Module wire 

Wire frames for the daemon UDS (PLAN-phase2 §2.9, S289 D-2 amended).

Framing is synaps rpc’s: one JSON object per \n, at most DAEMON_MAX_FRAME_BYTES (64 MiB — distinct from rpc’s 1 MiB because Attached carries the whole api_messages). Enforced symmetrically: encode_line refuses to build an oversize frame, decode_line and both readers refuse to accept one. WireSessionEvent is a serde mirror of SessionEventWire — StreamEvent/TurnError/ExtensionLoaderEvent are not Serialize, so they are mirrored variant-for-variant here and converted only at the socket boundary. In-process transports never touch this module.

The one lossy mirror is Conversation: on the wire it is a ConversationDigest (len + hash + tokens/cost), never the messages. Full history travels only in Attached and QueryResult{Messages}; SocketTransport rebuilds the snapshot from its local mirror (Attached + Stream(MessageHistory)) and re-queries on a hash miss.

Security: nothing in here carries a credential. Welcome/Attached are summaries; ClientFrame’s Debug redacts Answer.value and Submit.text so a frame can be traced by type without leaking bodies.

Structs

AttachedWire

AttachSnapshot with a serialisable replay.

ClientReconnect

Who this connection used to be, so the daemon can restore ownership by reconnect order + was_owner.

ConversationDigest

ConversationSnapshot minus api_messages: what Conversation carries on the wire. messages_hash is FNV-1a over each message’s JSON so a client can tell whether its local mirror is current.

Hello

Welcome

Auth-status summary only — never key material.

WireEnvelope

WireLoadFailure

Enums

Attach

ByeReason

ClientFrame

Client → daemon. First frame on a connection MUST be Hello.

DaemonFrame

RefuseReason

WireAgentEvent

WireLlmEvent

WireLoaderEvent

WireSessionEvent

WireSessionStreamEvent

WireStreamEvent

Constants

CHECKPOINT_QUERY_ID

Checkpoint replies QueryResult{id: CHECKPOINT_QUERY_ID, {ok:true}} so reload.rs can await it per session.

DAEMON_MAX_FRAME_BYTES

Hard cap on one daemon frame, both directions (Attached ships the whole conversation; 64 MiB is well past any context window’s JSON).

DIGEST_RESYNC_QUERY_ID

SocketTransport re-fetches api_messages under this id on a digest miss.

IDLE_PROBE_QUERY_ID

The daemon’s idle monitor probes Status under this id.

MAX_FRAME_BYTES

Alias used by the readers/writers of this protocol.

PROTOCOL_MAX

PROTOCOL_MIN

Exact-match policy today (min == max == PROTOCOL_VERSION).

PROTOCOL_VERSION

Separate from RPC_PROTOCOL_VERSION; bump on any non-additive change. v2 (phase 3): Set became a struct variant, Bye gained a reason. v3 (E-P0): driver events (DriverArmed, DriverRevoked, DriverTurnOutcome); old clients skip unknown via #[serde(other)]. Protocol stays exact-match; only binary versions compare directionally (reload, §2.8).

RESERVED_QUERY_ID_BASE

Query ids at or above this are reserved for the transport/daemon and never surfaced to a client as QueryResult.

RPC_MAX_FRAME_BYTES

rpc’s cap, kept for reference; daemon frames use DAEMON_MAX_FRAME_BYTES.

Functions

binary_version

The binary version the daemon/client report in the handshake.

decode_line

Decode one line, enforcing DAEMON_MAX_FRAME_BYTES.

encode_line

Encode one frame as a single line (no embedded newline: serde_json escapes them). Refuses to produce a line over DAEMON_MAX_FRAME_BYTES.

frame_limit_msg

Human-readable form of the cap for error frames.

messages_hash

FNV-1a 64 over the canonical JSON of every message (stable across binaries, unlike DefaultHasher).