nomos_kernel_protocol library

Classes

Acknowledged
ApplyPackRequest
ApplyPackResponse
AttestedRead
AuthoringOptions
AuthorizationCheckRequest
AuthorizationCheckResponse
AuthorizationConditionContext
AuthorizationConsistency
AuthorizationDecisionBasis
AuthorizationExpandRequest
AuthorizationExpandResponse
AuthorizationExplanation
AuthorizationExplanation_Operation
AuthorizationObject
Zanzibar has its own explicit call algebra. These messages address the authorization graph compiled from the active typed USDA LawStage; they can constrain which custodied revision is acceptable but can never carry or replace the authorization model itself.
AuthorizationSubject
BirthCertificate
Signed authority evidence for one child birth. This is a kernel input, not tenant payload: generated clients cannot accidentally rename it, domain law cannot interpret it as business data, and the kernel converts it directly into its nominal Rust certificate before attaching it to USDA.
BirthOutcome
BirthOutcomeStatus
BornWorkspace
ByIdQuery
CallRequest
CallResponse
CapacityReserveRequest
CapacityReserveResponse
CapturedClock
CheckpointAssurance
CheckpointCompression
CheckpointExportRequest
CheckpointExportResponse
CheckpointImportRequest
CheckpointImportResponse
CheckpointVerificationPolicy
CompactionEquivalence
ConflictSnapshot
CustodyRequest
CustodyResponse
DeleteRefRequest
DirectiveCall
EncodeRefusalVerdictRequest
EncodeRefusalVerdictResponse
Failure
FoldFrontierAggregate
FoldFrontierFingerprint
FoldFrontierSnapshot
FrontierHlc
A prior-verification receipt is a typed cache of a kernel verdict. It is not authority by itself: only the separately supplied CheckpointVerificationPolicy decides whether an importer may accept it without recomputing the prefix. Unknown callers therefore verify by default.
FrontierTransitionDispositionMapEntry
FrontierTransitionDispositions
FrontierTransitionRequest
One real staged-law transition at the authenticated current frontier. This is deliberately a first-class protobuf contract rather than a NamedQuery/NomosStruct: field drift must fail every host build. HISTORY_PREFLIGHT remains an explicit counterfactual diagnostic and cannot authorize a lifecycle transition.
FrontierTransitionResponse
FrontierTransitionViolation
HistorySummaryRequest
HistorySummaryResponse
InjectedKey
InspectChangeRequest
InspectChangeResponse
InspectRefusalVerdictRequest
InspectRefusalVerdictResponse
IntentRecord
IntentsAboveRequest
IntentsAboveResponse
IntentTransportRequirement
A sealed change is self-contained and may take the low-latency offer lane. A commit-tree requirement means the effect also introduced canonical custody (currently a typed USDA law closure), so sync must carry the authenticated Git tree rather than stripping it to change.usda. The kernel derives this from the commit-tree delta; hosts never infer it from domain/directive labels.
KernelLawCapability
KernelLawHydrationStep
KernelProgressOperation
KernelProgressPhase
KernelProgressSnapshot
Ephemeral, authority-free progress from one long-running kernel operation.
KernelProgressUnit
KernelRefusal
KernelRefusalCode
This list mirrors nomos_executor::Reason. The Rust conversion is an exhaustive match, so adding a new gate refusal cannot silently degrade to prose.
KernelSpan
KernelSpanMetric
KernelSpans
LawClosureInfoRequest
LawClosureInfoResponse
LifecycleInstallIdentity
LifecycleInstallPhase
ListRefsRequest
ListRefsResponse
LocalCustodySnapshot
Host-local custody cache. This is a typed binary transport envelope, not application state and not a second semantic language: Git custody and kernel checkpoint bytes remain opaque bytes.
MetaFile
NamedQuery
Framework/introspection reads have fixed names in generated clients. arguments carries only their operation-specific data while migration replaces the remaining legacy query arms.
NominalCallIdentity
NomosKernelServiceApi
The host and kernel share one unary protocol. WASI transports the encoded messages through linear memory; native/cloud transports may expose the same messages through gRPC or Connect. This schema is an ABI only. Signed law and custody remain canonical typed USDA.
NomosList
NomosRef
NomosRuntimeServiceApi
The generated application/runtime ABI used inside the Component Model world. WIT owns resources and capabilities; this schema owns messages. Domain law, intent payloads and generated arguments remain canonical OpenUSD values.
NomosStruct
NomosValue
Nomos' dynamic tenant value is deliberately not google.protobuf.Value: that standard helper stores every number as double and cannot represent the exact i64/u64 values used by HLCs, replica ids, counters and custody metadata.
Null
OfferAdmitted
The kernel owns the shape of an admitted offer. Keep every framework consequence explicit so generated Rust, TypeScript and Dart clients fail to compile when this contract changes. Tenant business values remain canonical USDA; they never acquire a parallel protobuf domain model.
OfferAggregateRef
OfferBlockedOnDependency
OfferDeadLettered
OfferPreparationChallenge
OfferPrepared
A target holon's non-effectful authored result. The target kernel alone runs its installed law and captures its exact inputs; a sovereign client kernel may then add the device signature without cloning the target's custody. Admission still re-runs the ordinary offer gate against the target's current head.
OfferQuarantined
OfferRefused
OfferRequest
OfferResponse
An offer is adjudicated data, not a generic RPC success followed by a stringly outcome field. Every kernel-owned admission state is exhaustive in generated clients.
OpenRequest
OpenResponse
Application operations have distinct envelopes even where their tenant-defined body remains a NomosValue. This keeps operation identity in the generated type system instead of rebuilding a stringly mode discriminator above a generic success object.
OsgiAttribute
OsgiCapability
OsgiDirective
OsgiRequirement
OsgiResourceResponse
OutboundOffer
A kernel-authored outbound offer. The host is allowed to inspect destination solely to route the opaque sealed bytes; every semantic field remains inside sealed_offer. custody_path and delivery_ref are opaque transport cursors chosen by the kernel, never reconstructed by a host.
OutboxRequest
OutboxResponse
PackDeltaRequest
PackDeltaResponse
PageQuery
PrepareRemoteOfferRequest
The first half of remote authoring proves possession of an enrolled device key BEFORE the target evaluates a privileged plan. The client signs the exact serialized OfferRequest bytes; the target kernel verifies those same bytes against its own signer relation, then prepares the USDA transition. The second, existing SignPreparedOffer proof binds the resulting transition.
PrepareRemoteOfferResponse
ProveCompactionEquivalenceRequest
ProveCompactionEquivalenceResponse
QueryAuthority
Claims and opaque proofs supplied to a read. The kernel alone resolves them against active law; this message cannot assert a verified principal.
QueryOperation
QueryRequest
QueryResponse
ReadBlobRequest
ReadBlobResponse
ReferenceVersionCheck
ReferenceVersionsQuery
RefRecord
RefusalVerdict
RelationshipTupleAddress
RelationshipTupleEvidence
RepoStatsRequest
RepoStatsResponse
ResidentComponent
ResidentComponentKind
ResidentFootprint
ResidentFootprintRequest
OPERATOR TELEMETRY, never law. What each resident workspace costs this kernel in memory, so the host can see WHY a container is full instead of guessing from a process-wide RSS number. Cheap by construction: the read model's size is page_count × page_size, two SQLite pragmas, so this is safe to poll. Reports only what is ALREADY resident — it never mounts, folds, or touches custody. deep walks each resident's documents, indexes and fold images by reference (no clone, no serialize). That is the only way to see the ~70% of a workspace that is NOT SQLite pages, but it costs real time, so it is opt-in and the response reports what the measurement itself cost.
ResidentFootprintResponse
ResolveRefRequest
ResolveRefResponse
ResolveRefsQuery
ResolveStatePositionRequest
Ask the kernel whether one replica-local custody hint resolves to the same canonical USDA state on this authenticated main. Hosts may use the answer for placement only; offer admission reopens and rederives the foreign read independently.
ResolveStatePositionResponse
RestoreMainRequest
Establish an absent live frontier from already-imported custody. The kernel first exposes the candidate only under an internal quarantine ref, verifies its complete semantic chain, and promotes it atomically. A host cannot use this operation to advance or replace an existing main.
RestoreMainResponse
RestoreMainSpans
One typed breakdown of custody admission. Zero means that phase was not needed (for example, an already-mounted frontier only performs the live-ref lookup).
RowsQuery
RuntimeEvent
RuntimeEventKind
RuntimeFailure
RuntimeOperation
RuntimeRequest
RuntimeResponse
RuntimeSuccess
SetTestRootRequest
SignBirthCertificateRequest
Pure local signing for the same typed certificate that OfferRequest carries. The client-held secret enters one kernel call and is never retained; the response is the generated certificate message, not a second document representation of it. A non-empty input signature is refused so callers cannot confuse signing a body with accepting a previously signed certificate. The certificate parent_key authorizes the signer of the next link down the chain, so it need not match signer_secret. When omitted, the kernel derives it from signer_secret for the self-signed/keyless lane.
SignBirthCertificateResponse
SignOfferPreparationRequest
SignOfferPreparationResponse
SignPreparedOfferRequest
Pure client-side signing of a target-kernel-prepared USDA transition. The secret enters only the local kernel invocation; neither the host nor the target workspace receives it.
SignPreparedOfferResponse
SpatialQuery
StoredCheckpointManifest
Typed manifest for a checkpoint's Git meta-commit. This is cache/transport structure, not application state; semantic aggregate content remains canonical USDA.
SyncRequest
SyncResponse
TallyQuery
TestRequest
Harness-only controls. Production kernels compile these operations out and fail closed if asked.
TestResponse
TraceContext
VerifiedFrontierReceipt
VerifyChainDiagnostics
VerifyChainEngineTiming
VerifyChainLawHydrationTiming
VerifyChainStepPhases
Kernel-owned phase timings for one replayed intent. These remain typed all the way to the framework observability edge so diagnostics cannot become another semantic JSON carrier.
VerifyChainStepSpan
VerifyChainWalk
WorkspaceResidencyRequirement
A custody dependency the kernel decoded from a sealed intent's typed captured-read envelope. This is a compute-readiness hint, never authority: the receiving kernel still reopens the named workspace at source_head and proves the carried result before admission.
WorkspaceTarget
WriteMetaCommitRequest
WriteMetaCommitResponse
WriteRefRequest

Extensions

GeneratedMessageGenericExtensions on T
Extensions on GeneratedMessages.