Struct LoadedFilter 

pub struct LoadedFilter { /* private fields */ }

A loaded filter, ready to run per request. Trusted filters reuse instances from a TrustedPool (checked out per request, ADR 000012); untrusted filters instantiate fresh each request.

A trap leaves the guest’s linear memory undefined, so the host discards that instance and a later checkout rebuilds + re-inits one (self-heal, ADR 000006), with a pool-wide cooldown bounding re-init storms (review f000003 #5). The Option is the isolation discriminator — None means untrusted (fresh instance per request).

Implementations

impl LoadedFilter

pub fn isolation(&self) -> Isolation

pub fn reads_body(&self) -> bool

Whether this filter reads the request body — i.e. it exports on-request-body (world filter-body). The fast path buffers the body ONLY for a route with at least one such filter; a route of header-only filters keeps the zero-copy streaming path (ADR 000038 / ADR 000005 mechanism 2). Detected from the component’s exports at load, so it is sound (fail-closed): a filter cannot read the body without declaring it in the contract.

pub fn on_request( &self, req: &HttpRequest, trace: &RequestTrace, ) -> Result<(RequestDecision, Vec<LogLine>), RunError>

Run the request-side hook under the request’s trace context (trace, ADR 000009). The host times the call and emits one span — parented by trace, carrying the outcome and the filter’s host-log lines as events — to its TelemetrySink. Returns the typed decision plus those log lines (the direct-access form), or a RunError the caller MUST fail-closed on (deadline / trap / instantiation — never a pass-through to upstream).

pub fn on_request_body( &self, body: &[u8], trace: &RequestTrace, ) -> Result<(RequestBodyDecision, Vec<LogLine>), RunError>

Run the request-side BODY hook (buffer-then-decide, ADR 000025). The host hands the filter the fully-buffered request body; the filter returns the (possibly transformed) body to continue, or a short-circuit response (synthesised before upstream is reached). Same fail-closed contract and span emission as on_request.

pub fn on_response( &self, req: &HttpRequest, resp: &HttpResponse, trace: &RequestTrace, ) -> Result<(ResponseDecision, Vec<LogLine>), RunError>

Run the response-side hook for one response. Same fail-closed contract as on_request. req is the as-forwarded request snapshot (ADR 000073) — the request as it left the request-side chain — passed to a 0.3 guest as on-response’s first parameter and dropped by the 0.1 / 0.2 adapters.