Struct InvestigationContext 

pub struct InvestigationContext {
    pub entity_id: String,
    pub block_id: Option<Uuid>,
    pub partition: String,
    pub signals: Vec<Signal>,
    pub evidence: Vec<Evidence>,
    pub confidence: f32,
    pub pending_actions: Vec<NextAction>,
}

Runtime state for one investigation. Cheap to construct; passed by &mut reference through the skill chain.

Fields

entity_id: String

Stable identifier for the entity under investigation. May be a block id stringified, an actor id from the grammar layer (Phase 2), or any caller-defined key.

block_id: Option<Uuid>

Optional originating block — present when the investigation was triggered by an upstream pipeline. Stored as an opaque UUID so the kernel does not depend on any specific block-id newtype.

partition: String

Free-form partition tag (caller-defined).

signals: Vec<Signal>

Signals that triggered this investigation and any signals lifted by earlier skills. Skills add to this set as evidence accumulates.

evidence: Vec<Evidence>

Accumulated evidence in chronological order.

confidence: f32

Running confidence in [0, 1] that the entity exhibits malicious behaviour. Skills emit deltas; the agent clamps after each step.

pending_actions: Vec<NextAction>

Hints from the most recently executed skill.

Implementations

impl InvestigationContext

pub fn new(entity_id: impl Into<String>, partition: impl Into<String>) -> Self

pub fn with_block<I: Into<Uuid>>(self, id: I) -> Self

pub fn with_signal(self, s: impl Into<String>) -> Self

pub fn has_signal(&self, name: &str) -> bool

Trait Implementations

impl Clone for InvestigationContext

fn clone(&self) -> InvestigationContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for InvestigationContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for InvestigationContext

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for InvestigationContext

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.