state

Module: enforcement::session::state

Contents

Structs

• ActionOutcome - One entry in the bounded prior-action history.
• LruSessionStateStore - In-memory LRU-capped SessionStateStore for V1. Single-process only.
• RuntimeSignals - Runtime signals sourced from the session store and passed into

Enums

• Outcome - Categorical outcome of an evaluated action, recorded into a session’s

Traits

• SessionStateStore - Per-session runtime state used by Stage 2.

---

firma_sidecar::enforcement::session::state::ActionOutcome

Struct

One entry in the bounded prior-action history.

Traits: Eq

Trait Implementations:

• PartialEq
  • fn eq(self: &Self, other: &ActionOutcome) -> bool
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Clone
  • fn clone(self: &Self) -> ActionOutcome

firma_sidecar::enforcement::session::state::LruSessionStateStore

Struct

In-memory LRU-capped SessionStateStore for V1. Single-process only.

Methods:

• fn new(capacity: usize) -> Self - Construct with an explicit capacity (minimum 1).

Trait Implementations:

• Default
  • fn default() -> Self
• SessionStateStore
  • fn record_action(self: &Self, session_id: &SessionId) -> u64
  • fn signals(self: &Self, session_id: &SessionId) -> RuntimeSignals
  • fn record_outcome(self: &Self, session_id: &SessionId, action_class: &str, resource: &str, outcome: Outcome)
  • fn advance_provenance(self: &Self, session_id: &SessionId, context_hash: &str, action_class: &str, resource: &str) -> String

firma_sidecar::enforcement::session::state::Outcome

Enum

Categorical outcome of an evaluated action, recorded into a session’s prior-action history so later decisions can observe what the agent has already done (AARM R2 G3).

Variants:

• Allow - Request authorized and dispatched.
• Modify - Request authorized with a modification applied before dispatch.
• Deny - Request denied by policy or scope check.
• StepUp - Request blocked pending human approval / stronger auth.
• Defer - Request deferred pending additional context.
• Abort - Request was authorized then aborted (e.g. credential injection failed).

Traits: Eq, Copy

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• PartialEq
  • fn eq(self: &Self, other: &Outcome) -> bool
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>
• Clone
  • fn clone(self: &Self) -> Outcome
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>

firma_sidecar::enforcement::session::state::RuntimeSignals

Struct

Runtime signals sourced from the session store and passed into Stage 2 for Cedar context construction.

Built by the pipeline on every admitted request, used by ConstraintEnforcer::build_context() and then reused to populate the outgoing ExecutionMetadata so audit and enforcement see the same numbers. Carries the bounded prior-action history so policies can reason about what the session has already attempted.

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> RuntimeSignals
• PartialEq
  • fn eq(self: &Self, other: &RuntimeSignals) -> bool
• Default
  • fn default() -> RuntimeSignals
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result

firma_sidecar::enforcement::session::state::SessionStateStore

Trait

Per-session runtime state used by Stage 2.

Implementations must be Send + Sync — the pipeline holds them in an Arc and every request reads/writes through a shared reference.

Methods:

• record_action: Record an admitted call for session_id and return the new
• signals: Read the current signals for session_id. Returns defaults
• record_outcome: Record the outcome of the just-evaluated action into the
• advance_provenance: Advance the session’s tamper-evident provenance chain (AARM R2 G2)