- Rust 100%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
b92c63149c
The replay store is the connector's one durable ledger. begin reserves the request's worst case in the Active record it claims the request with, in one write: a ledger that cannot be written means nothing runs. complete settles the reservation to the charge derived from the outcome's usage under the service's price table; a backend reports usage only, never cost, and a receipt carrying any other cost is answered with the Provider stand-in at the whole reservation. Amounts are integer micro-USD, prices micro-USD per million tokens, rounded up once per request. Refusals: CostBound (the worst case exceeds the invocation's max_cost_micro_usd, decided before the replay lookup) and SpendCeiling (the caller's window cannot hold the reservation, after the replay lookup). Each caller's config carries a spend ceiling and window length, both required nonzero; windows are fixed and aligned to the unix epoch, and a request belongs to the window it was admitted in. The per-window spend is re-derived from the records at open. gamecult.model.replay_record.v1 is replaced by v2 (no reader survives). The published invocation, receipt and result schemas and their wire goldens are regenerated; provider_request and input_reasoning_state stay byte-identical. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> |
||
| crates/model-connector | ||
| schemas | ||
| .gitattributes | ||
| .gitignore | ||
| Cargo.lock | ||
| Cargo.toml | ||
| LICENSE | ||
| README.md | ||
ModelConnector
The connector kit for GameCult minds: one typed, encrypted, replay-safe contract between a caller that needs a model turn and a daemon that holds the provider credential, so no project wires its own provider calls.
Status: the model-connector crate is live. No connector binary exists yet
(the Claude connector is first, then an OpenAI-compatible one).
Entry points
Crate crates/model-connector:
src/contract.rs- the v3 wire contract (gamecult.model.*.v3):ProviderRequest,TransportInvocation,TransportResult,TransportReceipt, the typedStopReason,FailureKindandRefusal,InputItem::ReasoningState(a provider's opaque reasoning block, replayed by callers verbatim viaTransportResult::transcript_items; the service refuses another provider's state in the in-flight tool exchange and drops it from earlier turns), and the canonical byte and digest functions that bind a result to its request. Every document is named MessagePack with unknown fields refused.src/envelope.rs- the AES-256-GCMTransportEnvelope(binary ciphertext), its identity-binding AAD, the length-prefixed framing, and the CultNet carriage: each frame is acultnet.operation_request.v0/operation_response.v0for servicegamecult.model.connector, operationinvoke, itsmessage_idthe request id and its payload the base64 of the sealed envelope.schemas/- one JSON Schema per v3 document, generated from the types.src/client.rs-ConnectorClient, the one-request caller side.src/service.rs(featuredaemon) -TransportService: caller admission, durable replay (a retried request is answered byte-identically and the provider runs once), in-flight and capacity refusals.src/serve.rs(featuredaemon) -serve(), the loopback accept loop, over theProviderBackendtrait. A connector binary implementsProviderBackendfor its provider and callsserve; the kit names no provider.
Frame arithmetic is public in src/envelope.rs, measured on the carriage frame: frame_bytes_for_payload(n) is the frame a
caller payload bound of n needs, payload_bytes_for_frame(frame) is the largest payload bound
a frame allows, and MAX_IDENTITY_BYTES (256) bounds caller ids, request ids and model names.
serve refuses a frame/payload pair that violates them (ServeError::FrameBound states the frame
needed); the smallest legal frame is frame_bytes_for_payload(MIN_PAYLOAD_BYTES). A request id past
the bound is refused on the wire as Refusal::Malformed, the reply echoing the id (the connection is dropped only if that reply cannot fit the frame); ConnectorClient refuses such an id locally with RequestIdTooLong.
The default feature set compiles contract, envelope and client only. The kit speaks v3 only: a v2 frame gets no answer.
Verify
cargo test --locked --workspace
cargo test --locked --workspace --features model-connector/daemon
crates/model-connector/tests/wire_golden_v3.rs pins the v3 documents and one sealed carriage
frame to the fixtures in crates/model-connector/tests/fixtures/wire_v3 (regenerate with
WIRE_V3_REGENERATE=1; see the fixtures' README), and
crates/model-connector/tests/published_schemas.rs fails when schemas/ differs from the types
(MODEL_CONNECTOR_REGENERATE_SCHEMAS=1 rewrites it).
Provenance and license
AGPL-3.0-only. See LICENSE.
The contract, envelope, client, replay service and serve loop were lifted from CodexConnector at fd7cec4, formerly PolyForm Noncommercial. Its sole copyright holder relicensed the lifted material as AGPL-3.0-only for this repository.