fabric/graph

Durable agentic graphs. Author a definition with native codecs, bind it to a store, a context and the same policy.Policy agents use, and start runs in the same supervised store as ordinary Fabric agents.

let assert Ok(runtime) =
  graph.new(publishing, runs, context: fn(_run) { Ctx(user:) }, policy:)
  |> graph.with_approvers(editors)
  |> graph.with_operation_timeout(run.After(duration.minutes(5)))
  |> graph.build
let assert Ok(handle) =
  graph.start(runtime, id: run.new_id(), initial: draft, correlation: None)
case graph.await(handle, within: duration.seconds(5)) {
  Ok(graph.AwaitingApproval(pending)) -> {
    let assert Ok(proof) =
      approvers.check(editors, token, pending.requirement)
    graph.approve(handle, pending, proof:, context: Ctx(user:))
  }
  ...
}

await and every command (approve, reject, deliver, reconcile, poll_job, cancel, recover) return the run’s Status, as the agent runtime’s do; snapshot reads the whole record (the state value, receipts, deadline). status_kind classifies a status by what the caller does next.

A run handle starts no process by itself. Waiting approvals, unresolved effects and completed runs live as stored data. recover reconnects work whose owner is gone; recorded routing decisions are never recomputed.

The vocabulary is the agent runtime’s: one policy.Action and policy.Policy, one tool.Failure for operation bodies, ApprovalRef answered with an approvers.Proof and the current context, the context built from the run id (fn(RunId) -> context), and one Error classified by error_kind (fabric.ErrorKind).

Every wait is bounded by default:

Bound	Default	Setter
one pure callback (context, selection, acceptance)	1 s	`with_callback_timeout`
one activity body	60 s	`with_operation_timeout`
command waiting for the live runner	1 s	`with_command_timeout`
approval request	7 days	`with_approval_expiry`
signal, job, child and fork waits	7 days	`operation.with_deadline`
activations per run	100	`definition.with_max_activations`
family budget	none (opt-in)	`with_family_budget`

Deadlines are set and judged by the store’s clock (store.now).

A bound may come from configuration, so a setter only stores it; build checks every bound and reports every problem at once (InvalidLimit(limit:, value:, minimum:, maximum:), as agent.build does). Only build makes the Runtime that start, open and the composition functions take.

Types

ApprovalRef

</>

A waiting approval request. References are plain data: an application may serialize one and rebuild it later; approve and reject check it against the stored record.

pub type ApprovalRef {
  ApprovalRef(
    run: run.RunId,
    activation: Int,
    attempt: Int,
    revision: Int,
    requirement: run.Requirement,
  )
}

Constructors

ApprovalRef(
  run: run.RunId,
  activation: Int,
  attempt: Int,
  revision: Int,
  requirement: run.Requirement,
)

Awaited

</>

The status reached, or a caller-owned message that interrupted the wait.

pub type Awaited(answer, message) {
  Reached(Status(answer))
  Interrupted(message)
}

Constructors

```
Reached(Status(answer))
```
```
Interrupted(message)
```

Cancellation

</>

pub type Cancellation {
  BeforeStart
  JobDetached(job.Reference)
  JobStopped(job.Reference)
  AfterResult
  AfterFailure(Failure)
  ChildSettled(child.Reference)
  ForkSettled(activation: Int)
  ChildUnresolved(child.Reference, problem: Problem)
  Unresolved(reference: Reconciliation, problem: Problem)
}

Constructors

```
BeforeStart
```
```
JobDetached(job.Reference)
```
```
JobStopped(job.Reference)
```
```
AfterResult
```
```
AfterFailure(Failure)
```
```
ChildSettled(child.Reference)
```
```
ForkSettled(activation: Int)
```
```
ChildUnresolved(child.Reference, problem: Problem)
```
Reconcile the child’s operation, then recover its canceled or expired parent.

Unresolved(reference: Reconciliation, problem: Problem)

ChildProblem

</>

How a managed child does not belong to the parent that opens it.

pub type ChildProblem {
  DifferentStore
  OtherParent
}

Constructors

```
DifferentStore
```
The child’s runtime uses another store than its parent’s.
```
OtherParent
```
The child was started by another parent activation.

ConfigError

</>

Why build refused a spec. This union may grow: match the variants you handle and keep a catch-all, or use describe_config_error.

pub type ConfigError {
  InvalidLimit(
    limit: Limit,
    value: Int,
    minimum: Int,
    maximum: Int,
  )
}

Constructors

```
InvalidLimit(
  limit: Limit,
  value: Int,
  minimum: Int,
  maximum: Int,
)
```
A bound is outside minimum..maximum (both included), as for agent.InvalidLimit. Durations are in milliseconds.

Error

</>

Why a call to fabric/graph failed: one type for every function of this module. Branch on error_kind and log with describe_error; this union may grow, so match a variant only where it decides something (keep a catch-all).

pub type Error {
  AlreadyStarted(id: run.RunId, same_input: Bool)
  FamilyBudgetUnsupported
  RunNotFound
  StoreUnavailable(reason: String)
  UnsupportedVersion(found: Int)
  CorruptRecord(detail: String)
  IncompatibleDefinition(definition.Error)
  CallbackFailed(evidence: String)
  SignalEncodingFailed(codec.EncodeError)
  ValueRefused(definition.Error)
  RunEnded
  WrongReference
  StaleReference
  AlreadyAnswered
  ApprovalExpired
  RequirementChanged(ApprovalRef)
  ProofRefused(approvers.ProofError)
  SignalConflict
  NotReconcilable
  ReconcileChildFirst
  ChildMismatch(ChildProblem)
  RunUnattended
  RunnerBusy
  Contended
}

Constructors

```
AlreadyStarted(id: run.RunId, same_input: Bool)
```
A run with this id is already stored: this start stored nothing. same_input says whether the stored run is a root of the same graph with the same initial state and correlation; a retry can then open it. When the id is taken but the stored run cannot be read, the start returns the read’s error instead (StoreUnavailable, CorruptRecord or UnsupportedVersion).
```
FamilyBudgetUnsupported
```
The runtime declares a family budget (with_family_budget) and the store writes agent records older than version 7. Nothing was stored.
```
RunNotFound
```
```
StoreUnavailable(reason: String)
```
The store failed. A write it reported unavailable has an unknown outcome: the backend may still perform it later.
```
UnsupportedVersion(found: Int)
```
The record was written by a Fabric version this one cannot read.
```
CorruptRecord(detail: String)
```
```
IncompatibleDefinition(definition.Error)
```
The stored run cannot continue under this definition: another graph, changed structure, or a value its codecs refuse.
```
CallbackFailed(evidence: String)
```
A deployed callback (context, selection, acceptance, a child or job binding) crashed or ran past the callback timeout. evidence is for logs.
```
SignalEncodingFailed(codec.EncodeError)
```
deliver’s value does not encode with its signal’s codec.
```
ValueRefused(definition.Error)
```
A delivered signal value or a reconciled result is refused by the definition: its codec does not decode it, or the node’s acceptance refuses it. Nothing changed.
```
RunEnded
```
The run has ended, or an ancestor of it is stopping or has ended: it accepts no command but terminal reconciliation.
```
WrongReference
```
The reference names another run, or no wait or activation of this one.
```
StaleReference
```
The reference names a wait, approval request or attempt of this run that is not current: one the run moved past (also a request a new one superseded), or one not yet published.
```
AlreadyAnswered
```
This approval request was already answered.
```
ApprovalExpired
```
The approval request’s deadline passed before this answer (with_approval_expiry): it expired instead, and the run failed with ExpiredApproval.
```
RequirementChanged(ApprovalRef)
```
The current policy now requires another approval for the operation; the answer was not applied. Answer the new request, with a proof checked for its requirement.
```
ProofRefused(approvers.ProofError)
```
The answer’s proof is not one the runtime’s approvers accept for the request (see fabric/approvers). Nothing was changed.
```
SignalConflict
```
A different value was already accepted for this signal.
```
NotReconcilable
```
The run has no uncertain effect to reconcile.
```
ReconcileChildFirst
```
The uncertain effect is a managed child’s: reconcile the child, then recover its parent.
```
ChildMismatch(ChildProblem)
```
```
RunUnattended
```
Work is in flight and no runner known to this store drives it (its runner was lost, or another node’s holds it). Nothing was changed.
```
RunnerBusy
```
The run’s runner did not take the command within the command timeout (with_command_timeout). Nothing was changed.
```
Contended
```
The command lost every retry against concurrent commits.

Failure

</>

Why a run failed. This union may grow: keep a catch-all.

pub type Failure {
  DeadlineExpired(due: Int)
  ExpiredApproval(due: Int)
  Denied(String)
  PolicyFailed(String)
  OperationFailed(String)
  FamilyBudget(budget.Denial)
}

Constructors

```
DeadlineExpired(due: Int)
```
A wait passed its deadline (operation.with_deadline).
```
ExpiredApproval(due: Int)
```
The approval request expired unanswered at due (with_approval_expiry).
```
Denied(String)
```
The policy denied the operation, or a reviewer rejected it.
```
PolicyFailed(String)
```
```
OperationFailed(String)
```
The body failed definitely (tool.Explain), or a managed child failed.
```
FamilyBudget(budget.Denial)
```

Handle

</>

A handle on one graph run, for the runtime it was started or opened with. It holds no process.

pub type Handle(context, state, answer) =
  @internal Handle(Runtime(context, state, answer))

Limit

</>

A bound build checks, named after its setter. This union may grow.

pub type Limit {
  CallbackTimeout
  OperationTimeout
  CommandTimeout
  ApprovalExpiry
  FamilyWork
  FamilyChildren
  FamilyDepth
}

Constructors

```
CallbackTimeout
```
At most 2^32 - 1 ms, the longest timer the runtime can set, like the operation and command timeouts.
```
OperationTimeout
```
```
CommandTimeout
```
```
ApprovalExpiry
```
At most 2^53 - 1 ms, as for agents: the deadline is stored, not timed.
```
FamilyWork
```
budget.limits(work:).
```
FamilyChildren
```
budget.with_children.
```
FamilyDepth
```
budget.with_depth, at most 63.

Problem

</>

pub type Problem {
  EffectUncertain(evidence: String)
  InvalidResult(output: String, reason: String)
}

Constructors

```
EffectUncertain(evidence: String)
```

InvalidResult(output: String, reason: String)

Receipt

</>

A committed result. Read it by label: Fabric may add fields. approvals are the activation’s answered approval requests, oldest first, with their reviewers.

pub type Receipt {
  Receipt(
    activation: Int,
    attempt: Int,
    node: String,
    operation: run.DefinitionId,
    input_json: String,
    output_json: String,
    state_json: String,
    route: Route,
    approvals: List(run.Approval),
  )
}

Constructors

Receipt(
  activation: Int,
  attempt: Int,
  node: String,
  operation: run.DefinitionId,
  input_json: String,
  output_json: String,
  state_json: String,
  route: Route,
  approvals: List(run.Approval),
)

Reconciliation

</>

pub type Reconciliation {
  Reconciliation(run: run.RunId, activation: Int, attempt: Int)
}

Constructors

Reconciliation(run: run.RunId, activation: Int, attempt: Int)

Route

</>

Where an activation’s accepted result led.

pub type Route {
  Next(node: String)
  Finished
  Stopped
}

Constructors

```
Next(node: String)
```
```
Finished
```
```
Stopped
```
The run was stopping (cancelled, or past a deadline) when the result arrived: it was kept, and routed nowhere.

Runtime

</>

A checked runtime: what start, open, as_subgraph, both and map take. Only build makes one.

pub type Runtime(context, state, answer) =
  @internal Runtime(context, state, answer)

SignalReference

</>

Durable correlation data, not an authorization token. Applications must authorize callers before using the delivery APIs.

pub type SignalReference {
  SignalReference(
    run: run.RunId,
    activation: Int,
    attempt: Int,
    contract: run.DefinitionId,
  )
}

Constructors

SignalReference(
  run: run.RunId,
  activation: Int,
  attempt: Int,
  contract: run.DefinitionId,
)

Snapshot

</>

A run as stored. Read it by label: Fabric may add fields.

current is the action of the current (or last) activation, as the policy saw it, and approvals its answered approval requests (who approved or rejected it). deadline is the current wait’s, approval request’s or job cleanup’s due time, or an expired outcome’s, in UTC Unix milliseconds by the store’s clock.

pub type Snapshot(state, answer) {
  Snapshot(
    revision: Int,
    value: state,
    status: Status(answer),
    current: option.Option(policy.Action),
    approvals: List(run.Approval),
    receipts: List(Receipt),
    deadline: option.Option(Int),
    forks: List(fork.Snapshot),
  )
}

Constructors

Snapshot(
  revision: Int,
  value: state,
  status: Status(answer),
  current: option.Option(policy.Action),
  approvals: List(run.Approval),
  receipts: List(Receipt),
  deadline: option.Option(Int),
  forks: List(fork.Snapshot),
)

Spec

opaque </>

A graph definition bound to its store, context and policy, with its bounds; build checks it. Make one with new and the with_* setters.

pub opaque type Spec(context, state, answer)

Status

</>

A run’s status. This union may grow: branch on status_kind, and match the variants you handle with a catch-all.

pub type Status(answer) {
  Working
  Unattended
  AwaitingApproval(ApprovalRef)
  AwaitingSignal(SignalReference)
  AwaitingJob(job.Reference)
  CancellingJob(
    job.Reference,
    job.CancellationProgress,
    operation.StopReason,
  )
  Child(child.Reference, child.Progress)
  Fork(fork.Snapshot, stop: option.Option(operation.StopReason))
  CancellingChild(child.Reference, operation.StopReason)
  Blocked(Reconciliation, problem: Problem)
  Completed(answer)
  Failed(Failure)
  Exhausted
  Cancelled(Cancellation)
  Expired(due: Int, disposition: Cancellation)
}

Constructors

```
Working
```
```
Unattended
```
Work exists but this store knows no owner and no live foreign lease.
```
AwaitingApproval(ApprovalRef)
```
```
AwaitingSignal(SignalReference)
```
```
AwaitingJob(job.Reference)
```

CancellingJob(
  job.Reference,
  job.CancellationProgress,
  operation.StopReason,
)

```
Child(child.Reference, child.Progress)
```

Fork(fork.Snapshot, stop: option.Option(operation.StopReason))

```
CancellingChild(child.Reference, operation.StopReason)
```
The stop cause is committed; the owned child has not settled yet.

Blocked(Reconciliation, problem: Problem)

```
Completed(answer)
```
```
Failed(Failure)
```
```
Exhausted
```
```
Cancelled(Cancellation)
```

Expired(due: Int, disposition: Cancellation)

StatusKind

</>

A stable classification of Status, by what the caller does next.

pub type StatusKind {
  Active
  NeedsRecovery
  NeedsInput
  Ended
}

Constructors

```
Active
```
Work is in flight, or the run waits on something that settles without the caller: an operation, a job, a child, a fork, a stop in progress (Working, AwaitingJob, CancellingJob, Child, Fork, CancellingChild). await it. A job without a schedule is observed with poll_job, and a child or fork may itself wait for input (open it with child or branch).
```
NeedsRecovery
```
Work is in flight and nothing drives it (Unattended): recover it once its previous owner is known to be gone.
```
NeedsInput
```
The run waits for the application: an answer (AwaitingApproval), a signal (AwaitingSignal) or a reconciliation (Blocked).
```
Ended
```
The run has ended (Completed, Failed, Exhausted, Cancelled, Expired). A cancelled run may still name an effect to reconcile.

Values

approve

</>

pub fn approve(
  handle: @internal Handle(Runtime(context, state, answer)),
  reference: ApprovalRef,
  proof proof: approvers.Proof,
  context context: context,
) -> Result(Status(answer), Error)

Approves the run’s waiting approval request. context is the application’s current context: the policy is checked again with it, and a current denial or policy failure wins over the approval; a policy that now requires another approval refuses it with RequirementChanged. The approved operation runs with exactly this context; it does not become the run’s context. An answer after the request’s deadline (with_approval_expiry) is refused with ApprovalExpired: the request expires instead, and the run fails.

proof says who answers: approvers.check made it for the request’s requirement (reference.requirement) with the runtime’s approvers (with_approvers). Any other proof, or one older than the proof lifetime, is refused with ProofRefused before the run is read. The reviewer it names and the approvers’ name are recorded with the answer (Snapshot.approvals, Receipt.approvals).

as_subgraph

</>

pub fn as_subgraph(
  runtime: Runtime(child_context, child_state, child_answer),
) -> @internal Operation(
  parent_context,
  child_state,
  child_answer,
  operation.Kind,
  operation.Recovery,
  operation.Invocation,
  operation.Error,
)

Bind a graph’s native initial state and answer as one managed operation. Parent and child runtimes must use the same supervised store. The parent owns cancellation; child policy still gates every child operation. The child inherits its parent’s correlation and family root.

await

</>

pub fn await(
  handle: @internal Handle(Runtime(context, state, answer)),
  within within: duration.Duration,
) -> Result(Status(answer), Error)

Waits up to within for completion, approval, reconciliation or unattended work, and returns the run’s status. At the deadline a still-working status is returned; a within of zero (or less) reads the status now. It never recovers a run, but an approval request whose deadline passed is expired first, and the status shows the failed run. snapshot reads the whole record (the state value, receipts, deadline).

await_with

</>

pub fn await_with(
  handle: @internal Handle(Runtime(context, state, answer)),
  within within: duration.Duration,
  or interrupt: process.Selector(message),
) -> Result(Awaited(answer, message), Error)

await, selecting on a caller’s cancellation or shutdown at the same time. Interruption leaves the run unchanged; the caller may cancel it.

both

</>

pub fn both(
  identity: run.DefinitionId,
  left: Runtime(left_context, left_state, left_answer),
  right: Runtime(right_context, right_state, right_answer),
) -> @internal Operation(
  parent_context,
  #(left_state, right_state),
  Result(#(left_answer, right_answer), fork.Failure),
  operation.Kind,
  operation.Recovery,
  operation.Invocation,
  operation.Error,
)

Compose two managed graphs with independent native inputs and answers. A settled member failure is available to the parent as a typed alternative.

branch

</>

pub fn branch(
  parent: @internal Handle(Runtime(context, state, answer)),
  activation: Int,
  member: Int,
  runtime: Runtime(child_context, child_state, child_answer),
) -> Result(
  @internal Handle(
    Runtime(child_context, child_state, child_answer),
  ),
  Error,
)

Open one admitted fork member with its native runtime. Ordinals start at one.

build

</>

pub fn build(
  spec: Spec(context, state, answer),
) -> Result(Runtime(context, state, answer), List(ConfigError))

Checks spec and reports every problem at once. Building starts nothing.

case graph.new(publishing, runs, context:, policy:) |> graph.build {
  Ok(runtime) -> runtime
  Error(errors) -> panic as graph.describe_config_errors(errors)
}

cancel

</>

pub fn cancel(
  handle: @internal Handle(Runtime(context, state, answer)),
) -> Result(Status(answer), Error)

Cancels the run, and its managed children through the store, and returns its status right after the cancellation was committed. Cancellation does not require the currently deployed definition to fit the record. A lost or unresponsive owner is fenced by a committed cancellation; effects whose results were not saved remain explicitly unresolved. For an admitted owned job this records intent, not proof that remote work stopped. Its request runs only with compatible code and a committed fence; manual or scheduled observation must confirm the terminal outcome. A run that has ended is RunEnded.

cancel_stored

</>

pub fn cancel_stored(
  store: store.Store,
  id: run.RunId,
) -> Result(Nil, Error)

Cancels the stored run id with no definition: for a run that cannot be opened because its definition changed (IncompatibleDefinition). A run waiting on an approval, a signal, a job it observes, or a child is cancelled in one commit, and its managed children through the store. An owned job’s stop request runs only under a compatible definition: its intent is recorded, and the run stays unattended until it is recovered with one. A run that has ended is RunEnded.

child

</>

pub fn child(
  parent: @internal Handle(Runtime(context, state, answer)),
  activation: Int,
  runtime: Runtime(child_context, child_state, child_answer),
) -> Result(
  @internal Handle(
    Runtime(child_context, child_state, child_answer),
  ),
  Error,
)

Open a specific child visit, including a completed one, with its native runtime. The child’s reciprocal attachment is checked before returning.

deliver

</>

pub fn deliver(
  handle: @internal Handle(Runtime(context, state, answer)),
  reference: SignalReference,
  contract: signal.Signal(value),
  value: value,
) -> Result(Status(answer), Error)

Supply a native value for the exact committed wait. An identical encoded value for an already consumed reference is acknowledged without routing again. A conflicting value is SignalConflict; a wait the run moved past is StaleReference. A due wait instead commits and returns Failed(DeadlineExpired(due)); that status acknowledges expiration, not acceptance of the supplied value.

deliver_json

</>

pub fn deliver_json(
  handle: @internal Handle(Runtime(context, state, answer)),
  reference: SignalReference,
  output_json: String,
) -> Result(Status(answer), Error)

Transport boundary for callers that already hold encoded data. The saved signal’s deployed codec validates the value before it can be consumed. Duplicate acknowledgement compares exact encoded bytes, including JSON whitespace; transports should retain the original payload on retries.

describe_config_error

</>

pub fn describe_config_error(error: ConfigError) -> String

One line naming the problem and the setter that changes it.

describe_config_errors

</>

pub fn describe_config_errors(
  errors: List(ConfigError),
) -> String

One line for every problem build reported, in its order, joined with "; ".

describe_error

</>

pub fn describe_error(error: Error) -> String

One line for logs.

describe_failure

</>

pub fn describe_failure(failure: Failure) -> String

One line for a run’s failure, as a child’s failure reads to its parent.

describe_status

</>

pub fn describe_status(status: Status(answer)) -> String

One line for logs; it names the answer only by its presence.

error_kind

</>

pub fn error_kind(error: Error) -> fabric.ErrorKind

The stable classification of Error, shared with fabric.error_kind.

id

</>

pub fn id(
  handle: @internal Handle(Runtime(context, state, answer)),
) -> run.RunId

map

</>

pub fn map(
  identity: run.DefinitionId,
  child: Runtime(child_context, child_state, child_answer),
  max_members maximum: Int,
  concurrency concurrency: Int,
) -> @internal Operation(
  parent_context,
  List(child_state),
  Result(List(child_answer), fork.Failure),
  operation.Kind,
  operation.Recovery,
  operation.Invocation,
  operation.Error,
)

Run a bounded list of managed children and join native answers in input order. Empty input succeeds; oversized input is refused before any child reservation. Waiting and uncertain members keep their concurrency slots. definition.build refuses bounds below 1 (operation.InvalidLimit(MaxMembers, ..), Concurrency).

matches_initial

</>

pub fn matches_initial(
  handle: @internal Handle(Runtime(context, state, answer)),
  initial: state,
) -> Result(Bool, Error)

Whether this root was started with initial, under this definition. Compares the canonical stored input, not the current state or the correlation of a later request. Useful for idempotent request handlers. The codec runs under the runtime’s callback timeout.

new

</>

pub fn new(
  definition: @internal Definition(
    context,
    state,
    answer,
    definition.Error,
  ),
  store: store.Store,
  context context: fn(run.RunId) -> context,
  policy policy: fn(context, policy.Action) -> Result(
    policy.Decision,
    String,
  ),
) -> Spec(context, state, answer)

Binds definition to store, with the default bounds (see the module documentation); build checks it. context builds the live context of the run it is given, for each admission, recovery and job observation; the admitted body receives that same context (an approved one, the context its answer was checked with). policy gates every operation, as for agents: it sees policy.Activation(..) as the action’s step and policy.RunOperation(..) as its target. Callbacks and operations are bounded separately; pure selection and acceptance must contain no effects.

open

</>

pub fn open(
  runtime: Runtime(context, state, answer),
  id: run.RunId,
) -> Result(
  @internal Handle(Runtime(context, state, answer)),
  Error,
)

Opens the stored run id under runtime: it reads the record and checks that the run can continue under the runtime’s definition (IncompatibleDefinition otherwise). It never takes the run over and starts nothing; recover does.

poll_job

</>

pub fn poll_job(
  handle: @internal Handle(Runtime(context, state, answer)),
  reference: job.Reference,
) -> Result(Status(answer), Error)

Inspect an admitted job wait once. Pending progress leaves its record unchanged; a checked outcome commits its route before successor work starts. Repeating an accepted reference reuses the saved result without another read. After owned cancellation, terminal evidence settles the canceled run without invoking its route. An accepted, refused or uncertain stop may be observed.

reconcile

</>

pub fn reconcile(
  handle: @internal Handle(Runtime(context, state, answer)),
  reference: Reconciliation,
  content: String,
) -> Result(Status(answer), Error)

Supply the actual result of the original operation, encoded with its output codec. This is an explicit application reconciliation, not a repeated body. After cancellation the result is retained without running a route callback. A managed child’s uncertain effect is ReconcileChildFirst.

recover

</>

pub fn recover(
  handle: @internal Handle(Runtime(context, state, answer)),
) -> Result(Status(answer), Error)

A leased store leaves a live foreign owner alone. On an unleased store, callers must know the previous owner is gone before recovering through another store process. Started effects obey their declared replay contract. Idle child waits restore their local wakeup registration and reconnect the child; a missed notification is repaired from its retained outcome. For a canceled subgraph, recovery only records a now-settled child outcome; it never restarts the child or resumes the parent’s routes. A wait or an approval request whose deadline passed expires.

reject

</>

pub fn reject(
  handle: @internal Handle(Runtime(context, state, answer)),
  reference: ApprovalRef,
  proof proof: approvers.Proof,
  reason reason: String,
) -> Result(Status(answer), Error)

Rejects the run’s waiting approval request: the operation does not run and the run fails with Denied(reason). A rejection is not checked again, so it takes no context. It is refused like an approval (see approve), except RequirementChanged. proof is checked and recorded as for approve.

snapshot

</>

pub fn snapshot(
  handle: @internal Handle(Runtime(context, state, answer)),
) -> Result(Snapshot(state, answer), Error)

The run as stored, read through its current definition.

start

</>

pub fn start(
  runtime: Runtime(context, state, answer),
  id id: run.RunId,
  initial initial: state,
  correlation correlation: option.Option(correlation.Correlation),
) -> Result(
  @internal Handle(Runtime(context, state, answer)),
  Error,
)

Starts a root run of runtime under id: stores its first record (a successful return means it was confirmed) and hands its first activation to a runner. Execution proceeds independently; a store draining during start retains unattended work for recovery. id is the caller’s (run.new_id(), or run.id_from_parts of the work that starts it), so that starting again finds the run (AlreadyStarted). A runtime with a family budget (with_family_budget) declares it for this root.

correlation is carried in every event of the run, its child runs included, and in every operation’s Invocation; it is stored with the run. None derives it from the id.

status_kind

</>

pub fn status_kind(status: Status(answer)) -> StatusKind

with_approval_expiry

</>

pub fn with_approval_expiry(
  spec: Spec(context, state, answer),
  expiry: run.Timeout,
) -> Spec(context, state, answer)

How long an approval request this runtime issues waits for an answer; default 7 days, at least 1 ms. Its deadline is stored with the request (by the store’s clock) and shown as Snapshot.deadline. After it the request expires: the run fails with ExpiredApproval, and a late approve or reject is refused with ApprovalExpired. Whoever touches the run next expires it: an answer, await, recover, or on a leased store the sweeper. run.Infinity never expires; requests stored without a deadline never expire.

with_approvers

</>

pub fn with_approvers(
  spec: Spec(context, state, answer),
  approvers: @internal Approvers(credential, approvers.Denial),
) -> Spec(context, state, answer)

Who may answer this runtime’s approval requests: approve and reject take a proof from approvers.check with these approvers, checked for the request’s requirement (see fabric/approvers), and refuse any other. A runtime without approvers refuses every answer (approvers.NoApprovers). A child runtime (as_subgraph, both, map) answers with its own approvers, given to its own spec.

with_callback_timeout

</>

pub fn with_callback_timeout(
  spec: Spec(context, state, answer),
  timeout: duration.Duration,
) -> Spec(context, state, answer)

Bounds one call of the definition’s pure callbacks (context, selection, acceptance, validation); default 1 s, from 1 ms to 2^32 - 1 ms.

with_command_timeout

</>

pub fn with_command_timeout(
  spec: Spec(context, state, answer),
  timeout: duration.Duration,
) -> Spec(context, state, answer)

How long a command (cancel) waits for the run’s live runner to take it; default 1 s, from 1 ms to 2^32 - 1 ms.

with_family_budget

</>

pub fn with_family_budget(
  spec: Spec(context, state, answer),
  limits: budget.Limits,
) -> Spec(context, state, answer)

One budget shared by every root run this runtime starts and all its managed descendants, graphs and agents alike (see fabric/budget), stored with the root. A new attempt spends new work capacity; acknowledging an existing reservation never spends twice. The store must write agent records of version 7 or later (start is then FamilyBudgetUnsupported). build checks the limits: none negative, a depth of at most 63.

with_operation_timeout

</>

pub fn with_operation_timeout(
  spec: Spec(context, state, answer),
  timeout: run.Timeout,
) -> Spec(context, state, answer)

Bounds one admitted activity body; default 60 s, from 1 ms to 2^32 - 1 ms. A body still running then is stopped and its effect is uncertain (Blocked). run.Infinity lets a body run as long as it needs.