Module tools 

The L0 three. Index only: no logic lives here.

Structs

Assurances

What one arm promises, axis by axis.

BoundReader

What one run may read by a name its model wrote: the city it reads in, the read bound, and the store blocks are kept in. Cloned to every tool that reads bytes, so all of them ask one bound.

CallTool

The tool itself.

ChildStatus

One piece of work this run handed down.

Confined

The arm in use, the copy kept for the next command, and the copies commands still hold.

DescribeTool

The tool itself; it holds the catalog rather than a copy, as read does, so what it answers is what the run was admitted.

EditTool

ExecSetup

What one run’s execution boundary is made of.

ExecTool

Offerings

What a machine has, read once and handed to Confinement::choose so that a test states a machine instead of borrowing one.

Opened

The bytes one name led to, and where they came from.

Placed

Where one command was put, so that whoever ends the wait can hand the copy back.

ReadTool

What a read answers with, and what it refuses.

SearchTool

What a search answers with, and what it refuses.

StatusSnapshot

The frozen fields. backlog is read live from the table, and the context used and the time from the run’s readings, rather than frozen here, for the reason children is a closure: they change while the run goes on.

StatusTool

SucceedTool

The tool itself.

Succession

What a run said when it asked to be replaced.

SuccessionDesk

Holds at most one ask. A second ask replaces the first, reason included: the run is replaced once whatever it says, and the last reason it gave is the one worth keeping.

Enums

Confinement

The backends, by platform, each carrying what it promises.

Guarantee

One axis a confinement arm can promise, or refuse to promise.

Kept

Whether one arm keeps one axis.

Missing

What a machine lacks when none of its arms can take a command at all.

Named

What a model named: a file of this city, by its address, whether it was read from the tree or from a commit, or a content block, by its hash.

Placement

Where a host command runs. The safe arm is what a call gets when it says nothing, because an agent that already knew a command was dangerous would not need to be told to sandbox it.

ProviderMode

How the gateway is currently able to serve. Degraded and LocalOnly are situations the model should plan around, so they are reported rather than hidden behind a retry.

Functions

parse_arm

Reads the arm out of the call. An unrecognised shape is refused rather than defaulted to shell — guessing which arm was meant is how a program run becomes a shell injection.

parse_placement

Reads the placement out of the call. Absent is Placement::Sandbox.

version_of

The version stamp a caller must present: the first 16 hex of the content hash. Short enough to read aloud, long enough that a collision is not the failure mode anyone will meet.

Type Aliases

ReadBound

What one run may read: the read bound closed over the reader’s building and the city’s rules. The assembly builds it once per run and hands a clone to read and to search, so both ask the same question of the same rules.