Enum RunError 

pub enum RunError {
    Deadline,
    Trap(Error),
    Instantiate(Error),
    Unavailable,
    InvalidOutput,
}

Why a per-request filter call did not produce a decision. Kept deliberately distinct from RequestDecision/ResponseDecision — those are the filter’s intentional typed output; a RunError is the filter failing. The fast path MUST fail-closed on it: synthesise an error response and never forward to upstream (CLAUDE.md — no fail-open). Keeping the two apart also makes “deadline” vs “trap” an observable health signal.

Variants

Deadline

The filter ran past its epoch deadline (ADR 000006 metering) and was interrupted. Fail-closed mapping: 504.

Trap(Error)

The filter trapped (unreachable, a guest panic, or an allocation past the Store memory limit that aborted the guest). Fail-closed mapping: 502.

Instantiate(Error)

A fresh instance could not be created — untrusted per-request instantiation, or the rebuild of a trusted instance after a prior trap. Fail-closed mapping: 502.

Unavailable

A trusted filter trapped on several consecutive requests, so the host is in a short trap-cooldown: it returns this cheap fail-closed response instead of re-instantiating + re-init’ing every request (circuit-breaker, review f000003 #5). Fail-closed mapping: 503.

InvalidOutput

The guest returned cleanly but its output violates contract rules (CRLF / CTL / non-tchar header, oversize header, or oversize synthesised body — ADR 000071 / 000073). Distinct from Trap so operators can tell a misbehaving-but-alive filter from a crashing one; fail-closed mapping is 502.

Implementations

impl RunError

pub fn fail_closed_response(&self) -> HttpResponse

A synthetic, fail-closed response for this fault (host helper; the fast path may send it directly). Deadline → 504, every other fault → 502. Never a pass-through.

Trait Implementations

impl Debug for RunError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for RunError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for RunError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<&RunError> for SpanOutcome

fn from(e: &RunError) -> Self

Converts to this type from the input type.