pub struct OpScope {
pub node: ContentHash,
pub head: Option<ContentHash>,
}Expand description
Where and when an op is admissible: the author’s own statement of which log they are submitting into and which head they observed.
This is an admission precondition, exactly like OpKind’s prev,
and it lives in the payload for the same reason prev does — the
payload is what the author signs. A signature over (channel, payload) is otherwise position-independent, log-independent and
occurrence-independent, so a captured op replays onto any node that
trusts the key, and replays again on the node it came from as soon
as CAS state returns to what it expected (ABA). prev cannot close
that: it asks whether the state matches, not whether the op has run.
A head hash can occur at exactly one position in exactly one chain, which is what makes it a usable freshness token without a clock: the house rule is that elapsed time is not a thing this system measures.
The admission rule is in choir-node’s policy, not in View: the
view is pure state and knows nothing about nodes or log windows.
Fields§
§node: ContentHashActor id of the node whose log this op was signed for.
head: Option<ContentHash>A log head the author had observed when they signed. None says
the author read an empty log — admissible only while the node has
evicted nothing, which is the span its duplicate index still
covers in full.