Crate wire

Expand description

Process boundary: Command/Query/Event wire, WebSocket server, auth, read-only multi-city aggregation.

The kernel types that appear on this crate’s own signatures are re-exported below. The client reads the wire and nothing else (ARCHITECTURE section 8), so a client that cannot name EventRecord cannot read the frames it is sent; a boundary crate that hands out frames owes the vocabulary to read them.

Structs§

AccountStatus: Whether one account’s key is there, by the account’s id. Says nothing of the key’s value.
AcpProgress: What an accepted request gets back: the run it became, and nothing else. Progress is what an editor may see; the city’s history is not published through this door.
Address: Canonical relative path; invariants enforced at the sole constructor.
AgentAdding: What AddAgent carries: the consent to one agent entry the city offered, named by the digest of its launch spec. The city recomputes the digest of the spec it would offer now and refuses on a mismatch, so what is written is what the person saw (crates/wire/spec/Answer/Agents.lean §8-90).
AgentCatalogAnswer: Everything the ACP page draws from one question.
AgentLine: One agent this city added.
AgentLoginStart: What AgentLogin carries: which agent, and which of the auth methods it declared in initialize.
AgentOffer: One agent the person may consent to, as the consent card shows it.
Aggregate: The read-only multi-city view.
Answered: The reply to one Ask.
Appearance: How the pages look.
ApprovalId: Non-empty item identity, derived from the run that raises the item and that run’s own position counter — never from a clock. Four lanes drive at once by default, so two runs reach their first question in one millisecond routinely; a clock-shaped identity makes those two items one key, the inbox keeps the later one, and the earlier one disappears from an append-only history that cannot afterwards tell a lost item from an item that was never raised.
ApprovalItem
ApprovalsAnswer: What is waiting for a person, as the Ledger recorded it.
ArchiveAnswer: Archive hits across every building, read from the shelves at the moment of asking. The files are the authority; an index kept beside them would be a second copy of what the disk says.
ArchiveHit
ArchiveLine: One line of a building’s archive index.
Ask: One question, carrying the number its answer will come back under.
AskId: The asking side’s own number for one question, minted monotonically per connection and echoed on the answer.
AuthMethod: One auth method an agent declared.
AutomationAnswer: Both automation files, each in the order it was written, and the file that did not read with its reason. A file that is not there states no rows, which is a city that automates nothing.
AxError: The unified error shape: seven wire fields and two that are left out when absent, serialized in declaration order (determinism rule 6). The model is the recovery subject: nearby and recovery must hold directly executable information, not apologies.
B3Hash: BLAKE3 digest, 32 bytes; displayed as 64 lowercase hex digits.
BeatMs: How often the monitor reads this process’s private bytes, and a tenth of how often it sends a reading (§8-47i). Only a beat inside BEAT_MIN_MS..=BEAT_MAX_MS can be made, on the wire as off it.
BlockedLine: One cause, and how much is waiting behind it.
BodyOverride: One field written into every request body this endpoint receives.
BodyPx: A body size of at least BODY_PX_MIN pixels.
Bound: A listener already bound, the address it holds, and the face its judgement gave it.
BudgetUse
BuildingAnswer: What one building is: its plan, its own documents, its rooms and what it has filed. The answer a person reads when they ask “what happened in there”.
BuildingDoc: One document of a building, as it stands on disk.
BuildingProgress: A building’s plan, as its own Roadmap.md states it.
BytesAnswer: One window of a stored object’s bytes.
Call: One tool call inside a turn.
CatalogSnapshot: When the shipped catalog was read from the registry.
ChallengeAnswer: What POST /session/challenge answers: the nonce the device signs.
ChangesAnswer: What moved between two checkpoints, one row per file, path order.
Chord: One chord the person rebound: the action, and the chord as the keymap spells it.
ChosenSummary
CityAnswer
CityClosing: What CloseCity carries: how the runs under way end (crates/wire/spec/Command/Kind.lean §19-2).
CityLabel: Names one upstream city as the interface labels it. Local to this viewer: the upstream does not know or care what we call it.
CitySettings: The city’s own layer from the settings page: None leaves a key as it is (crates/wire/spec/Command/Step.lean §8-61).
Closing: How a session ended, in the word the run froze with: done, limit or cancelled.
ClusterKey: The clustering key: class + free detail. One answer covers the cluster a person was shown, and it expires with the process.
CommitAnswer: Which run wrote one commit, in the words the commit’s own git trailers use.
CommitAt: A commit, and where in the one history the line announcing it sits.
CommitsAnswer: One page of the commits a city made, newest first.
Committed: What the Ledger’s writer broadcasts: a record, and the ServerFrame::Event text that carries it. Cloning copies no bytes.
ConfigAnswer: What one address is governed by, value by value, with the file each value came from.
ContentAnswer: One object of the content store, cut to what travels.
CorePreferences: The person’s [core] section, read at serving startup.
CostAnswer: The five cuts of one authoritative total. Four cuts sum to total; by_run names the active runs and the few billed most, so it may sum to less. Shares render against total, so a remainder stays visible.
CostOfAnswer: What one plan node cost, and which runs spent it.
DayCount: How many uses one UTC calendar day holds.
Decision: One approval, as it was answered.
Delta: One piece of what a model is producing, on its way to a page.
DeviceForgetting: What ForgetDevice carries: the paired browser whose key the city deletes (crates/wire/spec/Answer/Devices.lean §8-91).
DeviceId: A paired browser, by the id the city gave it when it paired.
DeviceKey: The public half of a browser’s Ed25519 device key.
DeviceLine: One paired browser, as a person recognises and revokes it. Its public key and its sessions stay in the city.
DevicesAnswer: Every paired browser.
DiscardAnswer: The Recycle Bin: what was discarded and how each row gets back.
DiscardLine
DoctorAnswer: This machine, item by item, with a verdict for each tier.
DoctorCustody: Where this machine’s credentials rest, and how long they stay.
DoctorGuarantee: One axis of confinement, and whether this machine’s arm holds it.
DoctorItem: One item, and this machine’s answer about it.
DoctorSandbox: Which backend a host command runs under on this machine, and what that arm promises.
DoctorUpstream: The newest release of one item upstream, as its publisher states it.
DoctorVerdict: Whether one tier is reachable on this machine.
DocumentAnswer: One file, and what state it is in.
DocumentVersion: One version, and where the city learnt of it.
DoorAnswer: What ConfirmRemoteDoor carries: the code the city’s console printed, read however it was retyped. Every answer, right or wrong, ends the request it answers.
DoorOpening: What OpenRemoteDoor asks for: the remote door open for lasting_ms, one minute to seven days. The request does nothing by itself; the city prints a code at its own console and refuses the frame with E_APPROVAL_PENDING (crates/wire/spec/Command/Kind.lean, remote_access D4).
DoorSenses: The clock and the random source the door is handed; it samples neither itself.
DoorStep: A door verb with nothing to say but its key: ReplaceCityKey, guarded the way opening is, and CloseRemoteDoor, unguarded because closing only takes access away (remote_access D5).
Drift: How far a branch has drifted from the upstream it tracks.
EffortWord: The upstream’s own word for one level.
EmbeddedFile: One file of the embedded client: the path a browser requests and the gzip bytes the build wrote into the binary.
EndpointSummary: One attached endpoint, as a reader may see it. No credential appears here in any form; has_credential answers the only question a page needs, which is whether one was enrolled at all.
EndpointTuning: Everything a person settles about one endpoint beyond its address.
EndpointsAnswer: What the settings page reads back: what is attached, and what each tag currently points at.
Entry: One name inside a directory.
EventDraft: What a recording party supplies; the Ledger implementation owns the rest (seq, prev, v).
EventRecord: One serialized history line. Fields private: the only paths to a record are EventRecord::from_draft (append side) and EventRecord::parse_line (read side).
EvidenceAnswer: Everything one run left as evidence, oldest first.
EvidenceItem: One thing a run wrote down that can be looked at again.
ExportAnswer: A Markdown version written as one HTML file that stands alone.
FiguresAsked: One row of the table, as the page asks about it.
FiguresLine: What one row would be registered with.
FileChange: One file, as the difference between two trees describes it.
FindAnswer: The files found, shallow first and in name order within one level, each relative to under. under and text echo the question, which the wire carries no id for.
Forwarded: What ask produced: an address and a read. It carries no Command field, so nothing downstream can promote it into one.
FrozenNames: The names a session froze, as a page draws them.
GitOid: Git object id, 40 lowercase hex digits (SHA-1 repositories; other lengths are rejected; SHA-256 repositories are not accepted).
GitStatusAnswer: The working tree of one building, read at the moment of asking.
GithubLoginAnswer: What one import asked and what came back. Nothing was saved: the login is a candidate the identity card writes only when the person saves it, through PutIdentity.
GovernanceAnswer: Who answers for this city, and what was answered on the person’s behalf.
GuideProgress: The guide’s progress in one city: where it reopens, whether the person has left it, and each optional step seen or put off.
HeaderPair: One header every request to this endpoint carries.
HeldDocument: A file with bytes: which version, how long, and what of it a reader is given now.
HeldSkill: One shelf’s copy of a skill as it is now.
Hello: The client’s opening frame.
HistoryAnswer: A slice of the one history, oldest first - the order the ledger wrote them and the order a fold expects. A reader that wants the newest first reverses a list it already has, and a server that reversed it would make the fold the caller’s problem.
HistoryRangeAnswer: One slice of a named range of ledger records, and where the slice continues.
HunksAnswer: One file’s patch text between two checkpoints, and what could not be shown.
IdemKey: Idempotency key: 16 digest bytes plus the derivation version. Private fields; IdemKey::derive is the only mint.
InboxAnswer: What waits in one room, without taking it.
Keys: Every credential this city accepts at this moment: the face’s key, and the browsers’ session tokens that admit at now. One value, because the two are one question (crates/wire/spec/Reception/Admission.lean §8-40).
KnownFace: One face and the base URL it is called at: the URL attaching this face would store, so a form that fills it in changes nothing when the city normalises it.
KnownHost: One vendor’s host, and the faces it documents, main face first.
KnownHostsAnswer: Every host the city knows, in the table’s own order.
Lagged: Ledger records that never reached a peer, named by both ends.
LedgerHead: The seq of the last record the city has broadcast, readable without a lock.
ListenerOrigins: The names and origins one listener answers to, computed once from the address it holds.
ListingAnswer: One directory, one level deep: directories first, then files, each group in name order, so a tree drawn from it reads the same way on every machine.
LiveOutput: One piece of a running command’s output, on its way to a page.
LocalDoor: This machine’s door for a browser. Cloning shares the one door.
LogLine: One diagnostic line on its way to a page.
McpHealthAnswer: One line per server the address’s configuration names, in the order the configuration names them.
McpServer: One external tool server this run may reach, as its configuration states it: a label, a program on this machine, and that program’s arguments.
McpServerHealth: One server, as the handshake found it.
McpServerUsage: One tool server and the tools of it that were used.
McpToolLine: One tool a server offers, under the name the model sees it by.
McpToolUsage: One tool of a server.
McpUsageAnswer: Every tool server a building is configured with, and every one the ledger saw used.
McpUse: One call of a server’s tool.
MetricsAnswer: The city’s vital signs: the counts a page would otherwise assemble by asking four questions and adding up the answers.
ModelFactsSummary: One model an endpoint serves, with what the endpoint said about it.
ModelFiguresAnswer: Every row asked about, in the order asked.
MonitorFeed: The performance monitor as a session sees it (crates/wire/spec/Frames/Monitor.lean §8-47g).
NodeId: A node’s place in the plan, as the first column spells it: 2, 2.3, 2.3.1. The parent is the prefix, so the tree needs no second field to say where a node hangs.
OfferedCard: One open card, by the document it is on and the moment it was offered.
OpenCode: An open code on its way to a browser, and the signal that it arrived.
OpenProposalsAnswer: Every card still open in the city, newest offer first: the list a person deciding reads before they open any one document.
Opening: How a session began: what the person asked for, in their words.
Output: What a tool said, bounded so a wave of output cannot become the page.
PageHeaders: The response headers a listener answers with, as names and values; the shell turns them into HTTP headers once per listener.
PairAnswer: What a pairing answers: the id the city gave the browser.
PairBody: POST /pair: one of the two codes, the browser’s public device key, and the name the page gives itself.
PairedBrowser: One paired browser, as the city keeps it: public key only.
PairingToken: A pairing token, held as the digest of the code and nothing else.
PatchLine: One line of patch text, numbered from the top of the patch so a withheld line and the lines around it read as one list.
Payload: Ledger payload: a JSON object with every float refused, at construction and again on read (determinism rule 6). Keys serialize sorted (serde_json’s default BTreeMap), which is part of the canonical bytes.
Picture: The two sides and the media type of a picture, as the record wrote them. Absent on a row whose record named a locator and no size, which is a row worth showing and not a size worth inventing.
PlanRow: One node of a building’s plan, flattened for a renderer.
PlannedProgress: Progress with a denominator: the leaves of the plan tree.
PolicyChange: A room’s new run policy, which the run under way takes at its next safe point (crates/wire/spec/Answer/Sessions.lean D27).
PreferencesAnswer: Everything one person settled about their own copy of the city.
PrefixAnswer: What one run was told before it said anything.
PrefixSegment: One frozen segment, as a reader needs it.
PrefixSource: One document a segment was assembled from, as the assembler saw it.
PreviewAnswer
PrivacyAnswer: Everything the privacy page shows, read in one pass on the host that runs the city.
PrivacyControlEntry: One control as the host’s table defines it and as the host reads now.
PrivacyEditions: Where Microsoft’s documentation says a control is honoured and where it is ignored; an edition in neither list is not stated.
PrivacyIntent: One recorded operation: the value it found and the value it wrote.
PrivacyNotWrittenEntry: An original item no control writes.
PrivacyOriginalLine: One line of the request list, as the person wrote it.
PrivacyOutcome: The result kept for one operation a page sent.
PrivacyRequest: Change one host privacy control, or check the operation that has no conclusion: the payload of Command::PrivacyOperation. The city’s listener carries it out on the host, and its result is read back from crate::PrivacyAnswer::outcomes under idem.
PrivacyWindows: What HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion records.
ProposalCard: One open card: who offered it, on which stretch of which version, and its sentences.
ProposalDecision: One card and the verdicts on its changed sentences; a sentence left unnamed is rejected.
ProposalDecisions: A person’s decision on proposal cards of one document, landed as one save (crates/wire/spec/Answer/Proposals.lean §8-73).
ProposalsAnswer
ProviderName: A provider name in transit. Authority for the provider set is gateway.
PursuitLine: A city’s standing goal, if it has one.
RangeAnswer
RangeWrite: A page’s save of one document: edits made on the version baseline, refused once that version has moved (crates/wire/spec/Command/Step.lean §8-72).
RegistryAnswer: What this city has decided is worth keeping.
RegistryLine
RegistryNewest: What one registry said about the newest release (crates/wire/spec/Answer/Release.lean D24).
ReleaseLine: One release, in the two spellings a person reads.
Renewals: The keep-warm renewals the city sent, as storage::Renewals counts them (storage D35, D36). billed is already inside total and the cuts, under the room and the keep_warm bucket, so a page draws it as a line inside the total and never adds it again. The four counts sum to the renewals sent; late ones arrived after the cache had gone and paid the write price for the prefix.
Reply: Where a refusal goes back to.
ReplyEnded: The end of a reply wait, and when the Ledger recorded it (D37).
RoundsAnswer: One session’s rounds, oldest first.
RulesWrite: A building’s whole RULES.toml from a page, and the text the page read: the city evaluates body before it lands, and only over base (crates/wire/spec/Command/Step.lean §8-60).
RunCostsAnswer: What each run a Query::RunCosts named was billed.
RunId: Run identity; uuid v7 for humans, nil for the city itself. No generation here — the assembly layer (or a seeded simulator) mints.
RunPolicy: The four values one run works under, chosen when it is dispatched and written into its run_started line.
RunSummary: One run, as a reader needs it. The client folds the live stream for itself; this shape is what a query answers about runs it never saw, which is why it carries the position rather than the whole history.
Sample: One reading of every counter the monitor shows, in integers because it travels on the wire (crates/sprawling/Spec.lean §8-94, §8-129-6).
SandboxLimits: What a run’s execution boundary allows. Resolved as one value rather than field by field: a layer that speaks about the sandbox speaks about all of it, so an under-specified layer can only ever reduce what a run may do, never silently grant something the layer above it never mentioned.
ScheduledJob: One row of SCHEDULE.toml.
Sealed: A value that cannot reach any sink: no Debug, no Display, no serde, no Clone; drop zeroizes (secrecy::SecretBox). Expose call sites are whitelisted by xtask secret (EXPOSE_WHITELIST).
SecondDomain: The whole percents a file may state for the second rung, both ends included: the two figures kernel::config::SecondThreshold’s one construction point reads, answered so a page that states the span does not spell it a second time.
SecretForgetting: What ForgetSecret carries: the vault reference whose key is deleted, spelled secret:realm/name. Refused while an attached endpoint or a configuration still names the reference, and for a key the environment supplies (gateway D33); writes nothing to the ledger (crates/accounting/spec/Worker.lean §8-37).
Seq: Event sequence number; contiguous from Seq::FIRST, checked arithmetic.
ServeConfig: Everything the shell needs that it must not decide for itself.
ServerLabel: How one external server is named inside this city.
SessionAnswer: What a session answers: the token the page keeps in memory and shows on every later request.
SessionBody: POST /session: the device, the nonce it was given, and its signature over that nonce.
SessionLine: One stretch of a room, each field read off a line the Ledger files under the room’s address.
SessionName: What a person calls one session: one address segment, and therefore one directory under a building.
SessionNaming: A display name for the session of room that began at began; an empty name takes it back (crates/wire/spec/Answer/Sessions.lean D27).
SessionTags: One session’s tags: the session named by the city, the room and the line its stretch began at, and the tags the person gave it, in lexical order without repeats.
Sessions: The live session tokens, by digest, each belonging to one device.
SessionsAnswer: One room’s stretches, newest first, and how many older ones the answer leaves out. room echoes the question, which the wire carries no id for.
SettledEffort: [model] effort, and the file that settled it.
SettledSearch: [search] at one address, beside the city’s own statement of it.
SettledSecond: [context] second_threshold, and the file that settled it.
ShellCalls: One interpreter’s shell lines that ended with a code.
ShellsAnswer: Every shell interpreter the ledger saw, with how its shell lines ended (crates/wire/spec/Reading.lean D48). The fold is runtime::ShellTally’s; this is its reading on the wire.
Sighting: One event as the merged view carries it: which city it came from, and the event itself. The pair is what makes a merged stream readable - an event with no city is a fact with no address.
SignalLine
SkillLine: One shelved skill.
SkillUsageAnswer: Every skill on a shelf, and every skill the ledger saw used, one line each.
SkillUsageLine: One skill, by name: where it sits now, the contents runs have read, and every time one of them read it.
SkillUse: One read of a skill by a run that pinned it.
SkillVersion: One content of a skill, from the first line that named it.
SkillsAnswer: The shelves one building reads from.
StatedIdentity: The names a new session would freeze, and the two texts a save names as its base.
SupplierAccounts: The key of each account of one listed search supplier.
Tag: One word a person files sessions under: one to TAG_MAX letters of any script, digits, - or _, and no whitespace, so /tag <name> reads exactly one word.
TemplateName: A Building template name in transit. Authority is city.
ThemeOverride: Colours laid over the theme the page ships with. The empty value is the built-in theme.
ThinkingOffer: The thinking levels one (Endpoint, model) offers, as the gateway’s thinking ladder resolved them.
TimeMs: UTC milliseconds as an integer (determinism rule 6). Always a parameter, never sampled inside kernel or memory.
Tokens: Whole tokens.
ToolkitLine: One application on the shelf.
ToolkitSlug: An outside application’s id at the broker that connects it. Authority for which ids exist is the broker’s directory, and percent-encoding it into a request path belongs to whoever builds that path.
TuningDefaults: What an endpoint that settled nothing is called with.
Turn: One turn: the model was asked, and this is what came of it.
UnplannedProgress: Progress without a denominator: steps walked and budget burned. No ratio method exists — the interface cannot paint what it cannot know (A17’s type half).
UnpricedCalls: The model calls that came back with no authoritative amount, and the tokens they used. A city whose provider never prices a call has a zero total after any number of runs; this is what tells that city apart from one where nothing ran.
UpdateHint: The command a person runs to update, printed and never run: the channel that installed the binary owns updating it.
Upstream: One upstream connection’s settings. No plaintext token: same discipline as ServeConfig, for the same reason.
UsageExportAnswer: One export: every use as one row, in the format asked for.
UsdMicros: One micro-USD. Decimal price lists convert at the single accounting entry point (gateway::cost); decisions never touch floats.
Used: What one turn cost in tokens.
VersionsAnswer: One document’s versions, newest first.
Waiting: What a run waits for: the room it spoke to, and the instant on the city’s clock at which the wait ends without a reply. An instant rather than the time left, because an answer is cached and carried, and a count of milliseconds left is wrong once it leaves the city.
WatchedSource: One row of WATCH.toml.
Welcome: The server’s answer to a Hello it accepted.
WelcomeFacts: What a welcome tells a peer about the city it reached: which city it is, the seq of the last record the city has broadcast, and which ledger it is. One value because the two travel together into every welcome.
Window: The most tokens one model reads in a single call, prompt and reply together.
WindowLine: A window and the rung that stated it.
Withheld: One line that was not echoed, and what matched it.

Enums§

Admission: What a door does with one request, before any of its bytes are read.
AdmissionRequirement: The evidence a run’s work must carry before a merge lets it into the building.
AgentSource: Where an agent entry came from.
Answer: What a query returns. Unavailable is a real answer: a view this build does not evaluate yet says so by name, rather than returning an empty result a reader would mistake for an empty city.
ApprovalClass: What kind of decision this is. Wire data — the cluster keys serialize — and one arm, because a run asks a person exactly one kind of thing: a question about the design it cannot settle by reading the rules.
Arrival: Which route a request arrived at, as the route table names it.
AskOutcome: Whether the question was answered or refused. A refusal of a question travels here rather than as a bare Refusal frame, so the page knows which question fell through.
AssetReply: What one asset request gets back.
Autonomy: Who answers the Approval Inbox (9.2). Two states, because a question either waits for the person or goes straight to the resident they appointed; there is no third state in which nobody answers, since “nobody answered yet” is what an unanswered item already says.
AxCode: Closed set of error codes. Extension is additive only; the wire spelling lives in AxCode::as_str.
BindFace: Which face the listener presents, and the key it demands.
BindVerdict: The whole of the binding policy.
Cadence: How often a scheduled job runs, in UTC minutes.
Carry: What a new session at an address keeps from the previous one.
CeilingLine: The ceiling a call would be made with.
Chroma: Whether colour carries meaning on these pages, or only contrast does.
ClientAssets: The client the browser downloads, from whichever source this process was given. Two sources, one contract: the release binary carries the bundle inside itself; a development loop points at the directory the wasm build writes, read per request so an edit shows on refresh.
ClientFrame: Everything a client may send.
CloseMode: How a closing city treats the runs it still has.
Command: Commands change state, require authorization, and are idempotent. Deliberately not #[non_exhaustive], for the reason the module documentation of command::wire gives.
ConfigLayer: Which file settled one value.
ControlVerdict: What the control surface makes of one Command.
CorePlacement: The placement arm; platform policy belongs to serving::placement.
CorePriority: Whether the core’s hot threads stand above normal.
Coverage: How much of the version the first window holds.
Delivered: Where a refusal ended up.
Density: How much air the spacing steps carry. Two named postures rather than a coefficient, because the coefficient is the stylesheet’s to choose.
DialectKind: Which wire the far side speaks. Closed: a fourth dialect is a compile error at every entrance of gateway::dialect, which is how it is kept from being approximated with the nearest of the three already written.
DoctorAbsence: Which kind of not being here.
DoctorCore: The level this machine gives the core’s threads under the person’s setting (crates/sprawling/Spec.lean §8-93). The dispatched commands are not here: they always start one level below, and lowering is never refused.
DoctorCoverage: Whether the arm holds the axis. Two words rather than a boolean, because a page has to word both and a wire that carried true would make every reader choose its own word for false.
DoctorCustodyLifetime: How long a value the store keeps stays reachable.
DoctorCustodyStore: Which store a city writes secrets to.
DoctorDrive: Whether the city’s volume is a Dev Drive.
DoctorExclusion: Whether one of Defender’s exclusions holds the city.
DoctorFault: Why a thing that is here cannot be used.
DoctorGuaranteeAxis: What a confinement can promise.
DoctorInstall: What getting the item would cost on this machine.
DoctorNeed: Whether a tier can be reached without the item.
DoctorNewest: What asking the item’s publisher came to.
DoctorPack: A set of items a page draws as one row: each member is still its own item here, because each is detected, judged and installed on its own.
DoctorSandboxArm: The backend itself. Closed, so a page has a word for every arm and a new arm is a compile error at every reader.
DoctorSandboxMissing: What a machine lacks when it can give no confinement at all.
DoctorScanning: What this machine says about scanning in front of the city’s directory.
DoctorState: Whether the item is here, and in what condition.
DoctorTier: Who needs an item, and therefore which verdict it counts towards.
DoctorUnread: Why an item has no upstream version to compare with.
DoctorUntold: Why a question about scanning has no answer here. command is the tool as a person reads its name, such as fsutil devdrv query.
DoctorVersion: What a present program said when asked its version. Only the first arm carries text; the other three are facts about how it did not answer, and none of them makes the program absent.
DocumentBody: What the bytes of one version are to a reader.
DocumentState: What stands at an address in the tree.
Door: Which HTTP door a request arrived at.
Effort: How hard the provider should think, least to most, in the upstreams’ words. Which levels one (Endpoint, model) offers is the upstream’s statement, answered by the gateway’s thinking ladder and never by a table here (crates/kernel/spec/Model.lean D56); a level outside the offer is refused, never moved to a neighbour. Check the vendors before changing the ladder: https://platform.claude.com/docs/en/build-with-claude/effort, https://developers.openai.com/api/docs/guides/reasoning.
EntryKind: What one entry is. A directory has no size worth stating: the size of a directory is a question about everything under it, and this answer deliberately does not walk that far.
EventKind: The closed event vocabulary.
EvidenceKind: Which kind of evidence one row is.
ExportFormat: How an export is written.
Face: Where one of the two typefaces comes from.
FigureFrom: Who stated a figure, spelled as model_selected records it (window_from, ceiling_from).
GithubReading: What the GitHub CLI said about one host, or the named reason it said nothing. Every reading but Found leaves the card as the person left it, and each names the way on that the page offers.
Glass: Whether the edge layer’s small surfaces are drawn as glass. On still yields to a machine that asks for less transparency, which only some engines report: that gap is why the switch exists.
GovernedDocument: Which of the three documents that govern a city a PutDocument frame carries.
GuideMark: What the person did with one optional step. A step with no mark has not been looked at.
GuideState: Whether opening the city still offers the guide.
GuideStep: The five steps, in the order the guide gives them.
HaltScope: What a Halt, Release or Autonomy change applies to. Unlike modes and providers, this set is the protocol’s own and has no upstream owner.
HandbackNote: How a child session’s handed-back work ended, read through collab::Handback::from_signal; which session it was is Note::Arrived’s session (D38, D43).
HandshakeVerdict: The verdict on one peer’s opening frame.
How: What happened to the file.
IdentityAnswer: The two identity areas as they stand, or where one stopped reading.
IdentityCard: One identity card’s values (crates/wire/spec/Answer/Identity.lean §8-59).
InstallChannel: How this binary was installed, which decides the command that updates it.
Intervention: The verbs the control surface shows. Three interventions plus Release, the return path that Halt needs in order not to be a trap.
KeepWarm: Whether this city renews a warm prompt cache before it expires.
KeyState: Where one account’s key stands, decided by the city so a page draws a word rather than reading two flags.
LandingPolicy: Whether a run’s work takes the ordinary road or stays in an experiment that never lands.
Lang: Which language a person reads the interface in.
Lighting: Which palette the pages are drawn in. System is the absence of an opinion, resolved where the page is drawn rather than in the stylesheet: the light palette is declared once, and a second declaration of it inside a prefers-color-scheme block would be a second authority for the same rungs.
Lines: How much of a file moved.
Locator: The two-scheme reference grammar.
LogLevel: Who reads a log line, and when.
LoginKind: The two auth method types of ACP’s stable schema.
LoginState: Where an added agent stands on signing in.
McpState: The three answers a handshake can come back with.
McpTransport: How this city reaches one server. Exhaustive rather than a URL that might also be a command: the three are different machines to start talking to, they fail differently, and a configuration that leaves it to be guessed is one that guesses wrong on the day it matters.
Mode: Whether a run is talking with the person or carrying out work.
ModelTag: What a chosen model is for. Exhaustive rather than a free label: a tag exists because some code asks for a model by it, so a tag with no asker is a setting the person can fill in and never see used. It grows when a caller appears, not when a name is imagined.
Monitoring: Whether this session counts as somebody watching the monitor.
Motion: Whether the pages animate. System is the absence of an opinion, which is what the stylesheet’s prefers-reduced-motion block reads.
NoSecret: Uninhabited on purpose. A value of this type cannot be produced, so Command<NoSecret> has no reachable PutSecret variant. This is the compile-time half of “a remote connection cannot spell that frame”; Deserialize supplies the runtime half for bytes that try anyway.
Note: What a turn came to besides the calls it made.
OfferSource: The rung of the ladder an offer came from.
Offered: Where a verb is offered.
Outcome: What a tool call has come to so far.
OutputStream: Which of a command’s two outputs a piece came from.
PairProof: Which code a pairing presents: exactly one of the two.
Pairing: Whether the caller held this city’s pairing token.
PinState: How exactly the launch spec names the agent’s version.
PreferencePatch: One named change to PreferencesAnswer.
PrefixSlot: The four slots of a frozen prefix, in the order they are sent.
PrivacyAction: One change the person confirmed on the page. expected is the value the page showed when the person confirmed; the host writes nothing when its fresh read differs (crates/sprawling/spec/Privacy/Confirmation.lean D58).
PrivacyBuildEffect: What the sources say about whether writing a control changes anything on current Windows builds.
PrivacyCategory: The sections of the privacy page, in page order.
PrivacyControl: One host setting this binary may change for the person on request (a privacy control). Declared in page order: by PrivacyCategory, and within a category in the order of the controls table.
PrivacyCurrent: What a read of a control’s target gave.
PrivacyEdition: The Windows editions Microsoft’s documentation names when it says where a policy is honoured or ignored.
PrivacyEditionFit: How a control’s edition lists read for the edition of this host.
PrivacyFaultCode: Why a privacy operation ended without the change asked for, or with a result nobody could confirm: the closed set of stable codes (crates/sprawling/spec/Privacy.lean §12).
PrivacyHistory: What this app’s history tells the page, which depends on who asks.
PrivacyHost: The machine the controls belong to: the one running this city.
PrivacyNotWritten: Why an original item is not written. The research decided each one; nothing here is a judgement the host makes at run time.
PrivacyOriginal: One line of the privacy request list as the person wrote it (an original item), numbered as the list numbers it.
PrivacyResult: Where one operation stands.
PrivacyScope: Whose settings a control changes. A machine-scope write goes through administrator approval.
PrivacySettlement: The person’s check of an operation that has no conclusion. It writes nothing; it records what the target held.
PrivacyTarget: The place on the host a control writes, named by its operation kind.
PrivacyValue: One value of a target, exactly as the host holds it.
Progress: Deliberately exhaustive: both faces must be handled by every renderer.
PursuitState: Whether a pursuit is taking work right now.
PursuitStep: What a Pursue command does to a pursuit.
Query: A read of the city; the module documentation says what all of them share.
ReadingFace: Which face reading text is drawn in: the messages of a conversation, documents and reports. Controls, labels, figures and code keep the interface’s faces whichever this says (crates/wire/spec/Preference.lean D52).
Registry: A registry this project publishes to.
RegistryReading: What one registry answered.
ReleaseAnswer: Where this city stands against the release channel.
ReplyEnd: What ended a reply wait, one arm per arm of kernel’s WaitEnd; the reply itself is an Arrived note of its own.
Restoration: Tracked rides git (file:), Interred rides CAS (cas:), Rebuildable names its reason. No fourth storage authority exists.
RoadmapStatus: The five states, closed. The spellings below are the canonical table strings, and there is exactly one set of them: a second set would be a second authority over what a resident is allowed to write.
Ruling: How a person answers one item.
SandboxArm: One sandbox mechanism family, shared by configuration and doctor reports.
ServerFrame: Everything a server may send. Events are the push half; a Refusal carries the three-part refusal the interface renders verbatim.
SessionStart: How a stretch began.
SessionState: How far a socket session has got. Two states, because there are two: a peer that has not identified itself, and one that has.
SessionStep: What the shell does with one client frame. Exhaustive: a new frame kind has to be answered here rather than falling through to silence.
Shelf: Where a Command::PutShelved writes.
SkillAudit: What the audits on the ledger say about the content a shelf holds now (city::library::audit_state).
SkillShelf: Which shelf a holding sits on, and where its document is.
Slash: One verb a person can type after a /.
Speaker: Who spoke a word that arrived: the person who owns the city, through a steer; the city itself, through a steer; or a resident, through a steer or a signal (D36, D41).
SpineDocument: Which of a building’s own spine documents a write carries.
Standing: Where one application stands for this city.
Switch: Whether one setting is accepted.
Tier: How much of the world layer the page draws: none of it, whole panels beside the conversation, or all of it as the workspace with the conversation as a band along its foot. Three layouts rather than three points on one slider, so three names.
Timing: Whether the span between two times on a row is a measurement.
ToolkitsAnswer: The shelf, or the reason there is no shelf to show.
UsageKind: Which table an export writes.
UseOutcome: How the call that used it ended.
VersionAuthor: Who put one content of a skill on its shelf, read off the ledger in ledger order (crates/wire/spec/Reading.lean D33).
VersionSource: Where a version came from, as far as the city can say.
Walked: Whether the walk looked at everything under the address.
Watched: What one watcher looks at, which decides how much the city reads for it. It does not travel: it is what MonitorFeed::watch is told.
WriteDomain: The set of prefixes one actor may write under, and what it may write inside them.
WriteLimit: What a run may do to a file that already exists inside its write domain (crates/kernel/spec/WriteDomain.lean §8-78).

Constants§

BEAT_MAX_MS: The longest beat a page may set, in milliseconds.
BEAT_MIN_MS: The shortest beat a page may set, in milliseconds.
BODY_PX_MIN: The smallest body size a person may ask for, in pixels.
BYTES_WINDOW_MAX: The most bytes one Bytes answer carries.
COMMAND_NAMES: The Command surface, in declaration order — the order the handshake hash mixes these names in.
DROP_BYTES_MAX: The largest file /drop takes. axum’s own default of 2 MiB refuses an ordinary screenshot or PDF; the limit sits on that one route, because the others carry a line of text or a recording.
FIND_MAX: How many files one answer lists: a bound on the answer’s size on the wire, and as many as a list a person picks one file from needs.
FIND_WALK_MAX: How many entries one walk looks at before it stops: the cost of one question, paid on every key the person types.
HISTORY_MAX: The most records one History answer may carry. A page asking for more gets this many; the whole ledger is not a thing to put on a socket, and a limit the caller cannot exceed is one fewer way for a client to make the server do unbounded work.
OPEN_CODE_LIFETIME_MS: How long an open code stays redeemable.
OUTPUT_LINES: The most lines of one tool’s output a row carries.
QUERY_NAMES: The Query surface, in declaration order — the order the handshake hash mixes these names in.
RUN_COSTS_MAX: How many runs one Query::RunCosts may name: a bound on the size of one answer on the wire, not a machine reading.
SESSIONS_MAX: How many stretches one answer lists. A bound on the size of an answer on the wire, not a machine reading: the page that reads it shows a room’s recent stretches, and earlier says how many more there are.
SESSION_PREVIEW_MAX: How many characters of a stretch’s last reply SessionLine::preview carries. A bound on the answer, not on what a page shows: the page cuts again to the width it has (crates/wire/spec/Answer/Sessions.lean D27).
TAG_MAX: The longest tag, in characters. A tag is drawn as one chip that does not wrap in the narrow sessions pane; past this it is a sentence, not a class.
VERSIONS_MAX: The most versions one answer lists.
WHOLE_PPB: The whole plan, in billionths. Public because a reader comparing a share against the total needs the same constant the split used.
WIRE_V: Wire format version. Rises by one between two pushes, in the first commit that changes a frame’s shape while every frame and kind name stays (wire D1); a changed name moves schema_hash on its own.

Functions§

arguments_in: What a call was asked for, laid out over lines and cut at the same limit as what it answered.
bind: Judges the bind face, then binds the listener.
bundle_routes: The two routes that answer the client bundle: / and every path below it that no other route of the same table claims.
classify: Classifies one Command.
decide_admission: Decides whether one HTTP request may reach the work behind a door, once Keys::pairing has judged what it offered.
decide_bind: Decides whether the listener may bind addr, and which face it then presents.
decide_frame: The whole session policy, as a pure function: which frames are legal when, and what a mismatch does. Tested without a socket, for the same reason decide_bind is.
decide_handshake: Decides whether to accept a peer.
entered: routes behind the entry decision of the listener origins names: every route of the table arrives as arrival, and an OPTIONS request at any of them is judged as a preflight. The remote listener puts its sockets and its page behind this (wire D56); the city’s own table layers each route itself, because its routes arrive as different kinds.
note_of: Whether this kind changed what the turn did or what it waits on, and what to say about it if so.
offered_pairing: The one spelling of how an HTTP caller offers the pairing token.
output_in: What a tool said, cut to OUTPUT_LINES with the remainder counted.
router: Builds the route table. Split from serve so a test can exercise the routes over an in-process transport without owning a port.
said_in: What the model said, out of the message runtime::turn recorded.
schema_hash: A digest of the protocol surface, exchanged at connect time.
serve: Serves on a bound listener until the future is dropped.
text: A payload field as a string, when it is one.
thought_in: What the model thought, out of the same message.
used_in: The counters ModelUsage carries, read through its own deserialisation so a row written under an older meaning of input_tokens is converted by the one reader that knows the versions. Absent when the row carries no usage it can read, which is a different fact from having spent nothing. The two durations are not usage: model_returned keeps them beside it, and the fold that holds the whole line fills them in.
verify: Compares a presented token against a stored digest in constant time.

Type Aliases§

AcpSink: Where an outside request goes once the token has been judged.
Answering: Answers a query from the city’s derived views, with the ledger position the answer was read at. Synchronous: a query reads a projection, and a projection that needed to block would be a query pretending to be a command.
DropSink: Where a file dropped onto the composer goes: its name and its bytes in, the absolute path the city kept it at out (crates/wire/spec/Server.lean §8-49).
KeepBrowsers: Where the door keeps its table: the whole table, after every change.
TranscribeSink: Where a recording goes: the bytes, the media type the browser recorded into, and the line of text that comes back.
WireCommand: The Command set a socket can carry. PutSecret is unreachable because NoSecret has no values.

Crate wire

Crate wire Copy item path

Structs§

Enums§

Constants§

Functions§

Type Aliases§

Crate wire