Interface: CommandRule

Defined in: packages/contracts/src/permissions/table.ts:145

Who handles a command to an agent, and who may send it (D3.8). The fourth kind of row.

Its two fields are deliberately not named as a request's are. Code all over the estate tells a request row by its servedBy, and a command is not a request: its handler is a broker principal and not a module, it is not routed by tenant, and the receiver's actor-token checks do not apply to it.

Properties

handledBy

readonly handledBy: "gateway" | "gateway-admin" | "audit" | "provisioning" | "bootstrap" | "credential" | "agent-shared"

Defined in: packages/contracts/src/permissions/table.ts:151

The agent's broker principal, agent-<instanceId>, which must be the instance the key names. It subscribes to agent.<instanceId>.admin.> and to nothing of any other instance. It hosts no participant: an agent serves commands and sends nothing.

---

sentBy

readonly sentBy: readonly Participant[]

Defined in: packages/contracts/src/permissions/table.ts:158

Every participant permitted to send it, listed one by one. Each sender's host is granted publish on this exact key. The broker cannot tell which module of a deployable published, so the second line is the signed command envelope: the agent accepts a command only under a kid whose holder is the host of a listed sender.