Struct RpcContext 

pub struct RpcContext {

    pub config: LiveConfigHandle,
    pub config_authority: LiveConfigAuthority,
    pub agent_lifecycle: AgentLifecycleCoordinator,
    pub sessions: Arc<SessionStore>,
    pub session_backend: Option<Arc<dyn SessionBackend>>,
    pub memory: Option<Arc<dyn Memory>>,
    pub cost_tracker: Option<Arc<CostTracker>>,
    pub event_tx: Option<Sender<Value>>,
    pub event_history: Option<Arc<EventBuffer>>,
    pub subscriptions: Arc<SubscriptionHub>,
    pub reload_tx: Option<Sender<bool>>,
    pub gateway_shutdown_tx: Option<Sender<bool>>,
    pub approval_pending: Arc<ApprovalPendingMap>,
    pub tui_registry: Arc<TuiRegistry>,
    pub acp_session_store: Option<Arc<AcpSessionStore>>,
    pub sop_engine: Option<Arc<Mutex<SopEngine>>>,
    pub sop_driver_handles: Option<SopDriverHandles>,
    pub sop_audit: Option<Arc<SopAuditLogger>>,
    pub hooks: Option<Arc<HookRunner>>,
    pub cert_audit: Option<Arc<AuditLogger>>,
    pub auth: Arc<RpcInboundAuth>,
    /* private fields */
}

Daemon-wide state shared across all RPC connections.

Fields

config: LiveConfigHandle

Read-only live config handle: RPC readers observe the published config and its revision as one pair and cannot bypass publication with a raw write. Mutating handlers admit through RpcContext::begin_config_commit instead.

config_authority: LiveConfigAuthority

The live-config authority that owns this context’s publication transaction: the process-wide writer mutex, the parent config-write lifecycle lease, and the published pair. Every RPC config writer serializes through it before cloning the current config, and the irreversible save-and-publish phase of each commit runs retained (see save_and_publish_config in dispatch.rs), so request cancellation cannot abandon a dispatched commit.

agent_lifecycle: AgentLifecycleCoordinator

Alias-scoped admission and destructive lifecycle authority paired with this context’s live config identity.

sessions: Arc<SessionStore>

In-memory session store for active RPC sessions.

session_backend: Option<Arc<dyn SessionBackend>>

Persistent session backend (SQLite / JSONL) for history and session metadata. None when persistence is disabled.

memory: Option<Arc<dyn Memory>>

Memory subsystem (dyn Memory from zeroclaw-api).

cost_tracker: Option<Arc<CostTracker>>

Cost tracking. None when cost tracking is disabled.

event_tx: Option<Sender<Value>>

Daemon-wide event broadcast. RPC handlers subscribe to forward events as JSON-RPC notifications (logs/subscribe).

event_history: Option<Arc<EventBuffer>>

Recent observer frames on the same bus (events/history). None when there is no daemon event bus.

subscriptions: Arc<SubscriptionHub>

Replayable, bounded subscription sources (logs/subscribe, events/subscribe). The daemon feeds it from its event bus.

reload_tx: Option<Sender<bool>>

Write true to trigger a daemon-level config reload. Mirrors the gateway’s /admin/reload mechanism.

gateway_shutdown_tx: Option<Sender<bool>>

Write true to ask the current gateway listener to shut down before daemon reload rebinds the same address.

approval_pending: Arc<ApprovalPendingMap>

In-flight approval requests waiting for session/approve RPC calls.

tui_registry: Arc<TuiRegistry>

Live TUI client registry. Tracks connected TUI sessions by UID. Source of truth for “which TUIs are connected right now.”

acp_session_store: Option<Arc<AcpSessionStore>>

ACP session persistence. Opened (and the DB file created) at daemon boot under <data_dir>/sessions/acp-sessions.db. None when the store could not be opened (read-only FS, bad perms) — callers must treat persistence as best-effort.

sop_engine: Option<Arc<Mutex<SopEngine>>>

Shared SOP engine from the daemon (for RPC/TUI agent sessions). None when standalone — sessions build their own.

sop_driver_handles: Option<SopDriverHandles>

The daemon generation’s driver supervisor set. Approval surfaces register resumed headless drivers here so reload drains them instead of letting them run detached under superseded configuration.

sop_audit: Option<Arc<SopAuditLogger>>

hooks: Option<Arc<HookRunner>>

Lifecycle hook runner. None when hooks are disabled in config.

cert_audit: Option<Arc<AuditLogger>>

The daemon’s single certificate audit logger — the ONE writer of the Merkle-chained audit file, shared by enrollment, in-band renewal and the issued-cert ledger.

This field is the source of truth for “which logger owns the audit file”. AuditLogger serializes writers with a mutex held inside the instance, so a per-request logger only appears safe: two instances recover the same chain tip and both claim it, and verify_chain then rejects a file every individual write was correct against. Certificate paths must clone this Arc, never call AuditLogger::new.

None only when the logger could not be constructed (for example sign_events = true with no usable ZEROCLAW_AUDIT_SIGNING_KEY). Certificate paths fail closed on None rather than issuing credentials with no trail.

auth: Arc<RpcInboundAuth>

Inbound authentication layer: providers, shared resolver, and the live pairing/roster authorities. Always present — a default config yields the legacy local shared-operator behavior, never a bypass.

Implementations

impl RpcContext

pub fn for_live_test(config: Config, sessions: Arc<SessionStore>) -> Arc<Self>