ReactorEvent
in package
One hook firing, delivered to a reactor and **already verified** (CONTRACT.md §22.3).
By the time a handler sees one of these, its key_version, MAC, freshness and
nonce have all been checked, in that order. A runtime that hands an unverified
payload to user code has already lost — the handler will act on it, and "we
checked afterwards" is not a check.
§22.12: the payload, the patch, the reason and the decision are not
sensitive in the §7 sense and remain readable, because a handler that cannot
inspect the event cannot decide anything. They are, however, tenant business
data — do not log the payload at info level. The nonce, correlationId and
the signature are not secrets and may be logged for correlation.
Table of Contents
Properties
- $correlationId : string
- $deadline : float
- $event : string
- $issuedAt : int
- $nonce : string
- $payload : array<string|int, mixed>
- $tenantId : string
- $timeoutMs : int
Methods
- __construct() : mixed
- chainPatch() : array<string, string>|null
- The patch accumulated by earlier reactors in the chain (§22.3's `_reactor_patch`), or null when this is the first reactor consulted.
- spec() : ReactorEventSpec|null
- This event's §22.5 registry entry.
Properties
$correlationId read-only
public
string
$correlationId
$deadline read-only
public
float
$deadline
$event read-only
public
string
$event
$issuedAt read-only
public
int
$issuedAt
$nonce read-only
public
string
$nonce
$payload read-only
public
array<string|int, mixed>
$payload
$tenantId read-only
public
string
$tenantId
$timeoutMs read-only
public
int
$timeoutMs
Methods
__construct()
public
__construct(string $tenantId, string $event, string $correlationId, array<string, mixed> $payload, int $timeoutMs, string $nonce, int $issuedAt, float $deadline) : mixed
Parameters
- $tenantId : string
-
The tenant this event belongs to.
- $event : string
-
The §22.5 registry name, e.g. ReactorEvents::TOKEN_PRE_ISSUE.
- $correlationId : string
-
The single-use handle for this dispatch. The runtime copies it from the EVENT BODY into the REPLY BODY; copying it only into the AMQP property produces a reply the server discards (§22.1).
- $payload : array<string, mixed>
-
The event-specific body. It never carries a credential, a token or a signing key — a reactor is told what is being decided, not handed the means to act on it elsewhere.
- $timeoutMs : int
-
How long the server will wait for THIS dispatch. It is inside the signed body, so it cannot be widened in transit.
- $nonce : string
-
The §8 v2 replay nonce. Not a secret.
- $issuedAt : int
-
The signed
issued_at, as a Unix timestamp. - $deadline : float
-
When the runtime stops waiting on the handler: the moment this delivery was RECEIVED plus
timeoutMs, as a Unix timestamp with fractional seconds.Measured from receipt rather than from
issuedAton purpose: the freshness window is ±300 s while a timeout is typically 500 ms, so a clock a couple of seconds behind the server would compute a window that has already closed for every event and answer nothing at all.
chainPatch()
The patch accumulated by earlier reactors in the chain (§22.3's `_reactor_patch`), or null when this is the first reactor consulted.
public
chainPatch() : array<string, string>|null
It is READ-ONLY context, provided so a later reactor decides against the state that will actually be committed. Echoing it back inside this reactor's own patch is not how a field is preserved: the server merges the chain itself, as a union with last-write-wins per key (§22.6).
Return values
array<string, string>|nullspec()
This event's §22.5 registry entry.
public
spec() : ReactorEventSpec|null
Never null in practice: the runtime refuses a name outside the registry before a handler is ever called.