Schema

Use this reference to inspect fields, methods, accepted values and failure outcomes. For setup and working examples, start with the API guide.

Definition: abstraction.resource

Service `Table` [DEF-S1]

Read-only: who holds how much of a scarce resource on this machine, verified by the instrument or claimed by the holder. No row is invented: a holder the instrument cannot attribute to a program is reported under its process image with evidence verified and no account when the platform gives none. The table changes nothing.

Wire identity: abstraction.resource/table@1

Handler error codes, declared by resource_error_codes: internal, invalid_request, caller_refused, unknown_resource, policy_unavailable, forbidden. Generated bindings name each as a ServiceErrorCode member beside the dispatcher's own codes.

Multiple services share this namespace. Generated ServiceName (Go) and service_name (C++/Python) validate the request envelope and version before returning its service identity for routing. The selected generated dispatcher validates the method and typed arguments; the selector does not authorize callers or interpret method payloads.

Frames carry version, service, method and typed arguments. Transport owns framing, associated exchanges, deadlines and connections. Unknown version/service/method and malformed arguments are rejected before invoking a handler. One-way WriteFrame success means local submission, not remote acceptance or persistence.

Request-response methods use ExchangeFrame. Replies carry version, service, method, ok and payload; success payload contains typed value (or an empty object for void). Error payload contains nonempty code and message, which may be empty. ServiceError preserves unknown codes. Unexpected handler failures become handler_error without private details; invalid results become invalid_result. Clients validate reply identity and result before exposing it. A malformed frame or transport failure remains a local error; the transport must associate each response with its exchange. C++ dispatchers are pure protocol bindings, not listening servers.

The resources this machine's instrument and adapters can report.

`Resources`

request-response ResourcesResult

Who holds resource now. fresh reads the instrument again; otherwise the last sample within its age bound. Gated by abstraction.resource/table.read on resource account; a program always sees its own rows, and capacity, held and observed describe the machine to every caller.

`Holders`

request-response HoldersResult

Argument 1: string resource (required, including zero/false/empty)
Argument 2: bool fresh (required, including zero/false/empty)

Service `Leases` [DEF-S1]

Leases on a scarce resource, asked back on demand. A holder that predates OA is an attached holder: the service yields on its behalf through the host's own mechanism (LM Studio unload, Ollama keep_alive 0, ComfyUI free) and records the result as if answered. Every ask, yield and refusal is a record with the asker, the holder, the amount and the time. Version 1 kills nothing and boosts nothing.

Wire identity: abstraction.resource/leases@1

Ask to reserve amount bytes for admission of the bound caller, waiting up to wait_ms (0..120000) for holders to yield. The reservation is not a physical usage quota. Order: the rights decision for abstraction.resource/hold on resource (not_permitted, or unavailable when the decision point cannot answer), then the table (insufficient when capacity is known and amount exceeds it), then holders are asked in the service's order and the result is acquired or holders_refused. Nothing is killed.

`Acquire`

request-response AcquireResult

Argument 1: string resource (required, including zero/false/empty)
Argument 2: i64 amount (required, including zero/false/empty)
Argument 3: i64 wait_ms (required, including zero/false/empty)

Reserve amount bytes for the bound caller only from what is free now, asking nobody: a request that can take nothing from another holder, such as speculative work (RES-L6). Order: the rights decision for abstraction.resource/hold on resource (not_permitted, or unavailable when the decision point cannot answer), then the table (insufficient when the pool is known and amount exceeds it), then one grant decision under the book's lock: acquired when amount fits what is free, or when the resource has no pool and nothing holds it, otherwise held. asked is always empty: no yield request is ever sent.

`AcquireFree`

request-response AcquireFreeResult

Argument 1: string resource (required, including zero/false/empty)
Argument 2: i64 amount (required, including zero/false/empty)

Extend renew_by of the bound caller's own lease.

`Renew`

request-response LeaseChangeResult

Argument 1: string lease (required, including zero/false/empty)

End the bound caller's own lease now.

`Release`

request-response LeaseChangeResult

Argument 1: string lease (required, including zero/false/empty)

Yield requests addressed to the bound caller since cursor, waiting up to wait_ms (0..30000) for one. Each request names the lease to yield. A holder that never observes is asked through its adapter when the service has one, and is otherwise recorded as unanswered.

`Observe`

request-response ObserveResult

Argument 1: string cursor (required, including zero/false/empty)
Argument 2: i64 wait_ms (required, including zero/false/empty)

Record the bound caller's answer to one yield request. yielded is checked against the instrument before the asker is told; a refusal carries its reason into the audit.

`Answer`

request-response AnswerCallResult

Argument 1: string request (required, including zero/false/empty)
Argument 2: YieldAnswer answer (required, including zero/false/empty)
Argument 3: string reason (required, including zero/false/empty)

Associate the bound caller's own lease with one directly spawned process when its process start identity, parent relation and account can be verified. A failed or unsupported verification returns unverifiable and keeps conservative reservation accounting. One process may bind to one live lease.

`BindProcess`

request-response ProcessBindResult

Argument 1: string lease (required, including zero/false/empty)
Argument 2: i64 pid (required, including zero/false/empty)

Encoding [DEF-E1]

setting	value	rule
`escape`	`minimal`	[DEF-E2]
`indent`	`2`	[DEF-E3]
`map_keys`	`utf8-bytes`	[DEF-E4]
`numbers`	`integer-decimal`	[DEF-E5]
`opaque`	`verbatim`	[DEF-E6]
`terminator`	`newline`	[DEF-E7]
`duplicate_keys`	`refuse`	[DEF-E8]
`depth_limit`	`64`	[DEF-E9]

Types

kind	types
built in	`AcquireFreeOutcome` `AcquireOutcome` `Evidence` `ProcessBindOutcome` `ResourceCallOutcome` `bool` `i64` `string`
declared below	`AnswerResult` `Lease` `LeaseChange` `ResourceList` `ResourceState` `YieldPage`
container [DEF-T3]	`list<string>`
repeated record [DEF-A9]	`list<Holder>` `list<YieldRecord>` `list<YieldRequest>`

Named types [DEF-T2]

One spelling is written [DEF-G2] and a wider set is read [DEF-G1]; the width between them is the interoperability guarantee.

name	is	written	read
`timestamp`	`string`	`rfc3339-micros`	`rfc3339-wide`

Structs [DEF-T1]

A field is required, or says when it is omitted [DEF-A4]. Each struct says on its own what it does with a field name it has never heard of [DEF-A7]. A wire name never moves; where a language must spell it differently the field says so [DEF-A2].

`Holder`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`program`	`string`	required	—
2	`account`	`string`	required	—
3	`amount`	`i64`	required	—
4	`evidence`	`Evidence`	required	—
5	`lease`	`string`	optional · omitted when zero	—
6	`grant`	`string`	optional · omitted when zero	—
7	`since`	`timestamp`	optional · omitted when zero	—
8	`detail`	`string`	optional · omitted when zero	—

`ResourceState`

the document [DEF-A1] · unknown fields refuse

id	field	type	presence	named elsewhere
1	`resource`	`string`	required	—
2	`capacity`	`i64`	required	—
3	`held`	`i64`	required	—
4	`holders`	`list<Holder>`	required	—
5	`observed`	`timestamp`	required	—
6	`instrument`	`string`	required	—

`HoldersResult`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`outcome`	`ResourceCallOutcome`	required	—
2	`state`	`ResourceState`	optional · omitted when absent	—

`ResourceList`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`resources`	`list<string>`	required	—
2	`observed`	`timestamp`	required	—

`ResourcesResult`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`outcome`	`ResourceCallOutcome`	required	—
2	`list`	`ResourceList`	optional · omitted when absent	—

`Lease`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`id`	`string`	required	—
2	`resource`	`string`	required	—
3	`amount`	`i64`	required	—
4	`since`	`timestamp`	required	—
5	`renew_by`	`timestamp`	required	—

`YieldRecord`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`holder`	`string`	required	—
2	`amount`	`i64`	required	—
3	`answer`	`string`	required	—
4	`took_ms`	`i64`	required	—

`AcquireResult`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`outcome`	`AcquireOutcome`	required	—
2	`lease`	`Lease`	optional · omitted when absent	—
3	`asked`	`list<YieldRecord>`	required	—

`AcquireFreeResult`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`outcome`	`AcquireFreeOutcome`	required	—
2	`lease`	`Lease`	optional · omitted when absent	—
3	`asked`	`list<YieldRecord>`	required	—

`YieldRequest`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`id`	`string`	required	—
2	`resource`	`string`	required	—
3	`amount`	`i64`	required	—
4	`reason`	`string`	required	—
5	`at`	`timestamp`	required	—
6	`lease`	`string`	required	—

`YieldPage`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`requests`	`list<YieldRequest>`	required	—
2	`next`	`string`	required	—

`ObserveResult`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`outcome`	`ResourceCallOutcome`	required	—
2	`page`	`YieldPage`	optional · omitted when absent	—

`AnswerResult`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`recorded`	`bool`	required	—

`AnswerCallResult`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`outcome`	`ResourceCallOutcome`	required	—
2	`answer`	`AnswerResult`	optional · omitted when absent	—

`LeaseChange`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`applied`	`bool`	required	—
2	`lease`	`Lease`	optional · omitted when absent	—

`LeaseChangeResult`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`outcome`	`ResourceCallOutcome`	required	—
2	`change`	`LeaseChange`	optional · omitted when absent	—

`ProcessBindResult`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`outcome`	`ProcessBindOutcome`	required	—

Enumerations [DEF-T5]

Enum fields carry JSON strings containing exact member wire spellings, never numeric IDs. Unknown names are preserved with grant and refused as bad_enum with refuse on read and write. Optional absent fields preserve presence separately from an empty string.

An enumeration is a closed vocabulary of wire names, and each one says on its own what a reader does with a member it has never heard of [DEF-A5].