Struct WebizenHostApi 

pub struct WebizenHostApi { /* private fields */ }

Transport-neutral Host API exported for UI and qApps.

Implementations

impl WebizenHostApi

pub fn set_temporal_slice(&self, t_value: f64) -> Result<(), String>

Set temporal slice for time-travel navigation (P3).

pub fn get_temporal_slice(&self) -> u64

Current temporal scrub position (unix seconds).

pub fn list_canvas_worlds(&self) -> Result<Vec<Value>, String>

List all saved canvas world configurations.

pub fn get_canvas_world(&self, world_id: &str) -> Result<Value, String>

Load one world config by id.

pub fn save_canvas_world(&self, config_json: &str) -> Result<(), String>

Save (upsert) a world configuration.

pub fn delete_canvas_world(&self, world_id: &str) -> Result<bool, String>

Remove a world by id.

pub fn seed_canvas_demo(&self) -> Result<bool, String>

Seed the P0 demo world if the store is empty.

pub fn seed_flagship_worlds(&self) -> Result<u32, String>

Seed P8 flagship canvas worlds (history, biosphere, council, SDG, GLAM) when absent.

pub fn set_active_canvas_world(&self, world_id: &str) -> Result<(), String>

Set the active world for Chora navigation.

pub fn canvas_navigation_state(&self) -> Value

Active world id + temporal scrub state.

pub fn query_canvas_region( &self, x1: f64, y1: f64, x2: f64, y2: f64, ) -> Result<Vec<Value>, String>

Query assets visible in a bbox at the current temporal slice (P4 entry).

pub fn request_asset_stream(&self, asset_id: &str) -> Result<Vec<u8>, String>

Request asset bytes by content hash, local path, or urn (Phase 6).

• 64-char hex hash → content-addressed blob store lookup
• local://… or filesystem path → read from storage root
• urn:… → not yet implemented (honest error, no fabricated bytes)

pub fn get_render_surface(&self) -> Result<String, String>

Expose a WebGPU/canvas proxy surface configuration to the qapp context (Phase 6).

pub fn publish_planted_asset(&self, asset: PlantedAsset) -> Result<(), String>

Publish a planted asset to the spatial sync protocol (Phase 7)

pub fn pull_spatial_assets( &self, cell_id: u64, ) -> Result<Vec<PlantedAsset>, String>

Pull and merge planted assets for a specific spatial cell (Phase 7)

pub fn sync_cell(&self, cell_id: u64) -> Result<String, String>

Pull spatial assets for a cell and return merged state as JSON (Phase 7).

impl WebizenHostApi

pub fn ledger_append( &self, kind: &str, payload_json: &str, ) -> Result<LedgerEntry, String>

Append a raw record to the person’s tamper-evident accountability ledger, signed by the owner key.

pub fn ledger_verify(&self) -> Result<Option<LedgerTamper>, String>

Verify the whole ledger chain. Ok(None) = intact; Ok(Some(tamper)) = a detected, named tamper.

pub fn ledger_entries(&self, limit: usize) -> Result<Vec<LedgerEntry>, String>

The most-recent ledger entries (newest first), capped to limit.

pub fn grant_consent_credential( &self, agent_did: &str, scope: &str, purpose: &str, commitment_hex: &str, wrapped_key_hex: &str, expiry_unix: Option<u64>, ) -> Result<ConsentCredential, String>

Grant a consent credential to an agent (e.g. a social worker) over a committed payload. The subject is the vault owner. commitment_hex is the 32-byte payload commitment; wrapped_key_hex is the (opaque) wrapped data key that revocation destroys; expiry_unix optionally auto-expires access.

pub fn revoke_consent_credential( &self, credential_id: &str, ) -> Result<bool, String>

Revoke a consent credential — crypto-enforced (the wrapped key is destroyed). Returns whether a live credential was revoked. The conduct trail under it persists.

pub fn list_consent_credentials(&self) -> Result<Vec<ConsentCredential>, String>

All stored consent credentials (active and revoked — revoked rows remain as the audit anchor).

pub fn record_conduct( &self, agent_did: &str, credential_id: &str, action: &str, reason: &str, commitment_hex: &str, ) -> Result<ConductRecord, String>

Record an agent’s conduct under a credential — signed (attributable + court-auditable) — into the durable trail and the tamper-evident ledger. Binds to the payload commitment, not the payload.

pub fn conduct_audit_trail( &self, credential_id: &str, ) -> Result<Vec<ConductRecord>, String>

The audit view — every conduct record taken under one credential (survives its revocation).

pub fn record_guardian_notifications( &self, notifications: &[GuardianNotification], ) -> Result<(), String>

Record guardian notifications from a flagged ingest into the tamper-evident ledger — so a flagged ingest under a guardianship relation is both a notification to the guardian AND an auditable, un-erasable event (who was notified, about what, when). Composes the hypermedia flags → guardian layer (super::super::ingest_guardian) with the accountability ledger.

impl WebizenHostApi

pub fn body_assets_status( &self, model: &str, ) -> Result<BodyAssetsStatus, String>

Whether the body assets for a model are cached + complete (manifest exists + every referenced .10d is on disk). model is "male" / "female" (case-insensitive).

pub fn cached_organ_keys(&self, model: &str) -> Result<Vec<String>, String>

The cached organ keys for a model (empty if not cached).

pub fn load_cached_organ_10d( &self, model: &str, organ_key: &str, ) -> Result<Vec<u8>, String>

Load a cached .10d for one organ. Returns the raw container bytes (for the browser portal’s load_10d_colored).

pub fn cached_body_organ_percepts( &self, model: &str, ) -> Result<(Vec<OrganPercept>, Vec<String>), String>

The per-organ dual-modality percepts for the cached organ set — so the browser portal knows what colour to paint each organ (σ → RGBA via paint_organs). Returns (painted, unmapped).

pub fn get_body_constitution(&self) -> BodyConstitution

The person’s declared constitution, or an empty one if they have not authored it.

pub fn body_constitution_is_declared(&self) -> bool

pub fn set_body_constitution( &self, body: &BodyConstitution, ) -> Result<(), String>

pub fn reset_body_constitution(&self) -> Result<(), String>

pub fn body_fit(&self) -> BodyFit

View transform for the current constitution + physiological state.

pub fn clear_body_cache(&self, model: &str) -> Result<(), String>

Clear the cache for a model (idempotent). The person can re-acquire later.

pub fn compute_scorecard( &self, convergence_threshold: usize, ) -> Result<WellbeingScorecardReport, String>

The accumulative, traceable score-card + investigable hypotheses over the person’s own records — the reading they can act on. Forum-internum / Sanctuary-class selfhood content; a set of hypotheses and pathway-starts, never a diagnosis, never a rating. The card is computed at the person’s declared physiological state (their point on the reproductive continuum), or [PhysiologicalState::Baseline] if they have not declared one.

pub fn get_weight_model(&self) -> WeightModel

The person’s own score-card weight model — the interpretive lens the card uses — or the seed suggestion if they have not authored one. Theirs to see, edit, or reset; the software offers a starting point, it does not define how they are read.

pub fn seed_weight_model(&self) -> WeightModel

The seed suggestion on its own — so a UI can show “this is the starting point; here’s yours” and let the person compare / adopt / edit.

pub fn weight_model_is_authored(&self) -> bool

Whether the person has authored their own model (vs. still using the seed suggestion).

pub fn set_weight_model(&self, model: &WeightModel) -> Result<(), String>

Set the person’s own weight model — their authorship of how the score-card reads them.

pub fn reset_weight_model(&self) -> Result<(), String>

Reset to the seed suggestion (clears the person’s authored model — a choice, always reversible by re-authoring).

pub fn get_physiological_state(&self) -> PhysiologicalState

The person’s declared physiological state, or [PhysiologicalState::Baseline] if they have not declared one. Their own statement; the software never assumes.

pub fn physiological_state_is_declared(&self) -> bool

Whether the person has declared their physiological state (vs. still at the implicit baseline).

pub fn set_physiological_state( &self, state: &PhysiologicalState, ) -> Result<(), String>

Set the person’s declared physiological state — their own statement of where they are on the reproductive continuum. Forum-internum / Sanctuary-class.

pub fn reset_physiological_state(&self) -> Result<(), String>

Clear the declared state — revert to the implicit [PhysiologicalState::Baseline]. Idempotent.

impl WebizenHostApi

pub fn new( vault: VaultService, policy: PolicyDecisionService, signing_key: SigningKey, owner_did: String, author_did: String, storage_root: PathBuf, ) -> Self

pub fn save_accessibility( &self, prefs: &AccessibilityPreferences, ) -> Result<(), String>

pub fn load_accessibility(&self) -> AccessibilityPreferences

pub fn snapshot_from_vault( key_vault: &KeyVault, owner_label: &str, demo_mode: bool, ) -> WellfairHostSnapshot

pub fn build_snapshot( &mut self, key_vault: &KeyVault, owner_label: &str, ) -> WellfairHostSnapshot

pub fn fetch_10d_asset_on_demand( &self, _asset_uri: &str, ) -> Result<Vec<u8>, String>

Fetches a .10d asset on-demand instead of loading all assets upfront.

pub fn storage_root(&self) -> &Path

The on-disk storage root for this host (where the asset cache + prefs live). Exposed so the desktop can run blocking acquisition off the async runtime without holding the host lock.

pub fn owner_did_hash(&self) -> u64

Stable hash used by local graph evaluators without exposing the person’s DID.

pub fn evaluate_policy( &self, qapp_id: &str, requested_scope: &str, sensitivity: SensitivityClass, epistemic: EpistemicStatus, ) -> Result<PolicyDecisionDto, String>

pub fn grant_consent( &mut self, draft: &ConsentGrantDraft, scope: &str, ) -> Result<ConsentGrantRecord, String>

pub fn revoke_consent(&mut self, grant_id: &str) -> Result<bool, String>

pub fn list_consents(&self) -> Result<Vec<ConsentGrantRecord>, String>

pub fn submit_record( &mut self, qapp_id: &str, envelope: RecordEnvelope, source: &str, ) -> Result<usize, String>

pub fn submit_record_with_summary( &mut self, qapp_id: &str, envelope: RecordEnvelope, source: &str, summary: Option<String>, ) -> Result<usize, String>

pub fn submit_record_guarded( &mut self, qapp_id: &str, envelope: RecordEnvelope, source: &str, summary: Option<String>, ) -> Result<SubmitOutcome, String>

Policy-gated write that surfaces the guardian-escrow outcome instead of collapsing it to an error. A proxy write of a protected (Restricted) record does not commit immediately — it is held in a [GuardianshipProposal] pending M-of-N guardian co-signature (see Self::vote_guardianship_proposal). Non-proxy writes commit exactly as before.

pub fn finalize_batch(&mut self) -> Result<String, String>

pub fn list_health_records( &self, limit: usize, ) -> Result<Vec<JournalEntry>, String>

pub fn list_receipts(&self, limit: usize) -> Result<Vec<ReceiptRecord>, String>

pub fn list_outbox(&self, limit: usize) -> Result<Vec<SyncOutboxEntry>, String>

pub fn export_health_package( &mut self, limit: usize, ) -> Result<(HealthExportPackage, ExportReceipt), String>

Standards-readable Turtle export bound to the latest checkpoint (§8.1 step 9).

pub fn query_graph_coverage( &self, limit: usize, ) -> Result<Vec<GraphCoverageRow>, String>

Journal row → materialized quin coverage (bounded semantic query).

Applies the Sanctuary projection: while Sanctuary is locked (including a decoy session) rows for protected kinds are withheld, so the coverage/Tools view is never an alternate read path around the boundary (master plan §5.2, §17).

pub fn add_condition( &mut self, report: &ConditionReport, ) -> Result<JournalEntry, String>

pub fn add_disputed_diagnosis( &mut self, report: &DisputedDiagnosisReport, ) -> Result<JournalEntry, String>

pub fn add_housing_safety( &mut self, report: &HousingSafetyReport, ) -> Result<JournalEntry, String>

pub fn add_allergy( &mut self, report: &AllergyReport, ) -> Result<JournalEntry, String>

pub fn graph_quin_count(&self) -> usize

pub fn import_samsung_health_folder( &mut self, folder: &Path, ) -> SamsungImportReport

pub fn ingest_companion_health_bundle( &mut self, bundle: &CompanionHealthBundle, ) -> SamsungImportReport

Primary ingest path: companion bundle from the user’s phone.

pub fn add_medication( &mut self, name: &str, dose: &str, route: &str, schedule_times: Vec<String>, ) -> Result<JournalEntry, String>

pub fn record_administration( &mut self, medication_id: &str, medication_name: &str, status: AdministrationStatus, notes: Option<String>, ) -> Result<JournalEntry, String>

pub fn add_diet_entry( &mut self, description: &str, meal_type: &str, calories_kcal: Option<u32>, ) -> Result<JournalEntry, String>

pub fn list_journal_by_kind( &self, kind: &str, limit: usize, ) -> Result<Vec<JournalEntry>, String>

pub fn compute_anatomy_view( &self, lens: &str, convergence_threshold: usize, ) -> Result<AnatomyViewReport, String>

3D Anatomy Qapp — compute the whole-person systemic view for a lens ("person" / "clinician"). Reads the person’s condition / medication / diet records, maps them onto body systems via the anatomy knowledge base, and returns the lens narrative + per-system burden + an honest account of what did not map. Read-only; a computed set of hypotheses, never a diagnosis. convergence_threshold is how many distinct adverse factors flag a system.

pub fn compute_body_scene( &self, azimuth_deg: f64, elevation_deg: f64, ) -> Result<RenderScene, String>

3D Anatomy Qapp — build the whole-body render scene (S5.7 interim visual) for the current records + declared physiological state, viewed from (azimuth, elevation) in degrees. Returns a [webizen_render::scene_contract::RenderScene] coloured by accumulated burden (σ → RGBA), ready for the headless render_scene_png pipeline. The orbit camera lets the Studio UI spin the body. Read-only; a computed visual of hypotheses, never a diagnosis.

impl WebizenHostApi

pub fn ingest_document( &self, uri: &str, media_type: &str, text: &str, guardian_did: Option<String>, ) -> Result<Value, String>

Ingest a text document into the library: derive its topics + searchable text, bind them into a hypermedia container, persist it (findable by meaning), and — if guardian_did is set (the principal is under a guardianship relation) and a flag is raised — notify the guardian and record it in the tamper-evident ledger. Returns a summary (topics, flags, any guardian notifications).

pub fn ingest_document_annotated( &self, uri: &str, media_type: &str, text: &str, manual: &ManualFacets, guardian_did: Option<String>, ) -> Result<Value, String>

Ingest a text document with person-authored facets — an optional date (→ timeline), place (→ map), project and purpose the person chooses to attach. The document’s derived topics still come from its content; these facets are added on top (the person authoring meaning, not being defined).

pub fn ingest_bytes( &self, uri: &str, media_type: &str, bytes: &[u8], excerpt_source: &str, manual: &ManualFacets, guardian_did: Option<String>, ) -> Result<Value, String>

Ingest any asset bytes (a document, a photo, an audio clip) into the library. The processor registered for media_type derives searchability — a text doc → topics; a JPEG/PNG → its EXIF capture time (timeline) + GPS place (map); a WAV → duration + dominant frequency — and it all folds into the container so the original is findable by meaning. excerpt_source is a short human string for the results list (the text for a doc; a caption/filename for binary). Guardianship + ledger hook as Self::ingest_document.

pub fn ingest_file_hex( &self, uri: &str, media_type: &str, bytes_hex: &str, caption: &str, guardian_did: Option<String>, ) -> Result<Value, String>

Ingest a photo/audio file from hex-encoded bytes — the boundary form for the desktop, which reads a picked file and passes its bytes as hex (a JPEG is not valid utf-8, so it cannot come through the text path). A photo’s EXIF capture-time + GPS auto-populate the timeline + map. caption is the short display string. Same derive + persist + guardian hook as Self::ingest_bytes.

pub fn search_library( &self, facet: &str, value: &str, ) -> Result<Vec<Value>, String>

Search the library by facet (topic | depicts | place | project | purpose). Returns per-entry summaries (not the raw quins).

pub fn search_library_time( &self, start: i64, end: i64, ) -> Result<Vec<Value>, String>

The timeline query — entries whose event instant falls within [start, end] (unix seconds).

pub fn list_library(&self) -> Result<Vec<Value>, String>

Everything in the library (newest first), as summaries. Optional section filters to secret | wellfair | personal | work | commons.

pub fn list_library_section( &self, section: Option<&str>, ) -> Result<Vec<Value>, String>

pub fn search_library_text(&self, query: &str) -> Result<Vec<Value>, String>

Free-text search over uri / excerpt / topics / projects / place.

pub fn query_library_faceted( &self, filter_json: &str, sort: &str, ) -> Result<Value, String>

Multi-facet library query with sort. filter_json is a FacetFilter object; sort is newest|oldest|title_asc|title_desc|media_type|category.

pub fn library_facet_counts(&self, filter_json: &str) -> Result<Value, String>

Facet value counts for chip UI (optionally narrowed by the same filter JSON).

pub fn seed_studio_qapps_library(&self) -> Result<Value, String>

Seed the early studio academic QApp inventory into Library → Software. Idempotent; returns add/update counts.

pub fn seed_perception_library(&self) -> Result<Value, String>

Seed perception models + ontology catalogue rows into Library → Software. Also ensures seed weight files under {storage}/models/.

pub fn ingest_legislation_pdf_hex( &self, hex_bytes: &str, register_id: Option<&str>, jurisdiction: Option<&str>, title_hint: Option<&str>, ) -> Result<Value, String>

Native legislation ingest (structure parse, no Ollama): PDF bytes → Work shelf entries for the instrument and every Part/Section/Subsection with full body text.

pub fn ingest_legislation_text( &self, text: &str, register_id: Option<&str>, jurisdiction: Option<&str>, title_hint: Option<&str>, ) -> Result<Value, String>

Native legislation ingest from plain text (already extracted PDF text or HTML).

pub fn build_cml_context_graph( &self, uri: &str, title: &str, text: &str, ) -> Result<Value, String>

Build a Rust-native CML context graph for arbitrary text (no Python). Returns concepts, signal tags, N3, and deontic/privacy counts — does not persist.

pub fn build_cof_html_package( &self, uri: &str, title: &str, text: &str, max_chars: Option<usize>, dual_surface: bool, ) -> Result<Value, String>

Build a COF HTML+RDFa package (token-bounded segments) without persisting. max_chars defaults to 24000 when zero/None.

pub fn enrich_library_entry_cml(&self, asset_uri: &str) -> Result<Value, String>

Re-run CML context enrichment on an existing library entry’s excerpt/text fields.

pub fn list_qapp_catalog_categories(&self) -> Result<Value, String>

List catalogue categories (for Software shelf UI without seeding first).

pub fn library_stats(&self) -> Result<Value, String>

Aggregate library stats for the UI header (includes section counts).

pub fn set_library_commons_visibility( &self, asset_uri: &str, visibility: &str, ) -> Result<Value, String>

Set commons / peer visibility (refuses Secret).

pub fn library_commons_share_card( &self, asset_uri: &str, ) -> Result<Value, String>

Build a permissive commons share card for social networking (no secret payloads). Returns metadata peers can list; raw content stays on-device until a fuller mesh transfer.

pub fn remove_library_entry(&self, asset_uri: &str) -> Result<Value, String>

Remove one library entry by asset URI.

pub fn export_library_graph(&self) -> Result<Value, String>

Export the full hypermedia graph mass (quin count + optional dump for inject). Returns { quin_count, entries } — the live graph inject seam for daemon/MCP.

impl WebizenHostApi

pub fn add_agency_delegation( &mut self, delegation: &AgencyDelegation, ) -> Result<JournalEntry, String>

Persist a delegation (create or supersede). Returns the committed journal entry.

pub fn create_agency_delegation( &mut self, principal_did: &str, domain: &str, values_anchor: &str, agent_dids: Vec<String>, precedence: &str, consent: &str, ) -> Result<AgencyDelegation, String>

Build and persist a new delegation from primitive fields (so the Tauri layer needs no cooperative-core types). Validates the domain against the seeded taxonomy; an empty values_anchor defaults to the UN-HR anchor (urn:un:hr:udhr). Returns the created record.

pub fn list_agency_delegations( &self, limit: usize, ) -> Result<Vec<AgencyDelegation>, String>

List the current delegations — latest version per delegation id (updates supersede).

The journal is append-only and lists newest-first, so the first record seen for a given logical delegation id is its latest version (append order == version order). This is robust even when several versions share the same asserted_time_unix second.

pub fn get_agency_delegation( &self, delegation_id: &str, ) -> Result<AgencyDelegation, String>

Fetch a single current delegation by its logical id.

pub fn set_agency_delegation_consent( &mut self, delegation_id: &str, consent: ConsentState, ) -> Result<JournalEntry, String>

Update the principal’s consent state (grant / withdraw) — appends a superseding version.

pub fn revoke_agency_delegation( &mut self, delegation_id: &str, ) -> Result<JournalEntry, String>

Revoke a delegation — appends a superseding, revoked version (revocation is monotonic).

pub fn list_agency_domains(&self) -> Vec<AgencyDomainInfo>

The seeded domains of agency (id + label + description + consequential/selfhood flags), for a delegation-creation picker. Category terms are excluded — only the 17 leaf domains.

pub fn evaluate_agency_access( &self, delegation_id: &str, action: &str, data_class: &str, ) -> Result<AccessDecision, String>

Evaluate the fail-closed ABAC for a delegation against an access request built from the delegation’s own domain. action is "read" | "write" | "decide". Uses a bare trigger context (now only) — trigger-gated delegations therefore read as inactive here; supplying a richer context (events/attestations) is a follow-up. Demonstrates the safety invariants: selfhood default-deny, and consequential judgements requiring declared provenance + horizon.

pub fn list_assessment_instruments(&self) -> Vec<InstrumentDto>

The instruments this build ships (definitions: items, options, bands, disclaimer).

pub fn record_assessment( &mut self, instrument_id: &str, responses: Vec<u8>, ) -> Result<AssessmentResult, String>

Score responses against the given instrument and persist the result. Returns the scored outcome (total, band, interpretation, any safety flags). Errors if the instrument is unknown or the responses are the wrong count / out of range (fail-closed in score).

pub fn list_assessments( &self, limit: usize, ) -> Result<Vec<AssessmentResult>, String>

Past assessment results, newest-first, reconstructed from the journal.

impl WebizenHostApi

pub fn export_backup_bytes(&self) -> Result<Vec<u8>, String>

Build a portable backup of this node’s WellFair data (the wellfair/ subtree) as archive bytes. The Sanctuary vault stays encrypted inside it.

pub fn import_backup_bytes(&self, bytes: &[u8]) -> Result<BackupReport, String>

Restore a backup (archive bytes) into this node’s storage. Path-traversal-safe.

pub fn export_backup_to_path(&self, path: &str) -> Result<BackupReport, String>

Write a backup archive to path; returns the file count + archive size.

pub fn import_backup_from_path( &self, path: &str, ) -> Result<BackupReport, String>

Restore a backup archive from path into this node’s storage.

pub fn diagnostics_report(&self) -> Result<DiagnosticsReport, String>

A node health/status snapshot (record counts, sync queue depths, data footprint, Sanctuary state, build version). Native-only (reads the on-disk Sanctuary vault state).

pub fn add_clinical_report( &mut self, title: &str, report_type: ClinicalReportType, observed_at_unix: u32, body: &str, author_label: Option<String>, ) -> Result<JournalEntry, String>

pub fn list_clinical_reports( &self, limit: usize, ) -> Result<Vec<JournalEntry>, String>

pub fn add_clinical_attachment( &mut self, filename: &str, media_type: &str, bytes: &[u8], ) -> Result<JournalEntry, String>

Store an attachment’s bytes as a content-addressed blob and commit its metadata record. The bytes live only in the blob store; the journal row holds filename/size/hash metadata.

pub fn list_clinical_attachments( &self, limit: usize, ) -> Result<Vec<JournalEntry>, String>

pub fn attachment_bytes( &self, record_id: &str, ) -> Result<Option<Vec<u8>>, String>

Read the blob bytes for any record that carries a blob_hash (clinical attachments, government-letter documents, …), integrity-verified by the blob store.

impl WebizenHostApi

pub fn add_project(&mut self, project: &Project) -> Result<JournalEntry, String>

pub fn add_project_membership( &mut self, membership: &ProjectMembership, ) -> Result<JournalEntry, String>

pub fn add_contribution( &mut self, contribution: &Contribution, ) -> Result<JournalEntry, String>

pub fn list_contributions( &self, limit: usize, ) -> Result<Vec<JournalEntry>, String>

pub fn project_obligations( &self, limit: usize, ) -> Result<Vec<Obligation>, String>

Derive per-(project, contributor) effort obligations from the committed contribution journal. Pure over the unique-id set, so a duplicate or replayed commit can never double-count effort (§17 money/obligation safety).

pub fn synced_project_obligations( &self, limit: usize, ) -> Result<Vec<Obligation>, String>

Obligations derived from both locally-committed contributions and validated inbound sync operations (kind contribution) — the cross-node convergence view. Because derive_obligations collapses to the unique record-id set first, a remote contribution that has already been seen locally, or a replayed inbound op, never double-counts effort (§17). This is the “apply validated inbound ops” step of the sync loop for obligations.

pub fn add_credential( &mut self, credential: &CredentialRecord, ) -> Result<JournalEntry, String>

pub fn list_credentials( &self, limit: usize, ) -> Result<Vec<JournalEntry>, String>

pub fn get_credential( &self, record_id: &str, ) -> Result<Option<CredentialRecord>, String>

Load the full credential (including its claims) from its content-addressed blob. Returns None if the record id is unknown or its blob is missing.

pub fn present_credential( &self, record_id: &str, selected_claim_keys: &[String], ) -> Result<FieldSelectedPresentation, String>

Build a field-selected presentation of a stored credential — plain field selection, NOT cryptographic selective disclosure (the type name and the domain module say so).

impl WebizenHostApi

pub fn record_transparency_cc( &self, credential_id: &str, informed_authority_did: &str, purpose: &str, ) -> Result<(), String>

Record a transparency cc — the protective “I informed authority X for purpose Y” note.

pub fn record_disclosure( &self, commitment_hex: &str, credential_id: &str, recipient_did: &str, acting_delegate_did: Option<String>, onward_to: Option<String>, ) -> Result<DisclosureEvent, String>

Record a disclosure event (an access, or an onward-share if onward_to is set). A per-recipient fingerprint + id are generated. Returns the recorded event (its fingerprint is the tracing anchor).

pub fn disclosure_chain( &self, commitment_hex: &str, ) -> Result<Vec<DisclosureEvent>, String>

The disclosure chain for a payload (who saw it, via which route).

pub fn actors_with_access( &self, commitment_hex: &str, ) -> Result<Vec<String>, String>

The distinct actors who had access to a payload — the set a leak must be within.

pub fn trace_leak( &self, fingerprint_hex: &str, ) -> Result<Option<DisclosureEvent>, String>

Trace a leak by its fingerprint (hex, 16 bytes) → the disclosure + accountable actor.

pub fn list_transparency_ccs(&self) -> Result<Vec<TransparencyCc>, String>

List transparency cc records.

pub fn assess_duty_of_inquiry( &self, duty: DutyOfInquiry, conduct: ConductAgainstDuty, ) -> InquiryVerdict

Assess a duty of inquiry — classify conduct against the duty (the fair negligence classifier: was an accessible means left unchecked, and did a harmful act follow?). Pure; no persistence.

pub fn sleep_analytics( &self, target_min: f64, ) -> Result<(SleepDebtReport, SleepHeatmapReport), String>

pub fn default_sleep_analytics( &self, ) -> Result<(SleepDebtReport, SleepHeatmapReport), String>

pub fn add_emergency_contact( &self, display_name: &str, relationship: &str, phone: Option<String>, email: Option<String>, notes: Option<String>, ) -> Result<EmergencyContact, String>

pub fn list_emergency_contacts(&self) -> Result<Vec<EmergencyContact>, String>

pub fn med_reminder_prefs(&self) -> MedReminderPrefs

pub fn set_med_reminders_enabled( &self, enabled: bool, ) -> Result<MedReminderPrefs, String>

pub fn grant_med_reminder_permission(&self) -> Result<MedReminderPrefs, String>

pub fn list_due_med_reminders( &self, window_minutes: i32, ) -> Result<Vec<DueMedReminder>, String>

pub fn sanctuary_prefs(&self) -> SanctuaryPrefs

pub fn setup_sanctuary( &self, real_pin: &str, decoy_pin: &str, ) -> Result<SanctuaryPrefs, String>

pub fn lock_sanctuary(&self) -> Result<SanctuaryPrefs, String>

pub fn unlock_sanctuary(&self, pin: &str) -> Result<SanctuaryPrefs, String>

pub fn sanctuary_vault_configured(&self) -> bool

pub fn setup_sanctuary_vault( &self, real_pin: &str, decoy_pin: &str, ) -> Result<(), String>

pub fn sanctuary_vault_resolve_lane( &self, pin: &str, ) -> Result<SanctuaryLane, String>

Verify a PIN and report which lane it opens (real vs duress decoy).

pub fn add_sanctuary_vault_note( &self, pin: &str, body: &str, ) -> Result<SanctuaryLane, String>

pub fn list_sanctuary_vault_notes( &self, pin: &str, ) -> Result<(SanctuaryLane, Vec<SanctuaryVaultNote>), String>

impl WebizenHostApi

pub fn owner_envelope_public_hex(&self) -> String

The owner’s envelope public key (hex) — publishable so others can seal payloads to the owner.

pub fn seal_and_grant_consent_credential( &self, agent_did: &str, agent_public_hex: &str, scope: &str, purpose: &str, plaintext: &str, expiry_unix: Option<u64>, ) -> Result<ConsentCredential, String>

Seal a plaintext payload and grant a consent credential over it — real envelope encryption. If agent_public_hex is empty, the payload is sealed to the OWNER’s derived envelope key (self-custody, so the owner can open_owner_payload); supply an agent’s X25519 public key to grant that agent access (they open it on their own device with their secret — the owner cannot).

pub fn open_owner_payload(&self, credential_id: &str) -> Result<String, String>

Open an owner-sealed payload through a credential — proves the crypto-revoke property end-to-end: works while the credential is live, fails once revoked (the wrapped key is gone), though the commons ciphertext survives. Only opens payloads sealed to the owner (an agent-sealed payload opens on the agent’s device).

pub fn arm_dead_mans_switch(&self, switch: DeadMansSwitch) -> Result<(), String>

Arm a dead-man switch over a payload (post-death disposition; gamified + reversible).

pub fn dead_mans_alive(&self, commitment_hex: &str) -> Result<bool, String>

I’m alive — touch the heartbeat + un-fire a not-yet-enacted switch (reversibility). The routine owner-side action that keeps a dead-man switch from firing.

pub fn attest_dead_mans( &self, commitment_hex: &str, attestation: PartyAttestation, ) -> Result<bool, String>

Record a party attestation toward a dead-man switch’s gamified trigger.

pub fn enact_dead_mans( &self, commitment_hex: &str, ) -> Result<Option<Disposition>, String>

Enact a dead-man switch if the gamified rule holds — returns the Disposition to carry out.

pub fn list_dead_mans_switches( &self, ) -> Result<Vec<DeadMansSwitchRecord>, String>

List armed dead-man switches (with accumulated attestations).

pub fn enact_dead_mans_release( &self, commitment_hex: &str, party_keys_hex: Vec<(String, String)>, ) -> Result<Value, String>

Enact a dead-man switch AND release the keys (ADR 0011 D6, key-release-on-enact). Recovers the payload DEK by unwrapping the owner’s own credential, then — for a ReleaseTo disposition — re-seals the DEK to each supplied party X25519 pubkey and grants them a credential, so the disposition actually hands over access. party_keys = (did, pubkey_hex) pairs. (The owner key is derivable here; the true post-death friend-side release without the owner needs Shamir pre-positioning — separate.)

pub fn split_dek_recovery( &self, commitment_hex: &str, threshold: usize, parties: Vec<String>, ) -> Result<Value, String>

Split a payload’s DEK into Shamir social-recovery shares (threshold-of-parties.len()), so a quorum of friends can later reconstruct the key without the owner. Recovers the DEK from the owner’s own credential, splits it, and returns the shares paired with the parties they should be handed to (the caller distributes them off-device — they are NOT stored here). Owner-side, done while alive.

pub fn reconstruct_and_release( &self, commitment_hex: &str, shares: Vec<Share>, party_keys_hex: Vec<(String, String)>, ) -> Result<Value, String>

Social-recovery enactment (no owner key): given a quorum of friends’ Shamir shares, reconstruct the DEK, enact the dead-man switch, and release to the disposition parties. party_keys = (did, pubkey_hex).

pub fn set_peer_envelope_key( &self, did: &str, pubkey_hex: &str, ) -> Result<(), String>

Publish a peer’s envelope (X25519) public key into their peer record, so releases to that party can resolve the key automatically (remote-key distribution). The owner’s own publishable key is owner_envelope_public_hex.

pub fn enact_dead_mans_release_via_peers( &self, commitment_hex: &str, ) -> Result<Value, String>

Enact + release resolving the disposition parties’ keys from the peer store (remote-key distribution). Reads the switch’s ReleaseTo parties, looks up each one’s published envelope key from social_peers, and releases to those with a known key — reporting any parties whose key is still missing (so the owner knows to obtain it). No keys pasted by hand.

pub fn arm_incapacity_switch( &self, switch: IncapacitySwitch, ) -> Result<(), String>

Arm an incapacity switch (advocate activation on validated, reversible incapacity).

pub fn activate_incapacity( &self, principal_did: &str, attesting_parties: Vec<String>, official_instrument: Option<String>, ) -> Result<bool, String>

Activate advocacy if the corroborated trigger holds (quorum + optional official instrument).

pub fn regain_capacity(&self, principal_did: &str) -> Result<bool, String>

Regain capacity — the advocate stands down (reversibility).

pub fn list_incapacity_switches(&self) -> Result<Vec<IncapacitySwitch>, String>

List armed incapacity switches.

impl WebizenHostApi

pub fn submit_proxy_record( &mut self, qapp_id: &str, envelope: RecordEnvelope, source: &str, summary: Option<String>, ) -> Result<SubmitOutcome, String>

Submit a record that may be a proxy action, surfacing the guardian-escrow outcome. Callers that set envelope.proxy_did use this instead of submit_record so a suspended write is a first-class result (a pending proposal), not an error.

pub fn propose_proxy_condition( &mut self, proxy_did: &str, report: &ConditionReport, ) -> Result<SubmitOutcome, String>

A supporter records a condition on the principal’s behalf (a proxy action). The write is escrowed for M-of-N guardian co-signature; the returned outcome carries the pending proposal id. This is the supported-agency entry point the desktop exposes for the approval tray.

pub fn list_guardianship_proposals( &self, limit: usize, ) -> Result<Vec<GuardianshipProposalView>, String>

Pending and recently-resolved guardianship proposals for the approval tray.

pub fn vote_guardianship_proposal( &mut self, proposal_id: &str, guardian_did: &str, approve: bool, reason: Option<String>, ) -> Result<GuardianshipProposalView, String>

Record a guardian’s co-signature (or objection). On ratification the escrowed record commits through the normal signed vault path; the commit is idempotent (a replayed final vote will not double-write the record).

pub fn submit_live_share_request( &self, request: &LiveSectionRequest, ) -> Result<JournalEntry, String>

Companion requests a live section projection; owner must approve minimum kinds before data flows.

pub fn decide_live_share_request( &self, request_id: &str, approved: bool, projection_kinds: &[String], deny_reason: Option<&str>, ) -> Result<JournalEntry, String>

Owner approves or denies a pending live share; sanctuary-classified kinds fail closed unless unlocked.

pub fn get_live_share_record( &self, request_id: &str, ) -> Result<Option<LiveShareRequestRecord>, String>

pub fn list_pending_live_shares( &self, limit: usize, ) -> Result<Vec<LiveSectionRequest>, String>

pub fn register_usage_agreement( &self, agreement: &UsageAgreement, ) -> Result<(), String>

impl WebizenHostApi

pub fn publish_qapp_pwa( &self, target_dir: &str, id: &str, name: &str, kind: &str, description: &str, capabilities_csv: &str, wasm_filename: &str, ) -> Result<Vec<String>, String>

Author a qapp from discrete fields and write its installable PWA bundle to target_dir. Returns the written (bundle-relative) file paths. Serving the bundle over a secure origin so a phone can install it is a later stage (P1); this produces the artifact.

pub fn add_life_event( &mut self, report: &LifeEventReport, ) -> Result<JournalEntry, String>

pub fn add_welfare_case( &mut self, report: &WelfareCaseReport, ) -> Result<JournalEntry, String>

pub fn add_case_task( &mut self, report: &CaseTaskReport, ) -> Result<JournalEntry, String>

pub fn add_wellbeing_observation( &mut self, report: &WellbeingObservation, ) -> Result<JournalEntry, String>

pub fn add_therapy_note( &mut self, report: &TherapyNote, ) -> Result<JournalEntry, String>

pub fn add_ledger_entry( &mut self, entry: &LedgerEntry, ) -> Result<JournalEntry, String>

Record a signed personal-finance ledger entry (Phase 5 / FIN-01..).

pub fn list_ledger_entries( &self, limit: usize, ) -> Result<Vec<JournalEntry>, String>

List ledger journal rows (most recent first).

pub fn ledger_balance(&self, limit: usize) -> Result<BalanceReport, String>

Derived balance across the ledger. Balances are a pure derivation over the unique-entry-id set, so a duplicate or replayed commit can never move money (§17).

impl WebizenHostApi

pub fn add_sanctuary_vault_note_in_session( &self, pin: &str, body: &str, session_ref: &str, ) -> Result<SanctuaryLane, String>

Add a note, attributing a decoy (duress) write to session_ref — a fresh ref per duress unlock yields the git-like per-session branch in the audit DAG (ADR §10). Real-lane writes ignore session_ref (real activity is never audited). The host should mint one session_ref per unlock (e.g. a UUID) and reuse it for every write in that session.

pub fn curate_sanctuary_decoy_note( &self, real_pin: &str, body: &str, ) -> Result<(), String>

Curate the decoy from a real session (ADR §3.2). Write a plausible note into the decoy lane without the decoy PIN, so a coercer’s re-unlock shows fresh, believable content. Requires the real PIN; the decoy/wrong PIN is rejected.

pub fn review_sanctuary_decoy_activity( &self, real_pin: &str, ) -> Result<DecoyActivityReport, String>

Review decoy activity from the real lane (ADR §3.1 / §10). Decrypts every sealed decoy-session record, verifies chain integrity + each witnessed-prefix head anchor, advances the anchors, and returns the decrypted actions with an integrity verdict. Requires the real PIN. session_count is a proxy for “number of attackers”, never a hard head-count.

pub fn get_sanctuary_decoy_retention_mode( &self, real_pin: &str, ) -> Result<RetentionMode, String>

Read the decoy-audit retention policy (ADR §8). Real-session only — requires the real PIN; the setting is invisible/unreachable from a decoy session. Defaults to auto-archive.

pub fn set_sanctuary_decoy_retention_mode( &self, real_pin: &str, mode: RetentionMode, ) -> Result<(), String>

Set the decoy-audit retention policy (ADR §8). Real-session only — requires the real PIN.

pub fn sanctuary_vault_is_keychain_wrapped(&self) -> bool

Is the on-disk Sanctuary vault keychain-wrapped (bound to an OS-keychain pepper)?

pub fn setup_sanctuary_vault_wrapped( &self, real_pin: &str, decoy_pin: &str, ) -> Result<String, String>

Opt-in: create the Sanctuary vault with an OS-keychain-held pepper so disk + PIN alone can’t open it. Returns the hex recovery code the user MUST record — losing the keychain entry otherwise loses the vault. The ordinary Self::setup_sanctuary_vault path stays unwrapped.

pub fn sanctuary_vault_unlock_with_recovery( &self, pin: &str, recovery_code_hex: &str, ) -> Result<SanctuaryLane, String>

Recover a keychain-wrapped vault on a device whose keychain entry is missing, using the recovery code from Self::setup_sanctuary_vault_wrapped. Re-seats the pepper on success.

impl WebizenHostApi

pub fn build_outbound_operation( &self, entry: &JournalEntry, lamport: u64, ) -> Option<SyncOperation>

Build a signed outbound sync operation from a committed journal entry. Returns None for Classified/Sanctuary records — they never enter the ordinary sync lane (§5.2). The signature is a real ed25519 signature over the operation’s bound payload.

pub fn admit_sync_operation( &self, op: &SyncOperation, ) -> Result<AdmitOutcome, String>

Admit an inbound sync operation into the durable quarantined inbox. Idempotent: a replayed operation id is recorded as Duplicate and never applied twice.

pub fn validated_sync_operations(&self) -> Result<Vec<SyncOperation>, String>

Validated operations currently held in the inbox, in Lamport order.

pub fn list_sync_inbox(&self, limit: usize) -> Result<Vec<InboxRecord>, String>

pub fn sync_push_via<T: SyncTransport>( &self, transport: &T, limit: usize, ) -> Result<usize, String>

Drain the outbox through a transport. For each Queued outbox entry, build a signed SyncOperation from its committed journal entry and publish it; on success the entry is marked Sent. Classified/Sanctuary records never enter the ordinary lane — they are marked Rejected so they stop being retried. Returns the number of operations published.

The transport is a dumb pipe; correctness (dedup, convergence) is enforced by the peer’s fail-closed inbox on the other side.

pub fn sync_pull_via<T: SyncTransport>( &self, transport: &T, since: u64, ) -> Result<SyncPullReport, String>

Pull from a transport and admit into the quarantined inbox. Every op is validated fail-closed on admission (bad signature/hash/version/oversize/Classified → Rejected; replays → Duplicate), so a hostile peer can only cause rejections. Returns the admission tally.

pub fn sync_with_http_relay( &self, base_url: &str, since: u64, ) -> Result<(usize, SyncPullReport), String>

One-shot sync against an HTTP relay (the production wire): drain the outbox to the relay, then pull + admit from it. Returns (pushed, pull_report). Native-only (reqwest).

pub fn sync_with_libp2p_peer( &self, peer_id: &str, peer_addr: &str, since: u64, ) -> Result<(usize, SyncPullReport), String>

One-shot sync against a libp2p peer/relay (noise-encrypted request-response — the peer-to-peer wire): drain the outbox to the peer, then pull + admit from it. peer_id is the base58 peer id, peer_addr a libp2p multiaddr (e.g. /ip4/1.2.3.4/tcp/4001). Returns (pushed, pull_report). Native-only (libp2p). Same dumb-pipe contract as Self::sync_with_http_relay: correctness is enforced by the fail-closed inbox, not the transport.

impl WebizenHostApi

pub fn add_assistance_need( &mut self, category: &str, description: &str, urgency: Urgency, ) -> Result<JournalEntry, String>

pub fn add_welfare_stream( &mut self, program_name: &str, reference: Option<String>, status: StreamStatus, ) -> Result<JournalEntry, String>

pub fn add_government_letter( &mut self, sender: &str, subject: &str, action_required: bool, ) -> Result<JournalEntry, String>

pub fn add_authority_attestation( &mut self, authority_type: &str, authority_label: &str, jurisdiction: Option<String>, department: Option<String>, agent_name: Option<String>, agent_capacity: Option<String>, representation: &str, subject: &str, statement: &str, action_required: bool, ) -> Result<JournalEntry, String>

Record a general authority attestation — the ontological generalization of a government letter: an authorizing body (extensible type + jurisdiction + department) attested by an agent-in-capacity, delivered as a PDF, a credential, or a PDF-with-embedded-credential. add_government_letter remains a preset (authority:government, PDF) of this model.

pub fn add_government_letter_attachment( &mut self, sender: &str, subject: &str, action_required: bool, bytes: &[u8], ) -> Result<JournalEntry, String>

Record a government letter together with its document bytes (stored as a content-addressed blob; the letter’s attachment_blob_hash is that blob’s hash, retrievable via attachment_bytes).

pub fn list_welfare_records( &self, limit: usize, ) -> Result<Vec<JournalEntry>, String>

All welfare-support journal rows (assistance needs, streams, government letters).

pub fn add_work_item(&mut self, item: &WorkItem) -> Result<JournalEntry, String>

pub fn add_work_item_status( &mut self, event: &WorkItemStatusEvent, ) -> Result<JournalEntry, String>

Append an immutable status transition. The current status is a derived projection (latest event), never a mutated field — so replayed transitions can’t corrupt the board.

pub fn list_work_items(&self, limit: usize) -> Result<Vec<JournalEntry>, String>

pub fn work_item_board( &self, project_id: &str, limit: usize, ) -> Result<Vec<BoardColumn>, String>

Derive the Kanban board for a project from committed work items and their status events. Pure over the unique-event-id set, so duplicate/replayed transitions never mis-place a card.