Transport-neutral MCP dispatch with A1 audit integration and effect fencing.
Audit lifecycle per request:
Fencing: the generation counter in the session registry increments on revocation or lease retirement. A permit acquired at admission is checked before the mutation commits. If the generation changed, the mutation is refused even though the session was valid at admission time.
Transport-neutral MCP dispatch with A1 audit integration and effect fencing. Audit lifecycle per request: 1. Health-check the A1 sink → refuse if unhealthy 2. Mint operation_id 3. Record durable Attempt → refuse if fails 4. Acquire generation permit from session registry 5. Check permit at mutation boundary (inside verb execution) 6. Execute verb 7. Record durable Completion → error handling per effect certainty 8. Return response Fencing: the generation counter in the session registry increments on revocation or lease retirement. A permit acquired at admission is checked before the mutation commits. If the generation changed, the mutation is refused even though the session was valid at admission time.
(healthy? this)Returns true if the sink can accept records.
Returns true if the sink can accept records.
(record! this event)Durably append an audit event. Throws on failure.
Durably append an audit event. Throws on failure.
(dispatch msg session)Dispatch one parsed JSON-RPC message.
Dispatch one parsed JSON-RPC message.
(journal-audit-sink dir-path)Create a JournalAuditSink at the given directory path. A2/A4: production-grade durable journal. Append-only, canonical JSON, fsync'd, process-locked. Replaces the old FileAuditSink.
Create a JournalAuditSink at the given directory path. A2/A4: production-grade durable journal. Append-only, canonical JSON, fsync'd, process-locked. Replaces the old FileAuditSink.
(record-transport-denial! auth-status
principal
denial-code
denial-message
&
{:keys [content-type byte-length]})Record a transport-level denial (origin, auth, content-type, accept) as an Attempt + denied Completion pair. Called by http-transport before the dispatcher is reached. auth-status is one of: missing, invalid, or authenticated (for post-auth transport rejections like content-type/accept).
Record a transport-level denial (origin, auth, content-type, accept) as an Attempt + denied Completion pair. Called by http-transport before the dispatcher is reached. auth-status is one of: missing, invalid, or authenticated (for post-auth transport rejections like content-type/accept).
(recording-sink records-atom)Create a RecordingAuditSink backed by the given atom. For tests only — production MUST use a durable A1 sink.
Create a RecordingAuditSink backed by the given atom. For tests only — production MUST use a durable A1 sink.
(set-audit-sink! sink)(set-audit-sink! sink production?)Set the global audit sink. A4: production path MUST reject RecordingAuditSink.
Set the global audit sink. A4: production path MUST reject RecordingAuditSink.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |