pipeline

Module: pipeline

Contents

Structs

• CompositeActionResult - Per-action result produced by composite enforcement.
• CompositeEnforcement - Ordered child results plus the atomic transport disposition.
• EnforcementPipeline - The enforcement pipeline. Orchestrates the full enforce() flow:
• PipelineArgs - Construction arguments for [EnforcementPipeline].

Enums

• CompositeDisposition - Aggregate dispatch outcome for one composite transport request.

---

firma_sidecar::pipeline::CompositeActionResult

Struct

Per-action result produced by composite enforcement.

Fields:

• decision: EnforcementDecision - The child’s complete enforcement decision.
• audit_payload: crate::audit::AuditPayload - The child’s logical audit payload.

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result

firma_sidecar::pipeline::CompositeDisposition

Enum

Aggregate dispatch outcome for one composite transport request.

Variants:

• Dispatch{ transport: Option<(Box<firma_core::ExecutionEnvelope>, firma_core::InjectedCredentials)>, monitor_override: bool } - Dispatch the original transport request exactly once.
• Block{ blocker_index: usize } - Do not dispatch; derive the client response from this ordered child.

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result

firma_sidecar::pipeline::CompositeEnforcement

Struct

Ordered child results plus the atomic transport disposition.

Fields:

• children: Vec<CompositeActionResult> - One result per decoded logical action, in input order.
• disposition: CompositeDisposition - Aggregate dispatch or block decision.

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result

firma_sidecar::pipeline::EnforcementPipeline

Struct

The enforcement pipeline. Orchestrates the full enforce() flow:

normalize → Stage 1 → Stage 2 → credential injection → assemble envelope

Short-circuits on any DENY or PASSTHROUGH. Every code path returns ALLOW, DENY, ABORT, or PASSTHROUGH. The pipeline is stateless per-request — all shared state is accessed via references injected at construction time.

Target: < 3ms p95 end-to-end overhead.

Methods:

• fn new(args: PipelineArgs) -> Self - Construct the pipeline from [PipelineArgs]. Called once at
• fn with_mode(self: Self, mode: SidecarMode) -> Self - Set the enforcement mode. Use [SidecarMode::Monitor] for observe-only
• fn with_stage2_timeout(self: Self, stage2_timeout: Duration) -> Self - Bound Stage 2 evaluation by a timeout.
• fn enforce(self: &Self, request: &RawRequest, session_id: &str) -> (EnforcementDecision, AuditPayload) - Run the full enforcement pipeline.
• fn enforce_composite(self: &Self, request: &RawRequest, session_id: &str, actions: &[ComposioAction]) -> CompositeEnforcement - Evaluate ordered logical Composio actions and derive one atomic

firma_sidecar::pipeline::PipelineArgs

Struct

Construction arguments for [EnforcementPipeline].

Bundles every component the pipeline needs so the constructor stays readable as new stages (e.g. credential injection) are added.

Fields:

• normalizer: IntentNormalizer - Intent normalizer (raw request → canonical envelope).
• capability_validator: CapabilityValidator - Stage 1: token selection, parse, verify, expiry, revocation.
• constraint_enforcer: ConstraintEnforcer - Stage 2: scope check, bundle freshness, Cedar policy eval.
• credential_injector: Box<dyn CredentialInjector> - Credential injector called after Stage 2 ALLOW.
• session_state_store: std::sync::Arc<dyn SessionStateStore> - Per-session runtime state store — holds action count and risk score