fault-tolerance capability installed on a chunk step.
FaultStateEntry: One unresolved retry key retained in durable fault state.
FaultStateEnvelope: The bounded, checksummed fault state of one durable step execution.
FlowDecision: One append-only, repository-authoritative selected transition.
FlowDecisionId: Opaque durable identifier of one selected transition.
FlowDecisionRequest: A validated transition awaiting repository allocation and commit.
FlowDecisionSequence: Positive, execution-local ordering of selected transitions.
FlowEvent: A value-redacted flow observation emitted only after its named decision.
FlowGraph: An immutable declaration of the M3 flow subset.
FlowJob: An executable binding for one compiled format-2 or bounded split flow.
FlowLaunchReport: Final durable observations from one flow attempt.
FlowLauncher: Async-first launcher for durable sequential, conditional, and bounded split flows.
FlowStepState: Latest durable attempt for one logical step, used to reconstruct restart.
FlowTransition: One declared transition edge.
InMemoryExplorer: The bounded keyset read port of InMemoryJobRepository.
InMemoryFaultState: A bounded, process-local FaultStateStore.
InMemoryJobRepository: Deterministic, process-local reference implementation of JobRepository.
IncidentBufferConfigurationError: Invalid finite incident-buffer configuration.
IncidentEventBuffer: A process-local, finite incident event buffer.
InheritedStepProgress: Committed step progress one chunk-step attempt inherits.
ItemListenerContext: Read-only execution data supplied at an item, retry, or skip callback.
ItemListenerFailure: One value-redacted item, retry, or skip listener failure.
ItemListenerSet: A bounded, ordered registration of the M3 item listener families.
JobExecution: One launch or restart attempt for a JobInstance.
JobExecutionId: An opaque identifier for one job launch or restart attempt.
JobExecutionProjection: A redacted job execution projection.
JobExplorer: The portable bounded inspection service.
JobInstance: One logical occurrence of a named job and its identifying parameters.
JobInstanceId: An opaque identifier for one logical job instance.
JobInstanceKey: The canonical identity key for a logical job instance.
JobInstanceProjection: A redacted logical job instance projection.
JobLauncher: Async-first launcher for one-step tasklet jobs.
JobName: A validated logical job-definition name.
JobOperator: The portable guarded operator application service.
JobParameter: One typed job parameter and its identity role.
JobParameters: A deterministically ordered set of typed job parameters.
JoinNode: The structural join owned by one M4 split.
LaunchReport: Final persisted execution snapshots returned by JobLauncher.
LifecycleEvent: A structured lifecycle event containing only reviewed, bounded fields.
LifecycleTransition: A requested framework lifecycle transition and its deterministic timestamp.
ListenerContext: Borrowed execution data supplied to job and step listeners.
ListenerError: A value-redacted listener failure.
ListenerFailure: One value-redacted listener failure retained by a launch report.
MaxClockSkew: A bounded repository/local wall-clock skew tolerance.
MetricCardinalityGuard: Enforces the per-family label-cardinality and name-allowlist budgets.
MetricConfigurationError: Invalid metric name-labelling configuration.
MetricDimensions: A complete set of typed dimensions accepted by the metric catalog.
MetricLabel: A bounded, framework-owned metric label.
MetricObservation: A metric observation after allowlist and cardinality enforcement.
MonotonicInstant: A runtime-neutral reading of one monotonic clock.
NodeId: A stable logical identifier for one flow-graph node.
OperationId: Caller-supplied idempotency key for one mutating action.
OperatorOutcome: The result of one guarded operator call.
OperatorRecord: One append-only operator audit and idempotency record.
OperatorRecordDraft: The bounded audit row an adapter appends.
OperatorRequest: One validated mutating operator request.
OperatorRequestId: An opaque identifier for one append-only operator request record.
OwnerToken: A per-process 16-byte execution-owner token.
Page: One bounded page and its continuation token.
PageRequest: One bounded page request.
PageSize: A validated page size in 1..=500.
ParameterDescriptor: A redacted description of one job parameter.
ParameterName: A validated job-parameter name.
ParameterValue: A bounded typed job-parameter value.
PartitionAggregate: The deterministic result of aggregating one complete durable partition plan.
PartitionBudget: The finite worker and connection budget for one M4 partition manager.
PartitionCount: A finite durable partition count for one M4 partitioned step.
PartitionKey: A stable byte-compared key within one partitioned step execution.
PartitionPlanEntry: One validated entry in a partition plan before durable identity assignment.
PartitionPlanFactory: Launch-scoped deterministic constructor for one complete partition plan.
PartitionPlanRequest: Deterministic inputs supplied once when a partition plan does not yet exist.
PartitionResult: A validated terminal result published by one assigned partition worker.
PartitionTaskletFactory: Per-child constructor that creates an independently owned tasklet step.
PartitionWorkerInput: Owned, bounded input supplied to one partition worker factory.
PartitionedStepNode: A bounded local partition manager and its ordinary worker-step definition.
PatternSpecificity: The computed specificity of one exit pattern.
PostgresChunkStateError: Value-redacted failure while preparing PostgreSQL chunk state.
PostgresChunkTransactionManager: PostgreSQL same-resource chunk transaction manager.
PostgresConfig: Facade-owned PostgreSQL pool, TLS, and timeout configuration.
PostgresDurableStepState: Durable progress loaded for one PostgreSQL-backed step execution.
PostgresExplorer: The bounded keyset read port of PostgresJobRepository.
PostgresFaultState: Durable PostgreSQL retry-reservation state for one step execution.
PostgresJobRepository: Durable PostgreSQL implementation of JobRepository.
PostgresMigrator: Applies the immutable OxideBatch PostgreSQL migration set.
ProcessContext: Borrowed call state for a processor.
ProcessorError: item processor failed
PurgeBatchBound: A validated purge batch bound in 1..=1000.
PurgeCandidate: One purge candidate and the version observed while planning.
PurgeCounts: Per-table row counts of one purge plan or applied batch.
PurgePlan: One bounded, digest-guarded purge plan.
PurgePlanRequest: One bounded purge planning request.
PurgeSurvey: The bounded candidate survey one adapter produces while planning.
QueryWindow: The bounded keyset window one adapter statement must honour.
ReadContext: Borrowed call state for a reader.
ReaderError: item reader failed
ReasonCode: Bounded closed-set machine reason code.
RecoveryDecision: One append-only recovery audit record.
RecoveryDecisionId: An opaque identifier for one append-only recovery decision.
RecoveryEvidence: Canonical evidence retained by one recovery proposal.
RecoveryMarkers: Closed boolean recovery markers retained as one bounded bit set.
RecoveryProposal: A validated, evidence-bound recovery proposal.
RecoveryProposer: Produces evidence-bound proposals without mutating repository state.
RecoveryRequest: Bounded, value-redacted request for one audited recovery decision.
RecoveryResult: Result of atomically appending an audit decision and changing execution state.
RecoverySnapshot: One adapter-owned recovery snapshot gathered with repository server time.
RecoveryStepEvidence: Redacted evidence for the latest durable step execution.
RepositoryDescriptor: The versioned capability descriptor a durable adapter publishes.
RequestDigest: A framework-computed SHA-256 digest of one canonical request.
RetentionActionId: An opaque identifier for one append-only retention audit record.
RetentionHold: One active retention hold on a logical instance.
RetentionRecord: One append-only retention audit record.
RetentionRecordDraft: The bounded retention audit row an adapter appends.
RetentionReport: The result of one audited retention call.
RetentionService: The portable retention service.
RetryCounts: Durable retry attempts, kept distinct per phase.
RetryKey: An opaque framework digest identifying one retryable unit of work.
RetryLimit: The maximum number of re-invocations after the initial component call.
RetryOrdinal: The zero-based invocation ordinal for one retry key.
RetryReservation: One durable retry reservation for a single key.
RetryStateLimit: The maximum number of unresolved retry keys retained for one step.
SequentialIdGenerator: A thread-safe nonzero identifier sequence suitable for local execution.
ShutdownCoordinator: Owns the Tokio adapter task set for one application runtime.
ShutdownDeadline: The total correctness budget for intake stop through durable persistence.
ShutdownHookError: A value-redacted failure returned by an application shutdown hook.
ShutdownReport: Complete ordered shutdown report.
ShutdownSignal: An application-owned process-shutdown signal.
SkipCounts: Durable committed skip counts, kept distinct per phase.
SkipLimit: The maximum aggregate committed skips for one step in one job instance.
SplitBranch: One declared linear branch of an M4 split.
SplitBudget: The finite concurrency and connection budget for one M4 split.
SplitNode: A bounded M4 split whose branches converge at exactly one join node.
StaleThreshold: A bounded stale-execution threshold.
StartControls: Restart-relevant start controls for one logical step.
StartLimit: The maximum number of step executions one logical step may start.
StateEnvelopeDescriptor: A redacted description of one durable state envelope.
StateLimits: Resource bounds checked before application payload decoding.
StateSchemaId: A validated application-owned durable-state schema identifier.
StateSchemaUpgrade: One directed application-schema upgrade a codec declares.
StateSchemaVersion: A nonzero application schema version.
StepDefinitionUpgrade: One source-to-target durable step mapping for a compatible restart.
StepExecution: One attempt to execute a named step within a job execution.
StepExecutionId: An opaque identifier for one step attempt.
StepExecutionProjection: A redacted step execution projection.
StepName: A validated logical step-definition name.
StepNode: One executable node of a compiled plan.
StepPartition: A durable partition plan row and its latest result snapshot.
StepPartitionId: An opaque identifier for one durable step partition.
StepPartitionProjection: A redacted durable partition projection.
StopPollInterval: The maximum interval between durable operator-stop observations.
StopSource: The owner used by application code or an operator adapter to request stop.
StopToken: A cloneable cooperative stop token passed to user work.
SystemClock: An explicitly injected wall-clock implementation.
SystemMonotonicClock: An application-owned system monotonic clock.
TaskJoinDeadline: The bounded budget for joining every owned child task.
TaskletContext: Borrowed execution data supplied to an asynchronous tasklet.
TaskletError: A value-redacted typed user-component failure.
TaskletJob: A validated single-step job definition.
TaskletStep: A validated one-step tasklet definition.
TaskletStepFactory: A launch-scoped factory for one tasklet inside a bounded split branch.
TelemetryExporter: Drains one queue from an application-owned task.
TelemetryFlushDeadline: The separate, non-correctness telemetry flush budget.
TelemetryQueue: Cloneable producer for one bounded exporter queue.
TelemetryRecord: One versioned event containing only reviewed safe fields.
TerminalStatusSet: A non-empty set of terminal statuses a purge may target.
UnjoinedPhase: One phase and the number of unjoined tasks observed there.
WriteContext: Borrowed call state for a writer.
WriterError: item writer failed

Enums§

AuthorizationClass: The separately authorizable class of a service call.
BackoffKind: The deterministic backoff family selected by a definition.
BackoffOutcome: The result of one cancellable backoff wait.
BatchStatus: The framework lifecycle status of a job or step execution.
BusinessTransactionError: Stable, value-redacted enlisted-transaction failure.
BusinessValueKind: Stable discriminator for a bound business value.
ChunkAttemptOutcome: The result visible to an after-chunk listener.
ChunkCompletionOutcome: Post-commit acknowledgement from a chunk-completion component.
ChunkDeliveryMode: Declared delivery boundary included in a chunk definition fingerprint.
ChunkError: Stable chunk-size and count failure.
ChunkExecutionOutcome: Final result of deterministic chunk orchestration.
ChunkFailure: Stable phase classification for a failed chunk step.
ChunkListenerFailureKind: Whether a chunk listener returned an error or panicked.
ChunkListenerPhase: The listener callback phase.
ChunkTransactionError: Stable, payload-redacted chunk-transaction failure.
CursorError: A rejected continuation token.
CursorKey: The immutable ordering key of the last row returned by a page.
DefinitionError: Failure to construct a bounded restart definition.
DefinitionTokenKind: Definition token category used by validation diagnostics.
DomainError: A stable, value-redacted domain validation failure.
DrainResult: Result of joining the structured task tree.
DurableStateKind: The durable state category being encoded or decoded.
EnqueueResult: Result of one non-blocking enqueue attempt.
EventComponent: The framework component associated with an event.
EventSeverity: Stable severity for a lifecycle event.
EventTiming: Stable timing of an event relative to the decision it observes.
ExplorerError: A stable inspection failure independent of a database or async runtime.
ExplorerQuery: The closed set of paginated explorer queries.
ExporterConfigurationError: Invalid bounded exporter configuration.
FailureCategory: A stable framework category for a redacted failure.
FaultDecision: The authoritative policy outcome for one fault.
FaultPhase: The framework phase that produced a fault.
FaultPolicyError: A value-redacted fault-policy validation or arithmetic failure.
FaultStateError: A value-redacted fault-state reservation failure.
FaultStateFormatError: A value-redacted durable fault-state format failure.
FlowEventKind: Stable, post-commit observations for the bounded flow runtime.
FlowExecutionOutcome: Why a durable flow attempt ended.
FlowFailure: Stable, value-redacted flow failure classification.
FlowJobError: An executable component assembly that does not match its compiled plan.
FlowNode: One node of a declared flow graph.
FlowRuntimeError: A flow operation that could not produce a trustworthy final report.
FlowSelectionError: A compiled plan that cannot route one observed exit outcome.
FlowTarget: The destination one transition selects.
FlowTransitionKind: Why one transition was selected.
IdGenerationError: Failure from an injected identifier source.
IdentifierKind: The kind of opaque numeric identifier.
InFlightPolicy: The accepted shutdown behavior for an already-open chunk.
ItemListenerError: Failure to register a bounded listener family.
ItemListenerPhase: The callback boundary where an item, retry, or skip listener failed.
JobInstanceSelection: The result of selecting the canonical instance for an identifying key.
LaunchError: A launch failure that prevented a final execution report.
LifecycleError: A typed lifecycle-policy or optimistic-concurrency failure.
LifecycleEventKind: Stable M1 lifecycle event names.
ListenerFailureKind: Stable classification of a listener boundary failure.
ListenerPhase: The listener callback boundary where a failure occurred.
LocalFailurePolicy: The sibling behavior selected after one local child fails.
ManifestError: A canonical definition manifest that cannot be interpreted.
MetricFamily: A stable metric family and its complete allowed label set.
MetricUnit: Stable measurement unit of one metric family.
NameKind: The kind of validated domain name.
OperatorAction: A mutating action a deployment authorizes and the core guards.
OperatorError: A typed operator-service failure that is not a guard rejection.
OperatorOutcomeClass: The durable class of one recorded operator request.
OperatorRejection: The typed reason one guard rejected an operator action.
OwnerObservation: The durable owner-token observation relative to the inspecting process.
ParameterRole: Whether a job parameter participates in job-instance identity.
ParameterValueKind: The stable type discriminator for a ParameterValue.
PartitionAggregationError: A deterministic partition plan could not be aggregated safely.
PartitionFactoryError: Redacted rejection from an application partitioner.
PartitionValueError: Invalid public partition input.
PlanError: A flow graph that cannot be compiled into an executable plan.
PostgresConfigError: Invalid facade-owned PostgreSQL configuration.
ProcessOutcome: One item-processor call outcome.
ReadOutcome: One item-reader call outcome.
RecoveryDirective: The disposition of one recovery decision together with the evidence that disposition requires.
RecoveryDisposition: Explicit operator disposition for an orphaned or ambiguous execution.
RecoveryError: A typed recovery-proposal failure.
RecoveryField: Recovery request field category.
RecoveryRequestError: Invalid bounded recovery request.
RepositoryCapability: A separately negotiated durable repository capability.
RepositoryError: A stable repository failure independent of a database or async runtime.
RequestField: A bounded request-envelope field category.
RequestFieldError: An invalid bounded request-envelope field.
RetentionAction: One audited retention action.
RetentionError: A typed retention failure.
RetentionOutcome: The durable class of one recorded retention action.
RetryOutcome: The result visible to a retry-completion callback.
RollbackDisposition: How a failed unit of work is separated from committed work.
ShutdownError: A shutdown intake or configuration error.
ShutdownHookStatus: Status of one correctness or resource-close hook.
ShutdownRequest: Classification of one shutdown request.
ShutdownTaskPhase: The bounded phase occupied by one owned child.
StateCodecError: Stable, payload-redacted failures returned by an application codec.
StateError: Stable, value-redacted durable-state validation failure.
StepComponents: The executable kind and restart-relevant declaration of one step node.
StopTiming: Classifies when a cooperative stop was observed.
TaskletExecutionOutcome: The stable execution result captured by a launch.
TaskletFailure: Classifies a tasklet failure without exposing an error or panic payload.
TaskletOutcome: The user-controlled result of one tasklet invocation.
TelemetryEventKind: One stable event in telemetry schema version 1.
TelemetryFlushStatus: Status of the non-authoritative telemetry flush.
TelemetrySpanKind: One stable span in the telemetry schema version 1 hierarchy.
TelemetrySpanStatus: Stable adapter-neutral span outcome classes.
TerminalKind: A node that ends the job without starting further work.
TlsMode: Transport security for a PostgreSQL repository connection.
WriteOutcome: One item-writer call outcome.

Constants§

DEFAULT_DROP_REPORT_WINDOW: Default throttling window for drop notifications.
DEFAULT_EXPORT_QUEUE_RECORDS: Default bounded exporter queue length.
DEFAULT_MAX_CLOCK_SKEW: Default repository/local clock-skew bound.
DEFAULT_PAGE_SIZE: Page size used when a caller does not choose one.
DEFAULT_PURGE_AGE: Minimum age used when a caller does not choose one.
DEFAULT_RETAINED_EVENTS_PER_EXECUTION: Default retained events returned for one incident execution.
DEFAULT_RETAINED_EVENT_CAPACITY: Default total retained events across executions.
DEFAULT_SHUTDOWN_DEADLINE: The default process drain deadline.
DEFAULT_STALE_THRESHOLD: Default stale-execution threshold.
DEFAULT_TELEMETRY_FLUSH_DEADLINE: The default telemetry flush deadline.
MAX_ACTOR_REF_BYTES: Maximum accepted UTF-8 bytes of an opaque actor reference.
MAX_BRANCH_STEPS: The maximum number of linear steps in one split branch.
MAX_CLOCK_SKEW: Maximum accepted repository/local clock-skew bound.
MAX_CURSOR_BYTES: Maximum size of one opaque cursor token.
MAX_DROP_REPORT_WINDOW: Maximum throttling window for drop notifications.
MAX_EXPORT_QUEUE_RECORDS: Maximum bounded exporter queue length.
MAX_METRIC_NAME_ALLOWLIST: Maximum explicitly allowed job and step names.
MAX_NODES: The maximum number of nodes one plan may contain.
MAX_OPERATION_ID_BYTES: Maximum accepted UTF-8 bytes of a caller-supplied idempotency key.
MAX_OUTGOING_TRANSITIONS: The maximum number of transitions leaving one node.
MAX_PAGE_SIZE: Maximum rows one page may contain.
MAX_PARTITIONS: The maximum number of durable local partitions in one partitioned step.
MAX_PARTITION_CONTEXT_BYTES: Maximum serialized byte length of one durable partition context.
MAX_PARTITION_KEY_BYTES: Maximum UTF-8 byte length of one durable partition key.
MAX_PARTITION_WORKERS: The maximum number of concurrent local partition workers.
MAX_PATTERN_BYTES: The maximum length of one exit pattern in UTF-8 bytes.
MAX_PURGE_BATCH: Maximum executions one purge batch may target.
MAX_REASON_CODE_BYTES: Maximum accepted UTF-8 bytes of a closed-set reason code.
MAX_RESPONSE_BYTES: Maximum estimated encoded size of one page.
MAX_RETAINED_EVENTS_PER_EXECUTION: Maximum retained events returned for one incident execution.
MAX_SHUTDOWN_DEADLINE: The upper bound for process drain and task-join deadlines.
MAX_SPLIT_BRANCHES: The maximum number of branches in one M4 split.
MAX_STALE_THRESHOLD: Maximum accepted stale-execution threshold.
MAX_TELEMETRY_FLUSH_DEADLINE: The upper bound for telemetry flush deadlines.
MAX_TRANSITIONS: The maximum number of transitions one plan may contain.
METRIC_CARDINALITY_BUDGET: Maximum distinct label combinations retained by one metric family.
MIN_CLOCK_SKEW: Minimum accepted repository/local clock-skew bound.
MIN_DROP_REPORT_WINDOW: Minimum throttling window for drop notifications.
MIN_EXPORT_QUEUE_RECORDS: Minimum bounded exporter queue length.
MIN_PURGE_AGE: Smallest accepted minimum age of a purge candidate.
MIN_SHUTDOWN_DEADLINE: The lower bound for process drain and task-join deadlines.
MIN_STALE_THRESHOLD: Minimum accepted stale-execution threshold.
MIN_TELEMETRY_FLUSH_DEADLINE: The lower bound for telemetry flush deadlines.
MIN_UNRESOLVED_AGE: Smallest age bound accepted by the unresolved-execution query.
OTHER_LABEL_VALUE: Reserved value used for values outside an allowlist or cardinality budget.
TELEMETRY_EVENT_CATALOG: The complete telemetry schema version 1 event catalog.
TELEMETRY_SCHEMA_VERSION: The stable M4 telemetry schema version.
TELEMETRY_SPAN_CATALOG: The complete telemetry schema version 1 span catalog.
VERSION: The version of the OxideBatch facade crate.

Traits§

BackoffSleeper: An injected monotonic, cancellable delay source.
BlockingTasklet: A synchronous tasklet isolated by BlockingTaskletAdapter.
BusinessTransaction: OxideBatch-owned port for the currently enlisted business transaction.
ChunkCompletion: An asynchronous observer called only after a durable chunk commit.
ChunkListener: Observes a chunk attempt around its transaction body.
ChunkTransaction: One adapter-owned transaction for a bounded chunk attempt.
ChunkTransactionManager: Begins isolated adapter-owned chunk transactions.
Clock: Supplies instants to repository and runtime operations.
ExplorerRepository: A bounded read port one metadata adapter implements.
FaultStateStore: Durable, bounded retry-reservation state for one step execution.
FlowEventSink: A non-authoritative observer of committed flow decisions.
IdGenerator: Supplies facade-owned opaque identifiers.
ItemProcessor: A dynamically dispatchable asynchronous item transformer.
ItemReader: A stateful asynchronous item source.
ItemWriter: A dynamically dispatchable asynchronous batch writer.
JobExecutionDecider: A deterministic, side-effect-free M3 flow decider.
JobExecutionListener: A dynamically dispatched job lifecycle listener.
JobRepository: Starts isolated repository units of work.
LifecycleEventSink: Receives committed lifecycle observations.
MonotonicClock: Supplies monotonic readings for bounded recovery observations.
PostgresChunkStateProvider: Produces checkpoint and context state at a PostgreSQL chunk commit boundary.
ProcessListener: Observes processor invocations for one item.
ReadListener: Observes reader invocations for one item.
RecoveryRepository: Adapter port for one bounded, server-time recovery observation.
RepositoryUnitOfWork: Transaction-scoped metadata operations required by the executable kernel.
RetryListener: Observes the retry scope around one failed invocation.
SkipListener: Confirms one accepted skip immediately before the accepting commit.
StepExecutionListener: A dynamically dispatched step lifecycle listener.
Tasklet: A dynamically dispatched, single-invocation asynchronous step body.
TelemetryEventSink: Receives versioned observational events.
TelemetryExportSink: Adapter-owned asynchronous export boundary.
VersionedStateCodec: Serializer-neutral application codec for one durable-state schema.
WriteListener: Observes writer invocations for one output batch.

Functions§

aggregate_step_partitions: Aggregates a complete partition plan independently of input or completion order.

Type Aliases§

BoxFuture: An owned, dynamically dispatched future used by public asynchronous ports.