Struct AppState 

pub struct AppState {

    pub config: Arc<HarnessConfig>,
    pub store: Arc<dyn StateStore>,
    pub sandbox: Arc<Sandbox>,
    pub bridge: Arc<dyn EventBus>,
    pub sessions: Arc<SessionRegistry>,
    pub worker: WorkerHandle,
    pub identity: Option<Arc<IdentityValidator>>,
    pub exchanged_revocations: Arc<dyn RevocationStore>,
    pub metrics: Arc<Registry>,
    pub client: Client,
    pub finalizer: Finalizer,
    pub draining: Arc<AtomicBool>,
    pub mcp_inflight: Arc<InflightTracker>,
    pub pushed_rates: Arc<RateLimits>,
    pub mcp_admission: Arc<Semaphore>,
    pub backend_router: Arc<BackendRouter>,
    pub pdp: Arc<PolicyDecisionPoint>,
    pub token_signer: Option<Arc<TokenSigner>>,
    pub redaction: Option<Arc<RedactionEngine>>,
    pub mcp_backends: Arc<McpBackendClient>,
    pub authzen: Option<Arc<AuthzenClient>>,
    /* private fields */
}

Shared application state passed through HTTP handlers and background tasks.

Fields

config: Arc<HarnessConfig>

Versioned harness configuration.

store: Arc<dyn StateStore>

Atomic quota and action-budget state.

sandbox: Arc<Sandbox>

MCP schema, policy, and action-budget sandbox.

bridge: Arc<dyn EventBus>

Event Bridge backend used by asynchronous workers and by lifecycle finalization (close/promote publish through it inline).

sessions: Arc<SessionRegistry>

Live session registry.

worker: WorkerHandle

Bounded non-blocking worker queue.

identity: Option<Arc<IdentityValidator>>

Optional NHI validator. Required in production identity mode.

exchanged_revocations: Arc<dyn RevocationStore>

Separate revocation namespace for tokens signed by this gateway.

metrics: Arc<Registry>

Prometheus-compatible metrics registry.

client: Client

Reused upstream HTTP client.

finalizer: Finalizer

Asynchronous session close and promotion service.

draining: Arc<AtomicBool>

Flips to true when shutdown starts. /readyz reads this and reports 503 so a Kubernetes readinessProbe (or any external LB) stops routing new traffic to a draining pod before axum’s graceful drain begins.

mcp_inflight: Arc<InflightTracker>

Tracks in-flight mcp_call_inner detached spawns so finish_shutdown can await their completion between HTTP drain and worker.wait_idle. Without this barrier, a client- disconnected mcp_call running past axum’s graceful drain could reach worker.try_submit AFTER wait_idle returned, stranding a fresh job across finalize_sessions and tripping pv_shutdown_session_close_timeouts_total on an otherwise- recoverable session.

pushed_rates: Arc<RateLimits>

Per-principal token-rate limits pushed from the console (policy_bundle_file); empty until a bundle with rate policies is applied.

mcp_admission: Arc<Semaphore>

Admission semaphore bounding concurrent mcp_call_inner executions to config.mcp_concurrency. R70 F1 (landed R71): without this limit a slow-tool-upstream attack + N concurrent MCP callers each buffering up to MAX_TOOL_RESPONSE_BYTES = 16 MiB in read_limited_tool_response stacked N × 16 MiB unbounded. mcp_inflight above is a shutdown-drain COUNTER — not a limiter. Chat path already has admission via worker.try_reserve_pair; MCP was the odd one out.

Refused admissions increment pv_mcp_admission_refusals_ total (see mcp_call in routes.rs) and respond 503 with a Retry-After header — 503 not 429 because the refusal is a server-side capacity signal (matches breaker-open 503-not- 429 discipline documented in finalize_error_response.rs).

backend_router: Arc<BackendRouter>

Per-backend credential routing (pillar 4). Resolves tool names to their designated backend and attaches the pre-resolved credential.

pdp: Arc<PolicyDecisionPoint>

Local policy decision point (pillar 2). Maps tool names to business intents and enforces mission constraints per call.

token_signer: Option<Arc<TokenSigner>>

Token signer (pillar 3). Signs exchange tokens and intent tokens with EdDSA. Present only when token_exchange_seed_file is configured.

redaction: Option<Arc<RedactionEngine>>

Redaction engine (pillar 5). Strips sensitive data from event payloads and ATIF step text before they are journaled or published.

mcp_backends: Arc<McpBackendClient>

MCP Streamable HTTP client and per-agent-session backend sessions for backends with transport = "mcp".

authzen: Option<Arc<AuthzenClient>>

External AuthZEN policy decision point, when [authzen] is set.

Implementations

impl AppState

pub fn effective_budget(&self) -> BudgetSpec

The per-session budget in force: the local [budget] tightened by any console-pushed budget policy (stricter wins on every dimension, so a pushed bundle can never loosen the host config).

pub fn new( config: HarnessConfig, store: Arc<dyn StateStore>, sandbox: Arc<Sandbox>, bridge: Arc<dyn EventBus>, identity: Option<Arc<IdentityValidator>>, signer: Arc<dyn Signer>, ) -> Result<Self, PipelineError>

Build fully wired application state with a bounded worker and shared lifecycle services.

pub fn new_with_embedder( config: HarnessConfig, store: Arc<dyn StateStore>, sandbox: Arc<Sandbox>, bridge: Arc<dyn EventBus>, identity: Option<Arc<IdentityValidator>>, signer: Arc<dyn Signer>, embedder: Arc<dyn Embedder>, ) -> Result<Self, PipelineError>

Build application state with an explicit embedding backend.

pub fn new_with_backends( config: HarnessConfig, store: Arc<dyn StateStore>, sandbox: Arc<Sandbox>, bridge: Arc<dyn EventBus>, identity: Option<Arc<IdentityValidator>>, signer: Arc<dyn Signer>, embedder: Arc<dyn Embedder>, vector_sink: Arc<dyn VectorSink>, ) -> Result<Self, PipelineError>

Build application state with explicit embedding and vector backends.

pub fn new_with_backends_and_metrics( config: HarnessConfig, store: Arc<dyn StateStore>, sandbox: Arc<Sandbox>, bridge: Arc<dyn EventBus>, identity: Option<Arc<IdentityValidator>>, signer: Arc<dyn Signer>, embedder: Arc<dyn Embedder>, vector_sink: Arc<dyn VectorSink>, metrics: Arc<Registry>, ) -> Result<Self, PipelineError>

Build application state reusing a pre-existing metrics registry.

main.rs uses this so counters registered outside AppState (JWKS refresh errors, HTTP shutdown drain timeouts) live on the same registry that gets scraped at /metrics — otherwise their samples would be invisible to Prometheus.

pub fn set_content_sink(&self, sink: Arc<dyn ContentSink>) -> Result<()>

Install the sink that receives every journaled step in content form (used by proofvisord for full-content tenant telemetry).

The sink runs on its own thread behind a bounded queue, so it can neither slow down nor fail the audit worker.

pub fn prepare_chat( &self, headers: &HeaderMap, payload: Value, identity_hint: Option<AgentIdentity>, ) -> Result<PreparedRequest, PipelineError>

Run identity, breaker, quota, sanitize, compression, and asynchronous dispatch in the mandated order without awaiting worker or upstream I/O.

identity_hint, when Some, is trusted as the resolved identity for this request — the internal resolve_identity + audit-enqueue step is skipped. Used by chat_completions (R72 F3 pre-admission gate) which already resolved the identity to fail-fast on unauthenticated probes before the body parses. Without this hint, the R72 pre-check path would enqueue_transient_failure on a JWKS-rotation race (pre-check success + re-check failure between the two calls), double-counting pv_identity_rejections_total and burning two of the sampled full-audit slots per rejected request (R73 review F3). None preserves the historical behaviour for callers that do NOT pre-resolve.

pub async fn prepare_chat_nonblocking( &self, headers: &HeaderMap, payload: Value, body_bytes: usize, identity_hint: Option<AgentIdentity>, ) -> Result<PreparedRequest, PipelineError>

Run synchronous local gates without waiting for off-path journal, embedding, or broker work.

The inline/blocking decision keys off PAYLOAD SIZE, not off whether a token budget happens to be configured. The cost of prepare_chat (parse-adjacent token scanning, sanitize, compression) is a function of body size — measured 1.9 ms p50 of uninterruptible CPU at a 128 KB body, which stalls every in-flight SSE stream’s poll on that tokio worker. Previously a configured budget.max_tokens (the one thing that makes quotas work) was what moved the work to spawn_blocking, which was backwards. Small bodies stay inline (spawn_blocking costs ~10-20 µs of handoff — 2× the total gate cost at 75 B).

The budget.max_tokens.is_none() clause below is load-bearing, not a leftover: with a budget configured, prepare_chat calls ActionBudget::try_tokens → StateStore::try_spend, which on the redis backend is a synchronous network round-trip — that must never run inline on a tokio worker, whatever the body size. The same applies to [principal_budget]: it drives its own for_principal(...).try_tokens store round-trip in prepare_chat even when the session max_tokens is unset, so it must equally force the blocking pool. Async wrapper over Self::prepare_chat that spawn-blocks on bodies large enough to stall the reactor. See prepare_chat for the identity_hint contract.

pub async fn prepare_chat_durable( &self, headers: &HeaderMap, payload: Value, ) -> Result<PreparedRequest, PipelineError>

Prepare a request and wait until its audit record is durably captured before the provider can observe it.

pub async fn forward_chat( &self, request: PreparedRequest, ) -> Result<ForwardedResponse, PipelineError>

Forward a prepared OpenAI-compatible request to the configured provider.

For the openai dialect the compressed payload is sent as is to upstream_url + upstream_chat_path and the response is relayed unchanged. For anthropic and gemini the payload is translated into the native request first (n choices become n concurrent Anthropic requests, or Gemini’s candidateCount), and the native response is translated back into the OpenAI shape before the relay sees it, so capture and accounting run one parser.

pub fn intercept_tool( &self, headers: &HeaderMap, raw: &[u8], ) -> Result<ToolVerdict, PipelineError>

Intercept one MCP JSON-RPC tool call, emit its OCSF verdict asynchronously, and return the immediate authorization decision.

pub async fn intercept_tool_durable( &self, headers: &HeaderMap, raw: &[u8], ) -> Result<ToolVerdict, PipelineError>

Authorize a tool call and wait for its verdict event to become durable.

pub async fn intercept_tool_nonblocking( &self, headers: &HeaderMap, raw: &[u8], ) -> Result<ToolVerdict, PipelineError>

Authorize a tool call on the blocking pool without waiting for the off-path event journal or broker publication.

Trait Implementations

impl Clone for AppState

fn clone(&self) -> AppState

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.