Enum ClientControlRequest 

pub enum ClientControlRequest {
    ServerDescribe {},
    CatalogList {
        module_id: Option<String>,
    },
    RouteOpen {
        target: RouteTarget,
        identity: BindIdentity,
        consumer_identity: Option<ConsumerIdentity>,
        consumer_capabilities: Option<Vec<String>>,
        admission_facts: Option<Value>,
    },
    RoutePoll {
        route_channel: u16,
        route_epoch: u32,
        kind: PollKind,
    },
    SupervisorList {},
    SupervisorRestart {
        module_id: String,
        drain_timeout_ms: Option<u64>,
    },
    SupervisorReload {
        module_id: String,
    },
    SupervisorRescan {
        preview: bool,
    },
    SupervisorReleaseReserved {
        module_id: String,
    },
    SupervisorSetEnabled {
        module_id: String,
        enabled: bool,
    },
    SupervisorHealthProbe {
        module_id: String,
    },
    SupervisorHealth {},
    SupervisorRoutes {
        module_id: Option<String>,
    },
    SupervisorProvenance {
        module_id: Option<String>,
    },
    SupervisorStderrTail {
        module_id: String,
        max_lines: Option<u32>,
        max_bytes: Option<u32>,
    },
    SupervisorTerminals {
        module_id: String,
    },
}

Client-originated channel-0 control RPC body.

Variants

ServerDescribe

CatalogList

Fields

module_id: Option<String>

Absent lists every registered module; present narrows to one. A narrowed list for an unregistered id is an empty list rather than an error, so absent and unregistered are distinguishable only by which question you asked.

RouteOpen

Fields

target: RouteTarget

identity: BindIdentity

consumer_identity: Option<ConsumerIdentity>

The consumer’s claim to a supervised launch, which the daemon verifies against its live spawn nonces before stamping a principal.

Absent is a legitimate shape, not an omission: a direct key-holder has no launch nonce to present, and the daemon stamps Direct. So absence means NO CLAIM WAS MADE, never that a claim was refused — a refused claim is an error frame and the route never opens. A provider deciding what to trust reads the stamped principal on the bind, not this.

consumer_capabilities: Option<Vec<String>>

Consumer-declared reverse-request capabilities for the route. This is an unverified declaration, not a privilege grant; if a consumer over-declares, providers may still send reverse requests that later time out or deny. Providers must treat an absent field as no reverse-request capability. The vocabulary is open strings; known MCP method-family values today are “elicitation”, “sampling”, and “roots”.

admission_facts: Option<Value>

Opaque admission facts supplied by the configured carrier module.

RoutePoll

Fields

route_channel: u16

route_epoch: u32

kind: PollKind

SupervisorList

SupervisorRestart

Fields

module_id: String

drain_timeout_ms: Option<u64>

Optional per-restart override of the module’s drain budget, in ms. Absent: the module’s configured drain_timeout_ms (or the daemon default) applies. 0 tears down without waiting — the wedge-bounce escape, where a stuck in-flight request would never settle anyway. Additive; older daemons that predate this field reject unknown fields on channel-0 requests, so senders must omit it unless asked for (the CLI only sends it when a flag is passed).

SupervisorReload

Fields

module_id: String

SupervisorRescan

Fields

preview: bool

Compute the reconciliation and return it WITHOUT applying it.

Rescan retires any supervised module absent from the config, which stops live processes. Both halves of that decision are inspectable in advance – the config is a file, the running set is supervisor.list – but nothing reconstructs the diff for the operator, so it is read from the result table AFTER the retires have happened.

A preview must be computed daemon-side rather than by a client, because a client would have to locate the daemon’s config itself: two rules selecting one subject, agreeing until someone runs a daemon with a non-default config. A preview that can describe a different file than the operation reads is worse than none, because it is believed.

Defaults to false so an existing client sending {} still executes, and is OMITTED when false so the bytes an existing client sends are unchanged. Serialising preview:false would have altered the request’s wire form for every caller that never asked for a preview – caught by the golden fixture, which is the whole reason that pin exists.

SupervisorReleaseReserved

Retire the retained exact-id reservation after its configuration entry has been removed. This is intentionally separate from rescan so deleting configuration never silently opens a protected module id to registration.

Fields

module_id: String

SupervisorSetEnabled

Fields

module_id: String

enabled: bool

SupervisorHealthProbe

Fields

module_id: String

SupervisorHealth

SupervisorRoutes

Enumerate the routes currently served by one supervised module, or every module when omitted.

This privileged census is control-plane-only. It is deliberately not an MCP facade or agent-tool operation: callers holding the daemon control connection may inspect live route ownership, while agent-facing modules must not be able to address that surface at all.

The daemon answers from its forwarding table under a read lock and never consults a module. That makes the read safe during a drain, when a module cannot be queried without recreating the hang/restart hazard that route status reads avoid.

Fields

module_id: Option<String>

SupervisorProvenance

Report source-tagged provenance for supervised modules, optionally narrowed to one module.

Fields

module_id: Option<String>

SupervisorStderrTail

Retained stderr for one module.

A separate op rather than a field on supervisor.list: the tail is kilobytes per module and list renders every module, so carrying it in the snapshot would charge every status read for a payload almost no caller wants. Caps ride on the REQUEST so a caller wanting twenty lines and one wanting the whole ring need no separate fields anywhere.

Fields

module_id: String

max_lines: Option<u32>

max_bytes: Option<u32>

SupervisorTerminals

Retained terminal exits for one module.

This stays separate from supervisor.list: a history grows with every incident, while the list is a current-state read most callers issue often.

The read MUST stay off the supervisor command channel — it reads the module’s shared ring directly. This is a requirement, not an optimisation: when the supervision task itself dies, every command-channel op returns CommandClosed, and that is precisely the moment an operator needs the exit history most. A history reachable only through the machinery whose death you are diagnosing is unreachable when it matters. Proven failure mode, not a hypothetical.

Fields

module_id: String

Trait Implementations

impl Clone for ClientControlRequest

fn clone(&self) -> ClientControlRequest

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ClientControlRequest

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ClientControlRequest

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for ClientControlRequest

fn eq(&self, other: &ClientControlRequest) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for ClientControlRequest

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ClientControlRequest