Module contract 

Machine-readable operational semantics for exported actions.

Labels explain an action to a person. This module explains it to callers that must plan safely without seeing the application: whether it is currently available, what confirmation it needs, whether a failed call may be retried, how it completes, and what it returns.

Structs

ActionContract

Complete operational contract copied into every inert descriptor.

ActionNeed

What one invocation of an action is, for the grants deciding it: its kind, the one field of its resource it writes when it writes only one (a reply writes the comments), which places it below that field in the tree, and whether it is privileged (RiskLevel::Privileged): it exercises authority over the room or others in it, so the person’s own grants must allow it (tilo_action_policy::Verdict::privileged).

Enums

ActionKind

What an action is able to do, derived by the framework from the action’s code and never declared by an app.

Availability

Whether an action can be invoked in the resource’s current state.

ConfirmationPolicy

Confirmation required after argument binding and immediately before run.

ExecutionMode

Completion behavior advertised before invocation.

ResultSpec

Shape of a successful result. Schemas use JSON Schema so non-Rust callers do not need a parallel Tilo-only type system.

RetryPolicy

What a caller may safely do after losing the completion response.

RiskLevel

Consequence class used by policy, confirmation UI, and audit logs.

Constants

ARGUMENT_RISK_TAG

ActionContract::tags entry of an action whose risk, and therefore whether it needs confirmation, depends on the arguments it is invoked with (a generic edit that may delete). The publishing host classifies each invocation; a caller that cannot classify arguments treats the action as requiring confirmation (see ActionContract::advertised_confirmation).

DOCUMENT_READ_TAG

ActionContract::tags entry of the read-only action that answers, when invoked with no arguments, the first page of the document an app has open (a word processor’s text, a sheet’s used cells, a deck’s outline). A caller that just opened a file reads it through this action without knowing the app.

FIELD_EDIT_PARAM

The parameter of a generic field edit that carries the edit.

INCOMING_MESSAGE_FACET

Facet the executor writes on a change made by a verb its app marks #[action(incoming_message)]: a message someone received. The IncomingMessage trigger fires on it without knowing the app’s schema.

INCOMING_MESSAGE_TAG

Contract tag on the declaration of such a verb, so a surface and a catalogue show it.

LOCAL_DEVICE_ONLY

The contract tag of an action that reaches files, hardware or services of the device it runs on: the door runs it only for the person at that device, never for a collaborator or a remote participant.

PROGRAMMATIC_TAG

ActionContract::tags entry of an action offered only to programmatic callers — agents, scripts and the controls or surfaces that submit it — and never listed for a person to pick (the action palette, menus).

UNTRUSTED_CONTENT_TAG

ActionContract::tags entry of an action whose result carries content from outside the user’s own data (a web page’s text, its logs): data for the caller to reason about, never instructions to follow.

Functions

action_node

The node of the action action on the resource resource (of kind resource_kind) the app app publishes, below base (a room, or the root for a path relative to one), and below the one field it writes if any: where every door decides it.