Module toolloop 

The SRBN tool loop (PSP-9 system 6) — Paper II Appendix A Algorithm 1 with tool calls substituted for bundle generation.

Every model-issued tool call becomes a Paper III proposal; the deterministic admissibility kernel decides whether it may affect the candidate; the gate is evaluated on the re-measured candidate, never on the model’s account of it (Paper I Definition 12.2); and every descent and rejection consumes the stated budget (Paper II Lemma 1).

The loop is written against dyn ModelTransport and cannot name a vendor type or credential — that is Gate S. Executor and measurer are ports too, so the whole loop runs in tests against scripted fixtures without a network.

Re-exports

pub use envelope::decode_tool_loop;

pub use envelope::DecodedLoopEvent;

Modules

envelope

Typed decoding of tool_loop ledger payloads (PSP-10 Gate AD).

Structs

CandidateCheckpoint

Opaque executor checkpoint plus its measured state witness.

DurableSeedFile

Content-addressed form persisted in a durable candidate checkpoint.

EffectOutcome

What applying one admitted call did to the candidate overlay.

EventLog

In-loop event log. With a durable recorder attached every event is already persisted before use, so only a rolling count and chain root are kept in memory; without one (conformance fixtures) the events are retained so tests can inspect them. This keeps long runs O(1) in event memory and makes each compaction O(1) instead of re-serializing the whole history.

LoopBudgets

The loop’s finite budgets (PSP-9 system 6).

LoopEventEnvelopeV1

The versioned runtime-event envelope (PSP-10 system 21, Gate AD). Every post-cutover tool_loop row wraps its event in exactly this shape; rows without schema_version decode through the strict legacy decoder; unknown versions fail authoritative replay and resume closed.

LoopOutcome

The loop’s terminal report.

Measured

One measured evaluation of the realized candidate.

PromptEnvelope

The compiled prompt binding for one actor (PSP-10 systems 23–24). The runtime compiles it through the SDK compiler for the resolved route and dialect; the loop seeds the text, stamps the digests into every control frame, and — holding the stage — recompiles whenever the offered tool surface or the failover route changes mid-loop, so each call’s exact program is ledgered.

ResidentReserves

The worker’s per-call context reserves, from [context].

SeedFile

One exported file of an accepted candidate. content is the accepted overlay state (None = deleted); source_preimage is the workspace state from which the first mutation was derived. Resume must preserve both so a later promotion cannot overwrite user edits made while the session slept.

ToolLoop

The assembled tool loop for one node generation.

Enums

LoopEvent

Recorded loop events (the ledger consumes these in system 14).

Traits

CandidateMeasurer

Re-reads the candidate overlay and runs the declared verifier suite against it (Paper I Def. 12.2: measurement runs on the realized state).

EffectExecutor

Applies admitted calls to the candidate overlay (the existing sandboxed executors are the first driver).

LoopRecorder

Synchronous write-ahead event sink. Implementations must durably append before returning; the loop records observations before inspecting them.

Functions

candidate_mutating_effect

The one definition of “this effect mutates the candidate overlay”, shared by the loop’s accounting and the executor’s journal so they cannot drift.

loop_decision_bound

The finite decision bound the loop must respect. Computed once at node entry from the measured baseline; the loop refuses the (N_gate + 1)-th gate submission and terminates through the exhaustion path (Gate X).