Module ledger 

Task 25 — typed tool-call ledger (spec §8.3).

Each tool call advances through a MONOTONIC lifecycle:

planned -> authorized -> started -> committed -> result_recorded

Transitions are single-step-forward only; any skip or backward move is rejected and never applied (the ledger state is therefore monotonic — invalid transitions cannot be represented in a committed ledger). When a turn is interrupted (cancellation or transport failure) with a call that has STARTED but not yet recorded a result — i.e. a side effect is possible but its commit status is unknown — a NonIdempotent call must surface TurnOutcome::InterruptedAfterSideEffect and must NEVER be automatically rerun. Read-only and idempotent calls stay retryable.

Structs

CallLedger

Per-call ledger. Cloneable/inspectable, but the phase can only ever be advanced one monotonic step at a time through CallLedger::advance_to (or its named helpers).

InterruptDisposition

Disposition of a call when its turn is interrupted.

NonMonotonic

A rejected non-monotonic transition. The ledger is left UNCHANGED when this is returned, so no invalid state is ever observable.

Enums

CallPhase

One monotonic phase of a tool call’s lifecycle (spec §8.3). The derived ordering matches the pipeline order, so </> express “earlier/later phase” directly.