Module invocation_scope 

Host-local invocation custody. No wire caller can manufacture these checks.

Structs

ApprovedCheckReceipt

Observed execution metadata. This is not a grader verdict or a model score. The full private receipt remains with the trusted host under its content hash.

DocumentAuthorization

Immutable local publication evidence. It is never serialized or minted from wire fields. Captured original guards outlive terminal invocation tracking.

ExternalModerationReply

Cloneable one-shot response custody for the collaboration request queue.

InvocationLocusBasis

Local evidence of the target resolved at dispatch, before encoding/execution.

InvokerScope

The invoker whose resource tree a delivered invocation resolves against, for the duration of its resolution and dispatch on this thread.

PublishedInvocationLease

An opaque check minted by the actual host for this exact invocation. Hosts must retain original caller authority and resample their registered policy time on every check. A positive result is never a reusable decision.

PublishedInvocationRequest

Inert delivered inputs. Only the registered host can associate these with an original admitted caller, contract and exact worker connection.

PublishedInvocationSpec

Inert declaration retained by the actual host at original admission. This is not authority, and is never decoded from a caller’s wire request.

ResourceEffectScope

ResourceInvocationScope

Immutable job custody, constructed only from an actual admitted invocation and the exact mounted record owner. InvocationId alone cannot construct it.

ViewerScope

The participant a published tree is being built for while it lives: what a surface offers bound to where someone is (their caret, their Find hits) is that participant’s, not the window’s. It grants nothing: an invocation still runs for its own invoker.

WriteAttributionReceipt

The host’s answer to naming the paths an invocation is about to write ([ResourceInvocationScope::attribute_writes]). Wait for it before writing, so the versions those writes make record who caused them.

Enums

ApprovedCheckReportObservation

Command observations do not establish success or authorize any operation.

Functions

current_invoker

The invoker of the delivered invocation being resolved on this thread. None outside any delivered invocation (the local person acting).

current_participant

The participant whose view the current resolution builds, if any.

current_viewer

Whose view what is being built or resolved now is: the participant of the delivered invocation, else the participant a tree is published for. None for the window’s own person.

delivered_invocation

The broker invocation being dispatched on this thread, when the broker delivered it: what a request the app makes to the shell for it (opening another app) names, so the shell admits it as that invocation’s caller. None for the local person acting, whose own press is the proof.

view_operation_permitted

Whether actor may invoke the View operation contract here. The local person always may. A remote actor may only when it is the current host-set invoker, it has its own participant view, and the operation declares that it changes only the invoking participant’s view (tilo_actions::PARTICIPANT_VIEW_TAG). A read of the document (tilo_actions::DOCUMENT_READ_TAG) moves nothing, so any actor the broker admitted may run it: it is a View operation only because it changes no document, and refusing it as “somebody else’s view” left an agent that may read a note unable to read it. Every other View operation would move somebody else’s private view and stays refused.

Type Aliases

ApprovedCheckFuture

A typed host check response, suitable for an existing effect worker.

ApprovedCheckReportSink

Informational reports enter the caller’s existing effect reporter.

ApprovedCheckReportedWork

A queued approved check, attached to its original reporter by the effect worker.

ExternalModerationFuture

A host moderation receipt, suitable for an existing action worker.

PublishedInvocationAuthorizer