Crate pushkin_core 

Pushkin core: manifest, validation pipeline, result/event envelope, and the append-only SQLite event log.

Crate contract: everything here is deterministic (charter N6) — no network, no embeddings, no LLM calls. Every fallible path returns Result with a thiserror enum (errors are API).

Modules

board

Peer board (spec §9): persisted, restart-surviving coordination in SQLite. Every operation is scoped by a run ID so concurrent runs never intersect. Verbs: register / status / peers / broadcast / send / read (auto-cursor per recipient), plus claim / release on paths — the pre-write gate consults claims to deny cross-agent edits. Embedded SQLite only (spec §10); schema is a versioned, append-friendly step.

delivery

Compaction-aware delivered-slice index (spec §7.3): file-backed state keyed on (session id + cwd) recording contract slices already delivered IN FULL, so repeats collapse to a pointer line. Unlike the event log this table is deliberately mutable working state — spec §7.3 requires clearing it on compaction, and horizon expiry models content scrolling out of the agent’s context window. Invariants: a truncated first emission is never recorded (the agent never saw it); clearing one scope leaves every other scope intact.

edits

F48 Phase B — applying an editor’s edit operations to file content.

envelope

The uniform result JSON of spec §8.3 — the wire contract every adapter translates from (charter N7). camelCase on the wire, deny_unknown_fields on ingest (charter N2).

events

Append-only SQLite event log (charter N4, N7). Every gate decision is an event from Phase 1 onward; append-only is enforced in the schema itself via triggers, not by convention. Timestamps: UTC ISO-8601 (one convention, this table, documented here).

floor_report

The ignored-test accounting for pushkin floor (spec §8.2 stage 5) — pure functions over captured command output, so pushkin-core stays free of I/O and the arithmetic is testable without running cargo inside cargo.

legacy

Legacy (pre-rename) Sentinel naming — the ONE place old names live (remediation pass 3, PART B2). The 2026-08-14 naming directive retired the sentinel names; every remaining old-name string in the codebase is a constant here, kept solely to RECOGNIZE or REMOVE artifacts a sentinel-era binary left behind. The naming sweep’s exclusion list is auditable against this module: any sentinel outside it (and the append-only history) is a straggler.

manifest

pushkin.toml parsing (spec §11). Strict by construction: serde with deny_unknown_fields everywhere, unknown-key errors enriched with nearest-candidate suggestions, mapping→contract references resolved once at the boundary (spec §7.1) so shorthand never silently changes meaning.

mapper

Deterministic symbol-level mapper (spec §7.1): manifest glob → contract, refined to the exported contract symbols a written file actually references. Resolution happens once at the boundary into canonical contract names; ambiguity and misses are structured errors with candidates. Deterministic by crate contract — tree-sitter parsing only, no retrieval, never load-bearing for gates: a file that cannot be parsed degrades to an empty symbol list, which means “deliver the full contract”, never a lost gate decision.

pipeline

The deterministic per-write validation pipeline (spec §8.2, Phase 1 subset: contract conformance heuristic, suppression detection, protected paths), driven by the manifest instead of Phase 0’s hardcoded settings. Rule IDs and decisions are conformance-locked to the Phase 0 Bun spike.

waivers

Waivers + the decision log (spec §15 Phase 5; integration doc §7). pushkin/waivers.toml is an append-only human-plane record: signed, scoped, expiring. The gate consults it to suppress matching denials; doctor lints it for stale entries (expired, superseded) and surfaces contradiction links. Agents cannot write it — pushkin/ is built-in gate surface (pipeline).