Annotation reference

Every (spec.*) option tacplus reads, generated from pkg/proto/sys/spec.proto and its comments on every build of this site. Import it with import "sys/spec.proto";; tacplus supplies the file to every build.

Options are grouped by where they are set. An option whose type is a message is written as a text-format message literal ({name: "notes"}); its fields are listed under option types.

Set on	Options
file	17
service	8
method	8
message	23
field	86
enum value	1

All options

Option	Set on	Type	Summary
spec.string_const	file	repeated StringConst	StringConst defines string constants at the file level
spec.int_const	file	repeated IntConst	IntConst defines integer constants at the file level
spec.float_const	file	repeated FloatConst	FloatConst defines floating-point constants at the file level
spec.bool_const	file	repeated BoolConst	BoolConst defines boolean constants at the file level
spec.generate_user_api	file	bool	GenerateUserApi marks this proto file for user API code generation When true, tacplus will generate service wrappers, HTTP clients, and example implementations
spec.service	file	ServiceAnnotation	service declares the owning service identity for this proto file.
spec.state_imports	file	repeated StateImport	state_imports is a legacy file-level mirror for field-level state_import roots.
spec.opa_import	file	repeated OpaImport	opa_import declares dependencies on OPA eval definitions.
spec.timeseries_store	file	TimeseriesStoreAnnotation	timeseries_store marks this service as a timeseries data store.
spec.grpc_s2s_client	file	repeated GrpcS2SClient	grpc_s2s_client declares service-to-service gRPC client dependencies. tacplus generates typed gRPC client wrappers for each referenced service.
spec.grpc_c2s_client	file	repeated GrpcC2SClient	grpc_c2s_client declares client-facing service dependencies for this service. tacplus.yaml selects whether those dependencies emit C2S, W2S, or both.
spec.grpc_w2s_client	file	repeated GrpcW2SClient	grpc_w2s_client declares browser/web client-facing service dependencies. tacplus.yaml selects whether those dependencies emit C2S, W2S, or both.
spec.all_grpc_s2s_clients	file	bool	all_grpc_s2s_clients declares that this service/client needs gRPC client wrappers for ALL gRPC services in the proto source.
spec.vservice	file	VServiceAnnotation	vservice declares a virtual service identity for this proto file.
spec.record_store	file	RecordStoreAnnotation	record_store marks this service as the full-record store.
spec.trait	file	TraitAnnotation	trait declares a cross-service trait implemented by a host service.
spec.record_read	file	repeated RecordRead	record_read declares that THIS service reads the stored rows of the named (spec.record) types, through the record query plane's S2S half.
spec.json_return_value	enum value	string	JsonReturnValue specifies the JSON representation for an enum value
spec.generate_from_map	message	ParamMapConfig	Generate a FromMap method that converts map[string]string to this message type
spec.service_state	message	StateAnnotation	service_state marks a message as a state root.
spec.state_eviction_policy	message	EvictionPolicy	NOT IMPLEMENTED. state_eviction_policy would specify the default eviction policy for all boundaries in a state root message.
spec.state_sync_backup_count	message	int32	NOT IMPLEMENTED. state_sync_backup_count would specify the default sync backup count for all boundaries.
spec.state_async_backup_count	message	int32	NOT IMPLEMENTED. state_async_backup_count would specify the default async backup count for all boundaries.
spec.grpc_config	message	GrpcConfigAnnotation	grpc_config marks this message as a gRPC service's configuration. tacplus generates a generated.Services message and per-service config state boundaries.
spec.disable_auth_message	message	bool	disable_auth_message marks a service_state message as not requiring authentication.
spec.subscribe	message	repeated SubscriptionAnnotation	subscribe declares event-bus topic subscriptions for this state service.
spec.record	message	RecordAnnotation	record marks this message as a stored record (an event held in full by the record_store, the record store) and makes it projectable. key = unique id field, owner = ownership/identity field.
spec.event	message	EventAnnotation	event marks this message as an EventBus event: a topic + publish RPC are generated for it.
spec.transformation	message	repeated Transformation	transformation declares a pure typed conversion of this message into a derived row type. tacplus generates the derived message, its column annotations, and its projection_source mappings.
spec.service_event	message	ServiceEventAnnotation	service_event declares that this state root's topic publish RPCs should be exposed through the API gateway. tacplus propagates this to the generated state service as spec.service_c2s and spec.event_label options.
spec.timeseries_type	message	TimeseriesTypeAnnotation	timeseries_type opts a message into timeseries table generation. tacplus generates store-neutral conversion helpers and a gRPC service; a downstream materializer renders the concrete backend schema.
spec.service_store	message	ServiceStoreAnnotation	service_store marks a message as a durable key-value store. tacplus generates a gRPC service with Put/Get/Delete/List RPCs.
spec.opa_eval	message	OpaEvalAnnotation	opa_eval marks a message as an OPA policy evaluation input. tacplus generates a typed S2S RPC on opa for each annotated message.
spec.service_health	message	ServiceHealthAnnotation	service_health declares a typed health message for a service.
spec.per_service_config	message	bool	per_service_config marks a message whose fields are per-service configuration slices.
spec.data_entitlement	message	RedactOption	data_entitlement: message(type)-level default data-entitlement transform for the eligible fields of this message.
spec.config_slice	message	ConfigSliceAnnotation	config_slice marks a message as one per-service configuration slice with an explicit owner and scope.
spec.event_publish	message	repeated EventPublishAnnotation	event_publish declares that this actor publishes an EventBus topic.
spec.event_watch	message	repeated EventWatchAnnotation	event_watch declares that this actor watches an EventBus topic.
spec.owner_default	message	OwnerDefault	owner_default declares what the OWNER of a row of this type may do with it by default (§4b).
spec.public_view	message	bool	public_view marks a message whose fields are split between what may be shown outside the company and what never leaves it (e.g. a prospect record rendered to a prospect's page).
spec.assert_required	field	bool	Validates that a field has a value For scalar/string fields: must not be empty/zero value For repeated fields: must have at least one element
spec.assert_ipaddr_type	field	IpAddrTypes
spec.assert_enc_type	field	EncType
spec.assert_net_port	field	bool
spec.assert_url	field	UrlScheme	URL/URI validation
spec.assert_email	field	bool	Email validation
spec.assert_fqdn	field	bool	FQDN validation
spec.assert_duration	field	DurationType	Duration/Timeout validation
spec.assert_duration_min	field	int64
spec.assert_duration_max	field	int64
spec.assert_listen_addr	field	bool	Listen address validation (host:port format)
spec.assert_base64	field	bool	Base64 validation
spec.assert_enum_defined	field	bool	Enum non-zero validation (ensures enum is not 0/_UNDEFINED value)
spec.assert_file_path	field	PathType	File path validation
spec.assert_gt	field	int64	Simple numeric comparisons (for most common cases) These work with int32, int64, uint32, uint64 fields
spec.assert_ge	field	int64	greater than or equal
spec.assert_lt	field	int64	less than
spec.assert_le	field	int64	less than or equal
spec.assert_numeric	field	NumericConstraint	Complex numeric constraints (for advanced validation scenarios)
spec.assert_float	field	FloatConstraint	Floating-point constraints (for float and double fields)
spec.assert_semver	field	bool	Semantic version validation Validates that a string follows semantic versioning format (e.g., "1.0.0", "v2.3.1") Supports optional 'v' prefix and follows semver.org specification
spec.param_key	field	string	Parameter key mapping for FromMap generation Explicitly maps this field to a specific enum value for parameter parsing
spec.required_if_false	field	string	Conditional requirement: this field is required when another field equals false Specifies the name of a boolean field that, when false, makes this field required
spec.required_if_true	field	string	Conditional requirement: this field is required when another field equals true Specifies the name of a boolean field that, when true, makes this field required
spec.assert_host	field	bool	Host validation (IP address OR FQDN) Validates that a string is either a valid IP address (IPv4/IPv6) or a valid FQDN.
spec.default_string	field	string	Field-level default value annotations.
spec.default_int	field	int64
spec.default_float	field	double
spec.default_bool	field	bool	was default_double — do not reuse 60049 (removed; use default_float for all floating-point defaults, the parser always mapped it to default_float).
spec.key	field	string	key provides a string identifier for mapping on Config fields.
spec.required_if_eq	field	ConditionalRequirement	Conditional requirement: this field is required when another field equals a specific value.
spec.assert_max_size	field	uint32	assert_max_size enforces a maximum length/count on string, bytes, repeated, and map fields.
spec.assert_min_size	field	uint32	assert_min_size enforces a minimum length/count on string, bytes, repeated, and map fields.
spec.assert_element_max_size	field	uint32	assert_element_max_size enforces a maximum BYTE LENGTH on each individual element of a repeated or map field whose element type is string or bytes.
spec.assert_sql	field	SqlPermit	SQL statement validation: a syntactic sanity check, NOT an injection defense.
spec.default_const	field	string	References a file-level constant (int_const, string_const, float_const, bool_const) as the default value for this field.
spec.default_host	field	DefaultHost	Default value for host.Host fields.
spec.indexed	field	bool	Statedb field indexing: marks a field for state-store index creation
spec.index_type	field	string	Statedb index type hint for indexed fields
spec.private	field	bool	Statedb private: field can never be accessed by other services (owner RW only)
spec.state_import	field	string	state_import declares that this field's value comes from another service's exported state.
spec.queue	field	bool	queue marks a state root field as a FIFO queue.
spec.priority_queue	field	string	priority_queue marks a state root field as a priority queue.
spec.topic	field	bool	topic marks a state root field as a pub/sub topic.
spec.leader	field	bool	leader marks a queue, topic, or priority_queue field as requiring leader election.
spec.sync_backup_count	field	int32	NOT IMPLEMENTED.
spec.async_backup_count	field	int32	NOT IMPLEMENTED.
spec.eviction_policy	field	EvictionPolicy	NOT IMPLEMENTED.
spec.eviction_max_size	field	int32	Statedb eviction: maximum number of entries (or heap metric) before eviction begins.
spec.eviction_max_size_policy	field	MaxSizePolicy	NOT IMPLEMENTED.
spec.eviction_ttl_seconds	field	int64	NOT IMPLEMENTED.
spec.eviction_max_idle_seconds	field	int64	NOT IMPLEMENTED.
spec.epoch_expiration	field	bool	epoch_expiration marks an int64 field as a Unix epoch expiration timestamp (seconds).
spec.persistence	field	bool	persistence requests that a graph boundary (singleton, collection, map) be durable.
spec.refresh_on_miss	field	string	refresh_on_miss names the message type used as the lookup request for cache-miss-triggered refresh.
spec.command	field	bool	command marks this field as a command RPC on the state service.
spec.view_sources	field	repeated string	view_sources marks a field as a read-only view over multiple collection boundaries.
spec.boundary_callers	field	repeated string	boundary_callers lists services allowed to call this boundary cross-namespace.
spec.view_member	field	repeated string	view_member registers this collection as a contributing source to one or more named cross-boundary views.
spec.instance_keyed	field	bool	instance_keyed: server extracts instance_id from the caller's token and uses "service_id@instance_id" as the entry key.
spec.store_key	field	bool	store_key marks a field as the entry key for a service_store message.
spec.quorum_write	field	bool	quorum_write marks a state field as requiring write quorum: the write is acked only after the value is durable on (spec.min_durable_copies) distinct nodes.
spec.min_durable_copies	field	int32	min_durable_copies is how many distinct nodes must hold a value durably before a (spec.quorum_write) field's write is acked.
spec.collected_health	field	bool	collected_health marks a state boundary for Sentinel health collection.
spec.projection_source	field	string	projection_source maps a projection field to its source path on the event message.
spec.projection_record_key	field	bool	projection_record_key marks the projection field that carries the SOURCE RECORD's key. tacplus auto-injects this field (or marks the existing one) on every timeseries projection so the projection query can return record keys — the record store federates into a projection, gets record keys, and hydrates the full records from the record_store.
spec.assert_invariant	field	string	assert_invariant declares a formal invariant for this field.
spec.cache	field	bool	cache marks this field for projection into the hot cache.
spec.timeseries	field	bool	timeseries marks this field for projection into the timeseries store.
spec.json_key	field	string	JSON key override: specifies the output key used in JSON serialization.
spec.json_aliases	field	repeated string	JSON aliases: additional keys accepted during JSON deserialization.
spec.timeseries_column	field	TimeseriesFieldOption	── Timeseries Projection Annotations ──────────────────────────────────────── Controls how individual fields map to timeseries columns.
spec.identity_namespace	field	bool	identity_namespace: this string field holds an authorization-tree namespace path; generated code normalizes it via normalize_namespace before use.
spec.identity_subject	field	bool	identity_subject: this string field holds a stable principal subject id (the sub), not a full SPIFFE URI.
spec.identity_spiffe_subject	field	bool	identity_spiffe_subject: this string field holds a full SUBJECT SPIFFE ID, constructed/validated via sys/spiffe (durable subject key, e.g. workload).
spec.identity_spiffe_resource	field	IdentitySpiffeResource	identity_spiffe_resource: this string field holds a RESOURCE SPIFFE ID that tacplus constructs from sibling fields; see IdentitySpiffeResource.
spec.query_field	field	QueryFieldOption	query_field: marks this record field as a typed filter criterion for the generated RecordMap query plane (Open<T>Query / Refine<T>). tacplus emits a typed <T>Filter message from the queryable fields.
spec.redact	field	RedactOption	redact: marks this record field as REDACTABLE AT EGRESS.
spec.principal	field	bool	principal: this REQUEST string field carries the caller's principal.
spec.store_principal	field	bool	store_principal: this RECORD string field holds the row's owning principal.
spec.identity_spiffe_actor	field	bool	identity_spiffe_actor: this OPTIONAL string field holds the delegated- mint actor's identity, stamped by EventBus from the token's act claim (JWT_PAYLOAD_TYPE_ACT) at publish time — the delegate/agent that made the call on the user's behalf, distinct from (spec.identity_spiffe_subject) which is always the authenticated caller (the user, when delegated).
spec.store_epoch	field	bool	store_epoch: this RECORD int64 field holds the row's STORE EPOCH — Unix milliseconds of the row's LAST WRITE, stamped by the generated wrapper.
spec.namespace	field	bool	namespace: this REQUEST string field carries the caller's namespace.
spec.store_namespace	field	bool	store_namespace: this RECORD string field holds the row's owning namespace.
spec.deleted_flag	field	bool	deleted_flag: this RECORD bool field records the row's SOFT-DELETE state.
spec.visibility	field	Visibility	visibility: on a field of a (spec.public_view) message, whether the field may be rendered outside the company (VISIBILITY_SHOW) or never leaves it (VISIBILITY_BACKGROUND).
spec.event_label	service	string	event_label is the routing label for gateway-exposed event services.
spec.service_s2s	service	ServiceS2SAnnotation	service_s2s declares a service-to-service gRPC service.
spec.service_c2s	service	ServiceC2SAnnotation	service_c2s declares a client-to-service gRPC service.
spec.service_c2d	service	ServiceC2DAnnotation	service_c2d declares a client-to-daemon gRPC service.
spec.token_minter	service	TokenMinterAnnotation	token_minter explicitly marks the cluster's token mint service so the bootstrap exchanger codegen targets it by fully-qualified name instead of scanning for mint RPC signatures.
spec.smb	service	SmbAnnotation	smb (Service Mesh Blackbox) marks a service whose OWN INSTANCES communicate over a black-box peer protocol within a single cluster (SPIFFE plan D7).
spec.smb_authority	service	SmbAuthorityAnnotation	smb_authority marks the consumer service that issues isolated per-SMB CAs and member certs for spec.smb services — declared EXPLICITLY (like token_minter), not inferred. tacplus targets the service carrying this annotation as the SMB cert authority and fails generation if spec.smb services exist with no authority declared. tacplus does not implement the authority; the designated consumer service does.
spec.volume_group	service	repeated VolumeGroupAnnotation	volume_group declares a named blob-store volume group owned by this service — its accepted content types, per-blob size ceiling and per-tenant quota, fixed at build time.
spec.rest_method	method	RestMethods	rest_method declares additional HTTP methods for this RPC's REST endpoint.
spec.rest_path	method	string	rest_path adds an additional alias REST route for this method.
spec.proof_requires	method	string	proof_requires declares a precondition on an RPC method.
spec.proof_ensures	method	string	proof_ensures declares a postcondition on an RPC method.
spec.method_collection	method	MethodCollection	method_collection marks a collection-returning read and declares its shape.
spec.rpc	method	RpcAnnotation	rpc declares an RPC's call surface: who calls it (principal), where it is reachable from (exposure), its non-exclusive protocol flags, the service identities allowed to call it, and its target namespace field.
spec.min_group_size	method	int32	min_group_size is the smallest result size this RPC will disclose.
spec.rest_browser	method	RestBrowser	rest_browser makes this RPC's REST route a browser form target: a form-urlencoded request body, and a 303 redirect instead of a JSON answer.