Struct BindIdentity 

#[non_exhaustive]
pub struct BindIdentity {
    pub project_root: PathBuf,
    pub harness: String,
    pub session: String,
    pub project_id: Option<String>,
}

Per-route bind identity shared by client-facing and module-facing control.

EVERY FIELD HERE IS CLIENT-SUPPLIED AND UNATTESTED. The daemon canonicalizes project_root as a path but does not verify that the caller has any relation to it, and harness, session, and project_id are strings the caller chose. A client holding the connection key can present any values it likes.

This sits directly above Principal, which is the opposite: stamped BY the daemon from a launch nonce it minted. The two travel together on every route.bind, so a module reading them side by side is reading one fact it can trust and four it cannot. THE DISTINCTION IS INVISIBLE FROM THE TYPES, which is why it is written here.

So these fields are for SCOPING AND ATTRIBUTION – which project’s state to open, which session to thread, what to log – and never for authorization. A module that grants capability on harness or trusts project_root to bound what a caller may reach has built an authorization check on a value the caller controls. Gate on Principal instead, and where a module needs a caller fact subc does not stamp, it must establish that fact itself rather than believe this struct.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

project_root: PathBuf

harness: String

session: String

project_id: Option<String>

The entorhinal-registered project id (pj-…) for project_root, when the root is a registered project. Aliases count as registered projects; implicit roots do not. Absent means “no stable id, key on the triple”, not “unknown”.

A producer sends the id on every bind of a session or on none. A producer that alternates between Some(id) and None across binds silently forks the consumer’s lineage into separate stores, with no error at either end. Therefore, a producer that cannot answer consistently must answer None consistently.

Resolve this at most once per session, before its first bind, and persist the outcome with the session. ALF’s resolver has real Resolved, Unavailable, and Disabled outcomes: if unavailable at cold start is re-resolved on a later bind, the session can alternate from None to Some(id). Send only registered or alias resolutions, never implicit, unavailable, or disabled fallback ids.

Implementations

impl BindIdentity

pub fn new( project_root: impl Into<PathBuf>, harness: impl Into<String>, session: impl Into<String>, ) -> Self

Constructs an identity with no registered project id.

Use this instead of a struct literal so future additive identity fields do not force construction-site migrations across the fleet.

Trait Implementations

impl Clone for BindIdentity

fn clone(&self) -> BindIdentity

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for BindIdentity

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for BindIdentity

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for BindIdentity

impl PartialEq for BindIdentity

fn eq(&self, other: &BindIdentity) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for BindIdentity

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for BindIdentity