Struct AppState 

pub struct AppState {

    pub config: Arc<HarnessConfig>,
    pub store: Arc<dyn StateStore>,
    pub sandbox: Arc<Sandbox>,
    pub bridge: Arc<dyn EventBus>,
    pub sessions: Arc<SessionRegistry>,
    pub worker: WorkerHandle,
    pub identity: Option<Arc<IdentityValidator>>,
    pub exchanged_revocations: Arc<dyn RevocationStore>,
    pub metrics: Arc<Registry>,
    pub client: Client,
    pub finalizer: Finalizer,
    pub draining: Arc<AtomicBool>,
    pub mcp_inflight: Arc<InflightTracker>,
    pub mcp_admission: Arc<Semaphore>,
    pub backend_router: Arc<BackendRouter>,
    pub pdp: Arc<PolicyDecisionPoint>,
    pub token_signer: Option<Arc<TokenSigner>>,
    pub redaction: Option<Arc<RedactionEngine>>,
    pub mcp_backends: Arc<McpBackendClient>,
    pub authzen: Option<Arc<AuthzenClient>>,
    /* private fields */
}

Shared application state passed through HTTP handlers and background tasks.

Fields

config: Arc<HarnessConfig>

Versioned harness configuration.

store: Arc<dyn StateStore>

Atomic quota and action-budget state.

sandbox: Arc<Sandbox>

MCP schema, policy, and action-budget sandbox.

bridge: Arc<dyn EventBus>

Event Bridge backend used by asynchronous workers and by lifecycle finalization (close/promote publish through it inline).

sessions: Arc<SessionRegistry>

Live session registry.

worker: WorkerHandle

Bounded non-blocking worker queue.

identity: Option<Arc<IdentityValidator>>

Optional NHI validator. Required in production identity mode.

exchanged_revocations: Arc<dyn RevocationStore>

Separate revocation namespace for tokens signed by this gateway.

metrics: Arc<Registry>

Prometheus-compatible metrics registry.

client: Client

Reused upstream HTTP client.

finalizer: Finalizer

Asynchronous session close and promotion service.

draining: Arc<AtomicBool>

Flips to true when shutdown starts. /readyz reads this and reports 503 so a Kubernetes readinessProbe (or any external LB) stops routing new traffic to a draining pod before axum’s graceful drain begins.

mcp_inflight: Arc<InflightTracker>

Tracks in-flight mcp_call_inner detached spawns so finish_shutdown can await their completion between HTTP drain and worker.wait_idle. Without this barrier, a client- disconnected mcp_call running past axum’s graceful drain could reach worker.try_submit AFTER wait_idle returned, stranding a fresh job across finalize_sessions and tripping av_shutdown_session_close_timeouts_total on an otherwise- recoverable session.

mcp_admission: Arc<Semaphore>

Admission semaphore bounding concurrent mcp_call_inner executions to config.mcp_concurrency. R70 F1 (landed R71): without this limit a slow-tool-upstream attack + N concurrent MCP callers each buffering up to MAX_TOOL_RESPONSE_BYTES = 16 MiB in read_limited_tool_response stacked N × 16 MiB unbounded. mcp_inflight above is a shutdown-drain COUNTER — not a limiter. Chat path already has admission via worker.try_reserve_pair; MCP was the odd one out.

Refused admissions increment av_mcp_admission_refusals_ total (see mcp_call in routes.rs) and respond 503 with a Retry-After header — 503 not 429 because the refusal is a server-side capacity signal (matches breaker-open 503-not- 429 discipline documented in finalize_error_response.rs).

backend_router: Arc<BackendRouter>

Per-backend credential routing (pillar 4). Resolves tool names to their designated backend and attaches the pre-resolved credential.

pdp: Arc<PolicyDecisionPoint>

Local policy decision point (pillar 2). Maps tool names to business intents and enforces mission constraints per call.

token_signer: Option<Arc<TokenSigner>>

Token signer (pillar 3). Signs exchange tokens and intent tokens with EdDSA. Present only when token_exchange_seed_file is configured.

redaction: Option<Arc<RedactionEngine>>

Redaction engine (pillar 5). Strips sensitive data from event payloads and ATIF step text before they are journaled or published.

mcp_backends: Arc<McpBackendClient>

MCP Streamable HTTP client and per-agent-session backend sessions for backends with transport = "mcp".

authzen: Option<Arc<AuthzenClient>>

External AuthZEN policy decision point, when [authzen] is set.

Implementations

impl AppState

pub fn new( config: HarnessConfig, store: Arc<dyn StateStore>, sandbox: Arc<Sandbox>, bridge: Arc<dyn EventBus>, identity: Option<Arc<IdentityValidator>>, signer: Arc<dyn Signer>, ) -> Result<Self, PipelineError>

Build fully wired application state with a bounded worker and shared lifecycle services.

pub fn new_with_embedder( config: HarnessConfig, store: Arc<dyn StateStore>, sandbox: Arc<Sandbox>, bridge: Arc<dyn EventBus>, identity: Option<Arc<IdentityValidator>>, signer: Arc<dyn Signer>, embedder: Arc<dyn Embedder>, ) -> Result<Self, PipelineError>

Build application state with an explicit embedding backend.

pub fn new_with_backends( config: HarnessConfig, store: Arc<dyn StateStore>, sandbox: Arc<Sandbox>, bridge: Arc<dyn EventBus>, identity: Option<Arc<IdentityValidator>>, signer: Arc<dyn Signer>, embedder: Arc<dyn Embedder>, vector_sink: Arc<dyn VectorSink>, ) -> Result<Self, PipelineError>

Build application state with explicit embedding and vector backends.

pub fn new_with_backends_and_metrics( config: HarnessConfig, store: Arc<dyn StateStore>, sandbox: Arc<Sandbox>, bridge: Arc<dyn EventBus>, identity: Option<Arc<IdentityValidator>>, signer: Arc<dyn Signer>, embedder: Arc<dyn Embedder>, vector_sink: Arc<dyn VectorSink>, metrics: Arc<Registry>, ) -> Result<Self, PipelineError>

Build application state reusing a pre-existing metrics registry.

main.rs uses this so counters registered outside AppState (JWKS refresh errors, HTTP shutdown drain timeouts) live on the same registry that gets scraped at /metrics — otherwise their samples would be invisible to Prometheus.

pub fn set_content_sink(&self, sink: Arc<dyn ContentSink>) -> Result<()>

Install the sink that receives every journaled step in content form (used by agentvisord for full-content tenant telemetry).

The sink runs on its own thread behind a bounded queue, so it can neither slow down nor fail the audit worker.

pub fn prepare_chat( &self, headers: &HeaderMap, payload: Value, identity_hint: Option<AgentIdentity>, ) -> Result<PreparedRequest, PipelineError>

Run identity, breaker, quota, sanitize, compression, and asynchronous dispatch in the mandated order without awaiting worker or upstream I/O.

identity_hint, when Some, is trusted as the resolved identity for this request — the internal resolve_identity + audit-enqueue step is skipped. Used by chat_completions (R72 F3 pre-admission gate) which already resolved the identity to fail-fast on unauthenticated probes before the body parses. Without this hint, the R72 pre-check path would enqueue_transient_failure on a JWKS-rotation race (pre-check success + re-check failure between the two calls), double-counting av_identity_rejections_total and burning two of the sampled full-audit slots per rejected request (R73 review F3). None preserves the historical behaviour for callers that do NOT pre-resolve.

pub async fn prepare_chat_nonblocking( &self, headers: &HeaderMap, payload: Value, body_bytes: usize, identity_hint: Option<AgentIdentity>, ) -> Result<PreparedRequest, PipelineError>

Run synchronous local gates without waiting for off-path journal, embedding, or broker work.

The inline/blocking decision keys off PAYLOAD SIZE, not off whether a token budget happens to be configured. The cost of prepare_chat (parse-adjacent token scanning, sanitize, compression) is a function of body size — measured 1.9 ms p50 of uninterruptible CPU at a 128 KB body, which stalls every in-flight SSE stream’s poll on that tokio worker. Previously a configured budget.max_tokens (the one thing that makes quotas work) was what moved the work to spawn_blocking, which was backwards. Small bodies stay inline (spawn_blocking costs ~10-20 µs of handoff — 2× the total gate cost at 75 B).

The budget.max_tokens.is_none() clause below is load-bearing, not a leftover: with a budget configured, prepare_chat calls ActionBudget::try_tokens → StateStore::try_spend, which on the redis backend is a synchronous network round-trip — that must never run inline on a tokio worker, whatever the body size. The same applies to [principal_budget]: it drives its own for_principal(...).try_tokens store round-trip in prepare_chat even when the session max_tokens is unset, so it must equally force the blocking pool. Async wrapper over Self::prepare_chat that spawn-blocks on bodies large enough to stall the reactor. See prepare_chat for the identity_hint contract.

pub async fn prepare_chat_durable( &self, headers: &HeaderMap, payload: Value, ) -> Result<PreparedRequest, PipelineError>

Prepare a request and wait until its audit record is durably captured before the provider can observe it.

pub async fn forward_chat( &self, request: PreparedRequest, ) -> Result<ForwardedResponse, PipelineError>

Forward a prepared OpenAI-compatible request to the configured provider.

pub fn intercept_tool( &self, headers: &HeaderMap, raw: &[u8], ) -> Result<ToolVerdict, PipelineError>

Intercept one MCP JSON-RPC tool call, emit its OCSF verdict asynchronously, and return the immediate authorization decision.

pub async fn intercept_tool_durable( &self, headers: &HeaderMap, raw: &[u8], ) -> Result<ToolVerdict, PipelineError>

Authorize a tool call and wait for its verdict event to become durable.

pub async fn intercept_tool_nonblocking( &self, headers: &HeaderMap, raw: &[u8], ) -> Result<ToolVerdict, PipelineError>

Authorize a tool call on the blocking pool without waiting for the off-path event journal or broker publication.

Trait Implementations

impl Clone for AppState

fn clone(&self) -> AppState

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.