Decrypt reverses Encrypt: it expects nonce(12) || ciphertext+tag.

Decrypt unwraps versioned KMS envelope. Metadata can choose only validated key identity under configured provider; it can never choose host or token.

Evidence ranks task-specific paths from an already-built repository map. It remains deterministic and performs no filesystem, network, or model work.

List returns every catalog entry so callers can serve the real, complete model catalog — provider/model/capabilities — instead of a hardcoded subset.

Lookup returns the Info for a class. The second return is false for an unknown class — callers fail closed (treat an unknown class as unsafe to run).

NewHTML returns the default HTML article extractor.

NewInsertClient returns an *http.Client bounded for ClickHouse inserts.

Open opens (creating if needed) a cavemem store.

Price returns the catalog pricing for an exact provider+model pair along with the catalog version (the entry's verified_at date). When a model is not

PriceForRegion returns only an exact provider+model+region catalog row. It is the runtime billing lookup for region-sensitive Bedrock and Vertex calls

Drop a reservation whose call never reached the provider.

--- Page geometry derived from a render profile --------------------------- A page is drawn as: rows advance by PitchY with an 8px-tall glyph, so the

The session ledger is the accounting the harm tripwire reads, and the freeze registry every lever consults. Its contract: bounded, session-scoped, one

jsonStr quotes s as a JSON string literal for embedding in a request line.

Budget available to a new reservation right now.

--- fixtures --------------------------------------------------------------- retroLogPayload builds a repetitive tool-result body the engine can actua

retroRepeatedBlock is one paragraph heavy enough to clear minBlockTokens.

C8 review finding 5: this optimizer adds a client-visible SSE chunk to the response (an observable effect outside what byte-safe promises), so like re

AppendObjectFields inserts fields immediately before an object's closing brace. Existing bytes, whitespace, key order, and escapes remain untouched. C

CanonicalDetail returns the deterministic JSON encoding of a detail blob: keys sorted (Go's encoding/json sorts map keys recursively), whitespace stri

DecodeTOON parses the supported TOON subset back into the JSON data model.

Encrypt delegates encryption to key manager.

HasDirectEvidence reports whether the bundle earned the right to be shown to a model: at least one ranked item matched a task term in its own path or

IsRecoveryToolName reports whether a tool call is a caveman recovery call. It exists so every adapter agrees on one definition. A tool_result produce

New constructs the Bedrock adapter. baseURL is the bedrock-runtime endpoint; in production it is the regional endpoint (https://bedrock-runtime.<regio

NewAXTree returns the forced-only CDP Accessibility.getFullAXTree compressor. It emits a compact, deterministic indented view with uid handles while C

NewConfig returns the deterministic YAML, TOML, and INI compressor.

NewEngineCompressor builds the engine-backed compressor over a CCR store. The engine shares that store, so a handle returned by StoreOriginal resolves

NewTerminal returns the default terminal/command-output compressor.

NewUsageScanner returns a sink that the proxy tees the upstream response through. It captures usage from both whole-body (non-stream) and SSE/JSONL (s

ParsePoolConfig validates the connection string and applies the managed database CA to every TLS path. Production rejects sslmode=require because it e

ProjectAnthropic projects a Messages request onto the provider's current count_tokens input surface. Every proven count field is copied as its raw JSO

RenderTextToTwoLayerPNGs splits wrapped text into max-level overlay pages. Each image holds up to 2×N lines: the first N in the red layer, the next N

SafetyClass is the compressor's inherent class on the S0–S4 ladder.

Shrink compresses a tool catalog with an S4 lossy transform. It is fail-open: on any parse problem or when the result would not be smaller, it returns

StripToolSchemaAnnotations removes the annotationDropKeys keywords from a serialized tool catalog (the provider `tools` array) and returns ok=false wi

Supersede atomically replaces one current memory with a new current version. The old row remains durable for history and byte-exact audit, but normal

ToolRawText wraps a raw string (e.g. recovered original bytes) as text content.

ToolText wraps a value as a single JSON text content item (the agent receives JSON it can parse).

ValidateHost resolves host (bare hostname or IP literal) and checks all resolved addresses. Use when you have a host/port pair rather than a full URL

A real finite number, or None. ``bool`` is not a number (it is an ``int`` subclass in Python, and a guard must never compare True against 1).

Build a provider request with stable/session content above volatile. Pure client-side: no account and no network call. The hash ledger is

callRetrieveTool drives the caveman_retrieve tool exactly as the MCP server does: through the handler EngineTools built, with its session attached.

charBudget is the per-image character capacity of a full canvas page at this profile (rows × cols × layers). Page capacity — not the fixed std budget