cayu.collaboration.mandates

Public Cayu API. Definitions are grouped by their public source module, and definitions from private implementation modules appear on their package’s page; adding a symbol does not move existing links. The import shown at each entry is a supported public namespace. Read the Python API overview and install the required extra.

CollaborationMandate

from cayu.collaboration import CollaborationMandate

One frozen step in an authenticated root-to-leaf delegation chain.

Bases: ContractValue.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
unordered_fields	class attribute	frozenset({'audiences', 'scopes', 'actions', 'resources', 'budgets'})
reference	ObjectRef	required
root	ObjectRef	required
parent	ObjectRef | None	required
issuer	OwnerRef	required
principal	Identifier	required
participant	ParticipantRef | None	required
audiences	tuple[OwnerRef, ...]	Field(max_length=16)
scopes	tuple[Identifier, ...]	Field(max_length=16)
actions	tuple[MandateAction, ...]	Field(max_length=16)
resources	tuple[ResourceSelector, ...]	Field(max_length=32)
remaining_delegations	StrictInt	Field(ge=0, le=8)
sponsor	ObjectRef | None	required
budgets	tuple[ObjectRef, ...]	Field(max_length=16)
restrictions	MandateRestrictions	required
expires_at_ms	Expiry	required
revocation_generation	Generation	required

bounded_input (method)

CollaborationMandate.bounded_input(value: object) -> Any

immutable_fields (method)

CollaborationMandate.immutable_fields() -> ContractValue

exact_authority (method)

CollaborationMandate.exact_authority() -> CollaborationMandate

Release source · Runtime guarantees · Capability guides

InputChannel

from cayu.collaboration import InputChannel

InputChannel = Literal['prompt', 'context', 'tool', 'retrieval', 'artifact', 'source']

Release source · Runtime guarantees · Capability guides

MandateAccessContext

from cayu.collaboration import MandateAccessContext

Authenticated host input, separate from any public operation proposal.

Bases: ContractValue.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
issuer	OwnerRef	required
principal	Identifier	required
participant	ParticipantRef | None	None
mandate	ObjectRef | None	None

bounded_input (method)

MandateAccessContext.bounded_input(value: object) -> Any

immutable_fields (method)

MandateAccessContext.immutable_fields() -> ContractValue

Release source · Runtime guarantees · Capability guides

MandateAction

from cayu.collaboration import MandateAction

MandateAction = Literal['consult', 'source', 'prepare', 'execute', 'publish', 'commission', 'accept_responsibility', 'accept_result', 'administer', 'readback', 'expose', 'release', 'retire']

Release source · Runtime guarantees · Capability guides

MandateChain

from cayu.collaboration import MandateChain

Ordered history authenticated together under current revocation policy.

Bases: ContractValue.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
entries	tuple[CollaborationMandate, ...]	Field(min_length=1, max_length=9)

bounded_input (method)

MandateChain.bounded_input(value: object) -> Any

immutable_fields (method)

MandateChain.immutable_fields() -> ContractValue

exact_lineage (method)

MandateChain.exact_lineage() -> MandateChain

Release source · Runtime guarantees · Capability guides

MandateDenied

from cayu.collaboration import MandateDenied

Bases: PermissionError.

init (method)

MandateDenied.__init__() -> None

Release source · Runtime guarantees · Capability guides

MandateResolution

from cayu.collaboration import MandateResolution

Bases: ContractValue.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
principal	PrincipalResolution	required
chain	MandateChain	required

bounded_input (method)

MandateResolution.bounded_input(value: object) -> Any

immutable_fields (method)

MandateResolution.immutable_fields() -> ContractValue

Release source · Runtime guarantees · Capability guides

MandateResolver

from cayu.collaboration import MandateResolver

Bases: ABC.

ref (property)

MandateResolver.ref() -> ObjectRef

Stable versioned implementation/configuration, never an ambient default.

acquire (method)

MandateResolver.acquire(context: MandateAccessContext) -> AbstractAsyncContextManager[MandateResolution]

Authenticate identity and the whole chain, holding current revocation.

Deny replaced/missing issuers, mandates or ancestor generations. Keep the guard held across owned effects/exposure; historical values alone cannot renew it. This extension is trusted application code, not an auth service.

Release source · Runtime guarantees · Capability guides

MandateRestrictions

from cayu.collaboration import MandateRestrictions

Bases: ContractValue.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
unordered_fields	class attribute	frozenset({'channels', 'excluded_sources'})
channels	tuple[InputChannel, ...]	Field(max_length=6)
excluded_sources	tuple[ObjectRef, ...]	Field(max_length=32)
independence_policy	ObjectRef	required
disclosure_policy	ObjectRef	required

bounded_input (method)

MandateRestrictions.bounded_input(value: object) -> Any

immutable_fields (method)

MandateRestrictions.immutable_fields() -> ContractValue

pinned_policy_and_exclusions (method)

MandateRestrictions.pinned_policy_and_exclusions() -> MandateRestrictions

Release source · Runtime guarantees · Capability guides

PrincipalResolution

from cayu.collaboration import PrincipalResolution

Fresh resolver output, not a portable credential or participant owner claim.

Bases: ContractValue.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
unordered_fields	class attribute	frozenset({'participants', 'audiences', 'actions', 'scopes'})
resolver	ObjectRef	required
issuer	OwnerRef	required
principal	Identifier	required
participants	tuple[ParticipantRef, ...]	Field(max_length=16)
audiences	tuple[OwnerRef, ...]	Field(max_length=16)
actions	tuple[MandateAction, ...]	Field(max_length=16)
scopes	tuple[Identifier, ...]	Field(max_length=16)
expires_at_ms	Expiry	required

bounded_input (method)

PrincipalResolution.bounded_input(value: object) -> Any

immutable_fields (method)

PrincipalResolution.immutable_fields() -> ContractValue

registered_issuer (method)

PrincipalResolution.registered_issuer() -> PrincipalResolution

Release source · Runtime guarantees · Capability guides

ResourceSelector

from cayu.collaboration import ResourceSelector

An exact revision or a subtree understood only by its registered owner.

A bounded union is a tuple of these selectors. Subtree names are not paths that Cayu compares by prefix; their interpretation belongs to the owner.

Bases: ContractValue.

Fields and attributes

Defaults below are source expressions; Field(...) includes schema/validation settings and default_factory creates a fresh value. Inherited declarations are included. Constructor behavior follows the model or dataclass shown in the bases/decorators.

Name	Type	Default
resource	ObjectRef	required
mode	Literal['exact', 'subtree']	'exact'

bounded_input (method)

ResourceSelector.bounded_input(value: object) -> Any

immutable_fields (method)

ResourceSelector.immutable_fields() -> ContractValue

pinned_revision (method)

ResourceSelector.pinned_revision() -> ResourceSelector

Release source · Runtime guarantees · Capability guides

ResourceSelectorOwner

from cayu.collaboration import ResourceSelectorOwner

Bases: ABC.

canonical_resource_kinds (property)

ResourceSelectorOwner.canonical_resource_kinds() -> tuple[str, ...] | None

Immutable owner-configuration scope; None explicitly covers all kinds.

Other kinds retain generic exact-identity semantics, not subtree or resource-effect authority. Bind changes to the owner’s configuration.

owner (property)

ResourceSelectorOwner.owner() -> OwnerRef

Exact registered resource owner/configuration incarnation.

canonicalize (method)

ResourceSelectorOwner.canonicalize(selector: ResourceSelector) -> ResourceSelector

Resolve aliases to a pinned, bounded canonical selector, without effects.

contains (method)

ResourceSelectorOwner.contains(parent: ResourceSelector, child: ResourceSelector) -> bool

Positively validate owner-defined subtree containment, not string prefixes.

Release source · Runtime guarantees · Capability guides