Struct Runtime 

pub struct Runtime { /* private fields */ }

Implementations

impl Runtime

pub async fn reexecute_live( &self, plan: &PreparedPlan, req: LiveRequest, authorizer: &dyn LiveAuthorizer, cancel: &CancelSignal, ) -> Result<LiveResult, LiveRefusal>

Re-execute a decision shape live (spec 026): a new decision, under fresh bounds, with the host authorizing every external attempt immediately before it is sent. The only entry point that accepts an authorizer; decide, capture, replay and comparison never dispatch on its behalf.

Refused before admission, with nothing presented or spent: a reused historical decision id, a snapshot whose computed identity is not the stated one, an invalid capture configuration, a plan whose proposals exceed the document bound, and every admission refusal of decide.

let cancel = rustev_core::seams::CancelSignal::new();
let _ = rt.reexecute_live(plan, live, a, &cancel).await;
let _ = rt.decide(plan, req, &cancel).await;

// `decide` takes no authorizer: only `reexecute_live` does.
rt.decide(plan, req, &rustev_core::seams::CancelSignal::new(), a).await;

// Nor does capture.
rt.decide_with_capture(plan, req, &rustev_core::seams::CancelSignal::new(), c, a).await;

pub async fn reexecute_live_with_gate( &self, plan: &PreparedPlan, req: LiveRequest, authorizer: &dyn LiveAuthorizer, cancel: &CancelSignal, spend: LiveSpend<'_>, ) -> Result<LiveResult, LiveRefusal>

Live re-execution with a durable spend gate, after budget and host authorization on every attempt. Existing ungated callers are unchanged. Plans with acquisitions are refused before admission until source authorization and spend identities are supported.

impl Runtime

pub fn builder( clock: Arc<dyn Clock>, sink: Arc<dyn EvidenceSink>, config: RuntimeConfig, ) -> RuntimeBuilder

pub fn gauges(&self) -> Gauges

pub fn backend_terms( &self, backend_id: &str, ) -> Option<(&BackendDescriptor, CostModel)>

The registered backend’s descriptor and static cost model, for a host’s checks before any dispatch (spec 043, 3.7.1).

pub fn prepare(&self, compiled: Compiled) -> Result<PreparedPlan, PrepareError>

Check a compiled plan against the registered backends (spec 003, 3.5.3 and 3.6.5).

pub fn invalidate_plan(&self, plan: &PreparedPlan) -> Option<InvalidationResult>

Invalidate every reusable result in this plan’s namespace, for any correction, revocation, erasure, artifact withdrawal or policy change the host observed. The generation advances before entries are removed, so a result captured earlier is never stored or served. A plan with a persistent tier also has its namespace marked unavailable in this process until Runtime::invalidate completes for it (spec 044, 3.10.3).

pub fn invalidate_scope( &self, plan: &PreparedPlan, principal_handle: &[u8], ) -> Option<InvalidationResult>

Invalidate reusable results for one opaque authorized scope, as for an erasure or a scope revocation, as Runtime::invalidate_plan does for a namespace.

pub async fn invalidate( &self, plan: &PreparedPlan, principal_handle: Option<&[u8]>, ) -> Option<InvalidationResult>

Invalidate the plan’s namespace, or one authorized scope of it, in every tier (spec 044, 3.10.3): the memory tier at once, then the store, whose generation advances. The selection is unavailable to the persistent tier until the store answers; a failure leaves it unavailable, and a later call reconciles it. Invalidation is not carried to other processes (3.10.4).

pub async fn decide( &self, plan: &PreparedPlan, req: DecisionRequest, cancel: &CancelSignal, ) -> Result<Decided, DecideError>

Run one decision (spec 003). cancel is the caller’s cancellation.

pub async fn decide_keyed( &self, plan: &PreparedPlan, req: DecisionRequest, dimensions: &BTreeMap<String, Handle>, cancel: &CancelSignal, ) -> Result<Decided, DecideError>

Runtime::decide with the host’s key dimensions (spec 044, 3.5 item 3): one scope handle per dimension the plan’s decision_cache declares. A decision missing a declared dimension, or naming one the plan does not declare, is neither served from nor admitted to the decision cache, and runs or is refused under the policy’s admission. A plan without the decision cache ignores them.

pub async fn decide_observed( &self, plan: &PreparedPlan, req: DecisionRequest, cancel: &CancelSignal, observer: &dyn ProgressObserver, ) -> Result<Decided, DecideError>

Run with a value-free observer. The ordinary entry point has no callbacks.

pub fn observer_panics(&self) -> u64

Contained progress callback panics across this runtime’s decisions.

pub async fn decide_with_capture( &self, plan: &PreparedPlan, req: DecisionRequest, cancel: &CancelSignal, capture: &CaptureConfig, ) -> Result<CapturedDecision, CaptureConfigError>

Runtime::decide with opt-in bounded capture of every supplied value (spec 004, 5.3). An invalid configuration is refused before admission. Dropping the future returns nothing, as for decide.

pub fn decide_streaming<'a>( &'a self, plan: &'a PreparedPlan, req: DecisionRequest, cancel: &'a CancelSignal, stream_buffer: usize, ) -> Result<(impl Future<Output = Result<Decided, DecideError>> + Send + 'a, GenerationStream), GenerationError>

Start an opt-in field stream. Poll the returned future to drive execution; the receiver may be polled independently and never backpressures it.

pub fn reconcile(&self, attempt_id: &str, observed_units: u64) -> bool

A later observed charge for an attempt whose cost was unknown, applied to the shared ledger (spec 003, 3.5.5). Delivered records are never rewritten.