sessioncontext

package
v0.57.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 16, 2026 License: MIT Imports: 19 Imported by: 0

Documentation

Overview

Package sessioncontext owns private, durable session context and immutable input pins. Source execution and Detective evaluation remain in their existing domains.

Index

Constants

View Source 
const (
	Sessions      = "sessionContextSessions"
	Bags          = "sessionContextBags"
	Entries       = "sessionContextEntries"
	Revisions     = "sessionContextEntryRevisions"
	ContextSets   = "sessionContextSets"
	Operations    = "sessionContextOperations"
	Audit         = "sessionContextAudit"
	Inputs        = "sessionContextInputs"
	Runs          = "sessionContextRuns"
	Messages      = "sessionContextMessages"
	Outbox        = "sessionContextOutbox"
	LegacyImports = "sessionContextLegacyImports"
	// MaxSnapshotBytes caps the sum of serialized session, bag, context-set, current
	// entry and current/applied revision records returned by GetSnapshot.
	MaxSnapshotBytes = 4 * 1024 * 1024
	// MaxSnapshotEntries bounds current entries and applied references in one snapshot.
	MaxSnapshotEntries = 400
	// MaxSnapshotRevisions bounds the union of current and applied revisions.
	MaxSnapshotRevisions = 2 * MaxSnapshotEntries
)
View Source 
const DetectiveOwners = "sessionContextDetectiveOwners"
View Source 
const DetectiveWork = "sessionContextDetectiveWork"
View Source 
const MaxDetectiveDefinitionBytes = 512 << 10
View Source 
const MaxDetectiveQueryBytes = 64 << 10
View Source 
const Redactions = "sessionContextRedactions"

Variables

View Source 
var (
	ErrNotFound    = errors.New("session context: not found")
	ErrConflict    = errors.New("session context: version conflict")
	ErrInvalid     = errors.New("session context: invalid command")
	ErrForbidden   = errors.New("session context: access denied")
	ErrReadOnly    = errors.New("session context: session is read-only")
	ErrUnavailable = errors.New("session context: storage unavailable")
)
View Source 
var ErrEmptyCheckSet = fmt.Errorf("%w: unsupported empty Check set", ErrInvalid)

Functions

func Collections 

func Collections() []string

func ManifestCollectionsYAML 

func ManifestCollectionsYAML() string

ManifestCollectionsYAML is the collections block beneath schemas in an OVDB manifest.

func SQLiteSchemaStatements 

func SQLiteSchemaStatements() []string

SQLiteSchemaStatements provision the private local OVDB mount before opening it. These identifiers are compile-time constants; no user SQL is interpolated.

Types

type AcceptedDetectiveOperation added in v0.57.0 

type AcceptedDetectiveOperation struct {
	Identity            DetectiveIdentity `json:"identity"`
	ClientRequestDigest string            `json:"clientRequestDigest"`
}

AcceptedDetectiveOperation is metadata-only transport recovery. Its request digest is the host's canonical client body, not the native operation payload. Adapters compare it before reading mutable Check/Case definitions on retry.

type AcceptedDetectiveStatus added in v0.56.0 

type AcceptedDetectiveStatus struct {
	RunID         string `json:"runId"`
	State         string `json:"state"`
	FenceReason   string `json:"fenceReason,omitempty"`
	Produced      bool   `json:"produced"`
	Done          bool   `json:"done"`
	EvidenceState string `json:"evidenceState,omitempty"`
}

AcceptedDetectiveStatus contains no content, Case identity, labels, or input refs.

type AcceptedDetectiveWork added in v0.55.0 

type AcceptedDetectiveWork struct {
	ID              string                            `json:"id"`
	Owner           string                            `json:"owner"`
	Namespace       NativeNamespace                   `json:"namespace"`
	SessionID       string                            `json:"sessionId"`
	RunID           string                            `json:"runId"`
	InputSnapshotID string                            `json:"inputSnapshotId"`
	Reference       apicontract.SessionInputReference `json:"reference"`
	Dispatch        DetectiveDispatchBinding          `json:"dispatch"`
	State           string                            `json:"state"`
	Version         int64                             `json:"version"`
	AcceptedAt      time.Time                         `json:"acceptedAt"`

	// SessionGeneration is captured atomically with acceptance, before any dispatch claim.
	SessionGeneration int64 `json:"sessionGeneration"`
	// OwnerProtocolVersion binds lifecycle generation; legacy unbound acceptances cannot dispatch.
	OwnerProtocolVersion int64 `json:"ownerProtocolVersion"`
	// ClientOperationID and AcceptanceDigest bind the durable metadata lookup.
	ClientOperationID   string `json:"clientOperationId,omitempty"`
	AcceptanceDigest    string `json:"acceptanceDigest,omitempty"`
	ClientRequestDigest string `json:"clientRequestDigest,omitempty"`
}

AcceptedDetectiveWork records private acceptance, never native execution or native acceptance. Its metadata is reserved for later authenticated recovery.

type Access 

type Access struct {
	Principal Principal
	Action    string
	SessionID string
	Scope     *Scope
}

type AppliedContextSet 

type AppliedContextSet struct {
	ID        string        `json:"id"`
	SessionID string        `json:"sessionId"`
	Enabled   bool          `json:"enabled"`
	Slots     []AppliedSlot `json:"slots"`
	CreatedAt time.Time     `json:"createdAt"`
}

type AppliedSlot 

type AppliedSlot struct {
	Scope      Scope      `json:"scope"`
	BagID      string     `json:"bagId"`
	BagVersion int64      `json:"bagVersion"`
	Version    int64      `json:"version"`
	Entries    []EntryRef `json:"entries"`
}

A slot with an empty bagId is a cleared tombstone. Its version prevents ABA reuse.

type AuditEvent 

type AuditEvent struct {
	OpID       string    `json:"opId"`
	Actor      string    `json:"actor"`
	Action     string    `json:"action"`
	SessionID  string    `json:"sessionId"`
	ResourceID string    `json:"resourceId,omitempty"`
	Count      int       `json:"count"`
	At         time.Time `json:"at"`
}

type Authorizer 

type Authorizer func(context.Context, Access) error

type Bag 

type Bag struct {
	ID           string   `json:"id"`
	SessionID    string   `json:"sessionId"`
	Title        string   `json:"title"`
	Scope        Scope    `json:"scope"`
	Version      int64    `json:"version"`
	ClearVersion int64    `json:"clearVersion,omitempty"`
	EntryIDs     []string `json:"entryIds"`
}

type Command 

type Command struct {
	OpID                 string         `json:"opId"`
	Action               string         `json:"action"`
	SessionID            string         `json:"sessionId"`
	ExpectedVersion      int64          `json:"expectedVersion,omitempty"`
	DatabaseID           string         `json:"databaseId,omitempty"`
	ProjectID            string         `json:"projectId,omitempty"`
	BagID                string         `json:"bagId,omitempty"`
	ExpectedBagVersion   int64          `json:"expectedBagVersion,omitempty"`
	ExpectedSlotVersion  int64          `json:"expectedSlotVersion,omitempty"`
	ExpectedContextSetID string         `json:"expectedContextSetId,omitempty"`
	EntryID              string         `json:"entryId,omitempty"`
	ExpectedEntryVersion int64          `json:"expectedEntryVersion,omitempty"`
	RevisionID           string         `json:"revisionId,omitempty"`
	Title                string         `json:"title,omitempty"`
	Alias                string         `json:"alias,omitempty"`
	Scope                *Scope         `json:"scope,omitempty"`
	Subject              *Subject       `json:"subject,omitempty"`
	Value                *ValueEnvelope `json:"value,omitempty"`
	Selection            []EntryRef     `json:"selection,omitempty"`
	Enabled              *bool          `json:"enabled,omitempty"`
	Transition           string         `json:"transition,omitempty"`
	// M3 input pins and durable run routing. Result rows remain in the existing result store.
	InputSnapshotID    string          `json:"inputSnapshotId,omitempty"`
	RunID              string          `json:"runId,omitempty"`
	Kind               string          `json:"kind,omitempty"`
	DefinitionID       string          `json:"definitionId,omitempty"`
	DefinitionRevision string          `json:"definitionRevision,omitempty"`
	DefinitionDocument json.RawMessage `json:"definitionDocument,omitempty"`
	ExecutionDocument  json.RawMessage `json:"executionDocument,omitempty"`
	Attachments        []EntryRef      `json:"attachments,omitempty"`
	Text               string          `json:"text,omitempty"`
	ExpectedRunVersion int64           `json:"expectedRunVersion,omitempty"`
	// reportClientRun accepts outcome-unknown only with the fixed
	// CLIENT_OUTCOME_UNKNOWN code and no result payload. It records uncertainty
	// after client interruption; it does not assert source failure or cancellation.
	RunState           string                            `json:"runState,omitempty"`
	Widgets            []WidgetOutcome                   `json:"widgets,omitempty"`
	ResultRefs         []string                          `json:"resultRefs,omitempty"`
	ErrorCode          string                            `json:"errorCode,omitempty"`
	CaseID             string                            `json:"caseId,omitempty"`
	DetectiveRunID     string                            `json:"detectiveRunId,omitempty"`
	ResolvedParameters map[string]apicontract.TypedValue `json:"resolvedParameters,omitempty"`
	LegacyImport       *LegacyImport                     `json:"legacyImport,omitempty"`
}

Command is shared by HTTP/terminal adapters. IDs are opaque, path-safe and stable. expectedVersion is the session version. expectedEntryVersion=0 creates an entry.

type CommandResult 

type CommandResult struct {
	Receipt Receipt `json:"receipt"`
}

type DALRepository 

type DALRepository struct {
	// contains filtered or unexported fields
}

func NewDALRepository 

func NewDALRepository(mounted MountedDatabase, parent *record.Key) (*DALRepository, error)

func NewNativePinRepository added in v0.55.0 

func NewNativePinRepository(mounted MountedDatabase, parent *record.Key, storage, space, project string) (*DALRepository, error)

NewNativePinRepository explicitly binds pinning to the real mount and an owned repository parent. Ordinary NewDALRepository does not enable native pinning.

func (*DALRepository) DatabaseID 

func (r *DALRepository) DatabaseID() string

func (*DALRepository) NativeNamespace added in v0.55.0 

func (r *DALRepository) NativeNamespace() NativeNamespace

func (*DALRepository) ReaderInTransaction added in v0.56.0 

func (r *DALRepository) ReaderInTransaction(tx dal.ReadTransaction) (Reader, error)

ReaderInTransaction binds the caller's existing transaction to this repository's operational parent. It never starts, commits, or writes a transaction. Its lifetime is the caller's transaction; do not retain it. On Firestore, use this before native writes so session fence reads participate in the same optimistic transaction conflict boundary as native finalization.

func (*DALRepository) Transact 

func (r *DALRepository) Transact(ctx context.Context, f func(Transaction) error) error

Transact queues every write until the worker has completed all reads. Firestore transactions prohibit reads after writes, so this ordering is part of the contract.

func (*DALRepository) View 

func (r *DALRepository) View(ctx context.Context, f func(Reader) error) error

type DetectiveAcceptedQueryPin added in v0.55.0 

type DetectiveAcceptedQueryPin struct {
	QueryID        string          `json:"queryId"`
	Revision       string          `json:"revision"`
	DefinitionJSON json.RawMessage `json:"definitionJson"`
}

type DetectiveCheckDefinitionPin added in v0.55.0 

type DetectiveCheckDefinitionPin struct {
	SchemaVersion       int                            `json:"schemaVersion"`
	Check               detective.Check                `json:"check"`
	Dependencies        []detective.Check              `json:"dependencies"`
	PublishedValidators []detective.PublishedValidator `json:"publishedValidators"`
	QueryValidators     []detective.QueryValidators    `json:"queryValidators"`
	Queries             []DetectiveAcceptedQueryPin    `json:"queries"`
	Scenario            *DetectiveScenarioStepIdentity `json:"scenario,omitempty"`
}

func CanonicalDetectiveDefinition added in v0.55.0 

func CanonicalDetectiveDefinition(ctx context.Context, definition DetectiveCheckDefinitionPin) (DetectiveCheckDefinitionPin, string, error)

CanonicalDetectiveDefinition validates a complete private executable snapshot. It uses existing saved-query and catalog contracts, not source admission. Errors never include query text or validator/provider diagnostics.

type DetectiveDispatchBinding added in v0.55.0 

type DetectiveDispatchBinding struct {
	NativeOperationID   string `json:"nativeOperationId"`
	NativeStoreID       string `json:"nativeStoreId"`
	NativeSpaceID       string `json:"nativeSpaceId,omitempty"`
	NativeProjectID     string `json:"nativeProjectId"`
	Action              string `json:"action"`
	CheckID             string `json:"checkId"`
	CheckVersion        int64  `json:"checkVersion"`
	DefinitionDigest    string `json:"definitionDigest"`
	NativeRequestDigest string `json:"nativeRequestDigest"`
	CaseID              string `json:"caseId,omitempty"`
	CaseVersion         int64  `json:"caseVersion,omitempty"`
	CaseContextDigest   string `json:"caseContextDigest,omitempty"`
}

type DetectiveFence added in v0.56.0 

type DetectiveFence struct {
	SessionGeneration int64             `json:"sessionGeneration"`
	Identity          DetectiveIdentity `json:"identity"`
	Generation        int64             `json:"generation"`
}

type DetectiveIdentity added in v0.56.0 

type DetectiveIdentity struct {
	Namespace         NativeNamespace `json:"namespace"`
	Actor             string          `json:"actor"`
	SessionID         string          `json:"sessionId"`
	RunID             string          `json:"runId"`
	NativeStoreID     string          `json:"nativeStoreId"`
	NativeSpaceID     string          `json:"nativeSpaceId,omitempty"`
	NativeProjectID   string          `json:"nativeProjectId"`
	NativeOperationID string          `json:"nativeOperationId"`
	Digest            string          `json:"digest"`
}

DetectiveIdentity binds both operational authorities. It is not a bearer grant. NativeOperationID and Digest must come from the native owner's accepted request.

type DetectiveInputPin added in v0.55.0 

type DetectiveInputPin struct {
	Reference       apicontract.SessionInputReference `json:"reference"`
	Definition      DetectiveCheckDefinitionPin       `json:"definition"`
	EffectiveInputs map[string]detective.InputValue   `json:"effectiveInputs"`
	Dispatch        DetectiveDispatchBinding          `json:"dispatch"`
}

type DetectiveObservation added in v0.56.0 

type DetectiveObservation struct {
	// FenceGeneration copies DetectiveFence.Generation (initially 1).
	// SessionGeneration copies DetectiveFence.SessionGeneration (initially 0).
	// The native owner persists both with its acceptance and checks them at finalization.
	FenceGeneration   int64             `json:"fenceGeneration"`
	SessionGeneration int64             `json:"sessionGeneration"`
	Identity          DetectiveIdentity `json:"identity"`
	Produced          bool              `json:"produced"`
	Done              bool              `json:"done"`
	NativeRunID       string            `json:"nativeRunId,omitempty"`
	NativeReceiptID   string            `json:"nativeReceiptId,omitempty"`
	State             string            `json:"state,omitempty"` // completed, failed, canceled
	CaseLinkStatus    string            `json:"caseLinkStatus,omitempty"`
}

DetectiveObservation is supplied only by an authenticated native owner lookup, never by command JSON or a browser. Produced means the result is durable, Done means native finalization has completed. A fence must never discard Produced.

type DetectiveOwner added in v0.56.0 

type DetectiveOwner struct {
	// contains filtered or unexported fields
}

DetectiveOwner is deliberately separate from Service.Command. Its host must authenticate an active account for every gate call, even after content access is revoked, and supply a native lookup bound to the exact operation identity. Native execution must call CheckFence before source execution AND native finalization. A claim is recoverable ownership, never permission to reexecute. Cross-store adapters must serialize/check these fences at their native owner; Core cannot turn a remote check followed by a write into an atomic transaction.

func NewDetectiveOwner added in v0.56.0 

func NewDetectiveOwner(s *Service, gate func(context.Context, Principal, DetectiveIdentity) error, lookup func(context.Context, DetectiveIdentity) (DetectiveObservation, error)) (*DetectiveOwner, error)

func (*DetectiveOwner) CheckFence added in v0.56.0 

func (o *DetectiveOwner) CheckFence(ctx context.Context, p Principal, token DetectiveFence) error

CheckFence observes the fence in a fresh session repository read. Native owners sharing the authority should use CheckFenceWithReader inside their existing transaction so concurrent fences cause a transaction conflict.

func (*DetectiveOwner) CheckFenceWithReader added in v0.56.0 

func (o *DetectiveOwner) CheckFenceWithReader(ctx context.Context, p Principal, token DetectiveFence, r Reader) error

CheckFenceWithReader performs the same fence and authorization validation using the caller's transaction snapshot. It starts or commits no transaction. The trusted native owner must supply a namespace-bound Reader and perform all reads before writes where its storage engine requires that ordering.

func (*DetectiveOwner) ClaimDispatch added in v0.56.0 

func (o *DetectiveOwner) ClaimDispatch(ctx context.Context, p Principal, id DetectiveIdentity) (DetectiveFence, DetectiveInputPin, error)

ClaimDispatch returns the SAME generation on retry. It has no clock or lease. Recovery must reconcile the native operation identity before any execution.

func (*DetectiveOwner) ClaimDispatchOnce added in v0.57.0 

func (o *DetectiveOwner) ClaimDispatchOnce(ctx context.Context, p Principal, id DetectiveIdentity) (DetectiveFence, DetectiveInputPin, bool, error)

ClaimDispatchOnce distinguishes the successful first ownership claim from replay. Only first=true may begin original native acceptance; it is still subject to native admission/fencing and durable journaling before dispatch. first=false never authorizes execution merely because native work is absent. A native accepted-but-not-started continuation needs its own durable proof.

func (*DetectiveOwner) Fence added in v0.56.0 

func (o *DetectiveOwner) Fence(ctx context.Context, p Principal, id DetectiveIdentity, reason string) error

Fence durably invalidates all prior dispatch tokens. Repeating a reason does not advance generation. No method clears fences or recreates private pins.

func (*DetectiveOwner) ReadHandoff added in v0.56.0 

func (o *DetectiveOwner) ReadHandoff(ctx context.Context, p Principal, id DetectiveIdentity) (EvidenceHandoff, int64, error)

ReadHandoff is a trusted worker read, with ordinary content authorization. Reauthorization of the destination Case remains the native adapter's duty.

func (*DetectiveOwner) ReadStatus added in v0.56.0 

func (o *DetectiveOwner) ReadStatus(ctx context.Context, p Principal, id DetectiveIdentity) (AcceptedDetectiveStatus, error)

func (*DetectiveOwner) Reconcile added in v0.56.0 

func (o *DetectiveOwner) Reconcile(ctx context.Context, p Principal, id DetectiveIdentity) (AcceptedDetectiveStatus, error)

Reconcile reads the native owner's authoritative operation. It cannot run a query or create a native Case link. Produced-but-unfinished results survive fences; only native Done observations can settle an accepted session run.

func (*DetectiveOwner) RedactPins added in v0.56.0 

func (o *DetectiveOwner) RedactPins(ctx context.Context, p Principal, id DetectiveIdentity, deleteOpID, cursor string, limit int) (string, error)

RedactPins installs an irreversible content marker before bounded scrubbing. Cursor advances across owner-filtered input records, including other sessions; a caller resumes until NextCursor is empty. Repeating pages is safe. This removes session-side executable pins only; separately owned Case evidence, operational records, legacy stores, backups and source data are untouched.

func (*DetectiveOwner) ResolveOperation added in v0.57.0 

func (o *DetectiveOwner) ResolveOperation(ctx context.Context, p Principal, clientOpID string) (AcceptedDetectiveOperation, error)

ResolveOperation uses the operation receipt and accepted work committed with the private pin as one durable mapping. It performs no content authorization, private input read, source execution or new native identity generation. The configured full-identity gate still runs for the accepted actor after metadata is found. A transport MUST authenticate its active caller before invoking this resolver, including missing/corrupt operation paths. Legacy acceptances without a client request binding cannot enter this transport path.

func (*DetectiveOwner) SettleHandoff added in v0.56.0 

func (o *DetectiveOwner) SettleHandoff(ctx context.Context, p Principal, id DetectiveIdentity, expected int64, delivered bool, receiptID string) error

SettleHandoff records only an external receipt, after the adapter reauthorizes both resources and delivers selected input evidence idempotently. It never changes native CaseRunLink. The version is the outbox storage version.

type DetectiveScenarioStepIdentity added in v0.55.0 

type DetectiveScenarioStepIdentity struct {
	ScenarioID      string `json:"scenarioId"`
	ScenarioVersion int64  `json:"scenarioVersion"`
	ApplicationID   string `json:"applicationId"`
	StepID          string `json:"stepId"`
}

type EntityKey 

type EntityKey struct {
	Components []KeyComponent `json:"components"`
}

type Entry 

type Entry struct {
	ID                string  `json:"id"`
	SessionID         string  `json:"sessionId"`
	BagID             string  `json:"bagId"`
	Alias             string  `json:"alias,omitempty"`
	Subject           Subject `json:"subject"`
	CurrentRevisionID string  `json:"currentRevisionId"`
	Version           int64   `json:"version"`
}

type EntryRef 

type EntryRef struct {
	EntryID    string `json:"entryId"`
	RevisionID string `json:"revisionId"`
}

type EntryRevision 

type EntryRevision struct {
	ID               string        `json:"id"`
	EntryID          string        `json:"entryId"`
	BagID            string        `json:"bagId"`
	ParentRevisionID string        `json:"parentRevisionId,omitempty"`
	Subject          Subject       `json:"subject"`
	Value            ValueEnvelope `json:"value"`
	CreatedAt        time.Time     `json:"createdAt"`
	Provenance       string        `json:"provenance,omitempty"`
	LegacySourceID   string        `json:"legacySourceId,omitempty"`
	SourceDigest     string        `json:"sourceDigest,omitempty"`
}

type EvidenceHandoff 

type EvidenceHandoff struct {
	ID              string `json:"id"`
	SessionID       string `json:"sessionId"`
	RunID           string `json:"runId"`
	InputSnapshotID string `json:"inputSnapshotId"`
	CaseID          string `json:"caseId"`
	DetectiveRunID  string `json:"detectiveRunId"`
	State           string `json:"state"`
	ErrorCode       string `json:"errorCode,omitempty"`
}

EvidenceHandoff cannot replace Detective's native CaseRunLink transaction. A worker finalizes the native Detective operation, then marks this handoff delivered.

type InputSnapshot 

type InputSnapshot struct {
	ID                 string                            `json:"id"`
	SessionID          string                            `json:"sessionId"`
	ContextSetID       string                            `json:"contextSetId"`
	Scope              Scope                             `json:"scope"`
	Entries            []EntryRef                        `json:"entries"`
	DefinitionDigest   string                            `json:"definitionDigest"`
	DefinitionDocument json.RawMessage                   `json:"definitionDocument"`
	ResolvedParameters map[string]apicontract.TypedValue `json:"resolvedParameters,omitempty"`
	ParametersOrigin   string                            `json:"parametersOrigin,omitempty"`
	CreatedAt          time.Time                         `json:"createdAt"`
	Detective          *DetectiveInputPin                `json:"detective,omitempty"`
}

type KeyComponent 

type KeyComponent struct {
	Field string                 `json:"field"`
	Value apicontract.TypedValue `json:"value"`
}

type LegacyChatMessage 

type LegacyChatMessage struct {
	ID        string    `json:"id"`
	Role      string    `json:"role"`
	Text      string    `json:"text"`
	CreatedAt time.Time `json:"createdAt,omitempty"`
}

type LegacyEntry 

type LegacyEntry struct {
	ID        string        `json:"id"`
	Alias     string        `json:"alias,omitempty"`
	Subject   Subject       `json:"subject"`
	Value     ValueEnvelope `json:"value"`
	CreatedAt time.Time     `json:"createdAt,omitempty"`
}

type LegacyImport 

type LegacyImport struct {
	SourceID string              `json:"sourceId"`
	Title    string              `json:"title,omitempty"`
	Scope    Scope               `json:"scope"`
	Entries  []LegacyEntry       `json:"entries,omitempty"`
	Messages []LegacyChatMessage `json:"messages,omitempty"`
}

LegacyImport is a bounded, read-only migration payload. It imports saved context values and historical chat turns; it never creates executable runs.

type LegacyImportManifest 

type LegacyImportManifest struct {
	ID           string    `json:"id"`
	SessionID    string    `json:"sessionId"`
	BagID        string    `json:"bagId"`
	SourceID     string    `json:"sourceId"`
	SourceDigest string    `json:"sourceDigest"`
	Scope        Scope     `json:"scope"`
	CreatedAt    time.Time `json:"createdAt"`
}

LegacyImportManifest is private idempotency state keyed by a digest of the source identity, actor, project, and execution scope.

type Message 

type Message struct {
	ID              string    `json:"id"`
	SessionID       string    `json:"sessionId"`
	InputSnapshotID string    `json:"inputSnapshotId"`
	Role            string    `json:"role"`
	Text            string    `json:"text"`
	CreatedAt       time.Time `json:"createdAt"`
	Provenance      string    `json:"provenance,omitempty"`
	LegacySourceID  string    `json:"legacySourceId,omitempty"`
	SourceDigest    string    `json:"sourceDigest,omitempty"`
	HistoricalAt    time.Time `json:"historicalAt,omitempty"`
	SourceScope     Scope     `json:"sourceScope,omitempty"`
}

type MountedDatabase 

type MountedDatabase interface {
	ID() string
	DB() dal.DB
}

MountedDatabase is implemented by OVDB core.Database. The identity is captured with its mounted DALgo engine; clients cannot supply a raw storage connection.

type NativeNamespace added in v0.55.0 

type NativeNamespace struct {
	StorageID   string `json:"storageId"`
	SpaceID     string `json:"spaceId,omitempty"`
	DatabaseID  string `json:"databaseId"`
	ProjectID   string `json:"projectId"`
	NamespaceID string `json:"namespaceId"`
}

NativeNamespace is the private operational authority, not the source engine.

type Page 

type Page[T any] struct {
	Items      []T    `json:"items"`
	NextCursor string `json:"nextCursor,omitempty"`
	HasMore    bool   `json:"hasMore"`
}

type PinDetectiveInputCommand added in v0.55.0 

type PinDetectiveInputCommand struct {
	// ClientRequestDigest is host-computed from a canonical transport request.
	// Empty retains compatibility for internal callers, not transport acceptance.
	ClientRequestDigest                     string
	OpID, SessionID, InputSnapshotID, RunID string
	ExpectedVersion                         int64
	ExpectedContextSetID                    string
	Scope                                   Scope
	Attachments                             []EntryRef
	Pin                                     DetectiveInputPin
	Case                                    *detective.Case
	NativeBinding                           detective.OperationBinding
}

PinDetectiveInputCommand is a trusted Go boundary, never a generic HTTP command. The native owner supplies its existing scope-envelope OperationBinding and authoritative Case snapshot. This method does not authorize or execute a Case.

type PinnedDetectiveInput added in v0.55.0 

type PinnedDetectiveInput struct {
	Receipt Receipt
	Input   InputSnapshot
	Run     Run
}

type Principal 

type Principal struct {
	// Executor is set only by the server runtime when persisting an actual outcome.
	Executor   bool
	Actor      string
	DatabaseID string
	ProjectID  string
}

Principal is supplied by the authorized server boundary, never decoded from a command.

type Reader 

type Reader interface {
	Load(context.Context, string, string, any) (int64, error)
	List(context.Context, string, string, string, int) ([]json.RawMessage, string, error)
}

type Receipt 

type Receipt struct {
	Scope           *Scope    `json:"scope,omitempty"`
	OpID            string    `json:"opId"`
	Actor           string    `json:"actor"`
	Action          string    `json:"action"`
	PayloadDigest   string    `json:"payloadDigest"`
	SessionID       string    `json:"sessionId"`
	SessionVersion  int64     `json:"sessionVersion"`
	ResourceID      string    `json:"resourceId,omitempty"`
	ResourceVersion int64     `json:"resourceVersion,omitempty"`
	At              time.Time `json:"at"`

	// RecoveryBindingDigest independently binds accepted native recovery metadata.
	RecoveryBindingDigest string `json:"recoveryBindingDigest,omitempty"`
}

Receipt and audit contain references and counts only, never source/input values or titles.

type Repository 

type Repository interface {
	View(context.Context, func(Reader) error) error
	Transact(context.Context, func(Transaction) error) error
}

Repository implementations commit heads, immutable records, receipt and audit in one authority. List pages are bounded and owner-filtered before records reach clients.

type Run 

type Run struct {
	ID                 string `json:"id"`
	SessionID          string `json:"sessionId"`
	InputSnapshotID    string `json:"inputSnapshotId"`
	Kind               string `json:"kind"`
	DefinitionID       string `json:"definitionId"`
	DefinitionRevision string `json:"definitionRevision"`
	// State is accepted/completed/failed/canceled; client reportClientRun may
	// also settle uncertainty as outcome-unknown.
	State                string                             `json:"state"`
	OutcomeOrigin        string                             `json:"outcomeOrigin,omitempty"`
	ExecutionAuthority   string                             `json:"executionAuthority"`
	ExecutionDigest      string                             `json:"executionDigest,omitempty"`
	ExecutionDocument    json.RawMessage                    `json:"executionDocument,omitempty"`
	ResolvedParameters   map[string]apicontract.TypedValue  `json:"resolvedParameters,omitempty"`
	Version              int64                              `json:"version"`
	Widgets              []WidgetOutcome                    `json:"widgets,omitempty"`
	ResultRefs           []string                           `json:"resultRefs,omitempty"`
	ErrorCode            string                             `json:"errorCode,omitempty"`
	CreatedAt            time.Time                          `json:"createdAt"`
	CompletedAt          *time.Time                         `json:"completedAt,omitempty"`
	InputReference       *apicontract.SessionInputReference `json:"inputReference,omitempty"`
	DetectiveOperationID string                             `json:"detectiveOperationId,omitempty"`
}

type Scope 

type Scope struct {
	EnvironmentID  string `json:"environmentId"`
	IdentityDomain string `json:"identityDomain"`
}

type Service 

type Service struct {
	// contains filtered or unexported fields
}

Service requires a live authorization boundary. It never executes source queries on reads.

func NewNativePinService added in v0.55.0 

func NewNativePinService(repo Repository, authorize Authorizer) (*Service, error)

NewNativePinService is explicitly opt-in and remains unrouted/dormant.

func NewService 

func NewService(repo Repository, authorize Authorizer) (*Service, error)

func (*Service) Execute 

func (s *Service) Execute(ctx context.Context, p Principal, c Command) (CommandResult, error)

func (*Service) GetSnapshot 

func (s *Service) GetSnapshot(ctx context.Context, p Principal, id string) (Snapshot, error)

func (*Service) ListEntryRevisions 

func (s *Service) ListEntryRevisions(ctx context.Context, p Principal, sessionID, entryID, cursor string, limit int) (Page[EntryRevision], error)

ListEntryRevisions exposes a stable, authorized history for one session entry.

func (*Service) ListMessages 

func (s *Service) ListMessages(ctx context.Context, p Principal, sessionID, cursor string, limit int) (Page[Message], error)

ListMessages returns durable chat history in stable ID order, rechecking the source scope pinned when each message was sent.

func (*Service) ListRuns 

func (s *Service) ListRuns(ctx context.Context, p Principal, sessionID, cursor string, limit int) (Page[Run], error)

ListRuns returns durable run receipts in stable ID order. Each page is scoped to the authorized session and reauthorizes every pinned source scope.

func (*Service) ListSessions 

func (s *Service) ListSessions(ctx context.Context, p Principal, cursor string, limit int) (Page[Session], error)

func (*Service) PinDetectiveInput added in v0.55.0 

func (s *Service) PinDetectiveInput(ctx context.Context, p Principal, c PinDetectiveInputCommand) (PinnedDetectiveInput, error)

PinDetectiveInput atomically accepts private inputs only. It deliberately dispatches nothing and cannot settle native work without later attestation.

func (*Service) ReadDetectiveDispatch added in v0.55.0 

func (s *Service) ReadDetectiveDispatch(ctx context.Context, p Principal, sessionID, runID string) (DetectiveInputPin, error)

func (*Service) ReadEntryRevision 

func (s *Service) ReadEntryRevision(ctx context.Context, p Principal, sessionID, entryID, revisionID string) (EntryRevision, error)

ReadEntryRevision returns one retained revision after checking its owning session and the bag's current authorization boundary.

func (*Service) ReadInput 

func (s *Service) ReadInput(ctx context.Context, p Principal, id string) (InputSnapshot, []EntryRevision, error)

ReadInput resolves exact historical revisions after fresh source-scope authorization.

func (*Service) ReadOperation 

func (s *Service) ReadOperation(ctx context.Context, p Principal, id string) (Receipt, error)

func (*Service) ReadRun 

func (s *Service) ReadRun(ctx context.Context, p Principal, id string) (Run, error)

type Session 

type Session struct {
	SchemaVersion   int       `json:"schemaVersion"`
	ID              string    `json:"id"`
	DatabaseID      string    `json:"databaseId"`
	ProjectID       string    `json:"projectId"`
	Owner           string    `json:"owner"`
	Title           string    `json:"title"`
	State           string    `json:"state"`
	Version         int64     `json:"version"`
	DefaultBagID    string    `json:"defaultBagId"`
	ContextSetID    string    `json:"contextSetId"`
	PendingRunCount int       `json:"pendingRunCount,omitempty"`
	BagIDs          []string  `json:"bagIds"`
	CreatedAt       time.Time `json:"createdAt"`
	UpdatedAt       time.Time `json:"updatedAt"`

	// NativeFenceGeneration monotonically invalidates native claims on Stop/archive/delete.
	NativeFenceGeneration int64 `json:"nativeFenceGeneration,omitempty"`
}

type SessionRedaction added in v0.55.0 

type SessionRedaction struct {
	SessionID  string          `json:"sessionId"`
	Owner      string          `json:"owner"`
	Namespace  NativeNamespace `json:"namespace"`
	DeleteOpID string          `json:"deleteOpId"`
	Version    int64           `json:"version"`
	RedactedAt time.Time       `json:"redactedAt"`
}

SessionRedaction is a private authority marker, not an erasure claim or a grant. Creation/scrubbing belongs to the later accepted owner-deletion command.

type Snapshot 

type Snapshot struct {
	Session    Session           `json:"session"`
	Bags       []Bag             `json:"bags"`
	Entries    []Entry           `json:"entries"`
	Revisions  []EntryRevision   `json:"revisions"`
	ContextSet AppliedContextSet `json:"contextSet"`
}

type Subject 

type Subject struct {
	ConceptID       string   `json:"conceptId"`
	FieldID         string   `json:"fieldId"`
	FieldMappingRef string   `json:"fieldMappingRef"`
	GraphResource   string   `json:"graphResource,omitempty"`
	GraphRevision   string   `json:"graphRevision,omitempty"`
	ModelRef        string   `json:"modelRef,omitempty"`
	ModelRevision   string   `json:"modelRevision,omitempty"`
	Record          string   `json:"record,omitempty"`
	Fields          []string `json:"fields,omitempty"`
}

type Transaction 

type Transaction interface {
	Reader
	Save(context.Context, string, string, any, int64, string, string) error
}

type ValueEnvelope 

type ValueEnvelope struct {
	SchemaVersion int                      `json:"schemaVersion"`
	Kind          string                   `json:"kind"`
	Scalar        *apicontract.TypedValue  `json:"scalar,omitempty"`
	Values        []apicontract.TypedValue `json:"values,omitempty"`
	KeyFields     []string                 `json:"keyFields,omitempty"`
	Keys          []EntityKey              `json:"keys,omitempty"`
}

ValueEnvelope keeps integers/decimals lossless and composite keys structurally typed. Sets may be empty; an empty set is never interpreted as an unfiltered source.

type WidgetOutcome 

type WidgetOutcome struct {
	ID        string `json:"id"`
	State     string `json:"state"`
	ResultRef string `json:"resultRef,omitempty"`
	ErrorCode string `json:"errorCode,omitempty"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.