Ingest of the agent-middleware shape (before_model / after_model /
before_tool composition) as a JCP standard crate — the one capability
LangChain's v1 stack has that JCP lacked a unifying abstraction for.
A Chain runs Interceptors onion-order across the model/tool seams; each
Step is Continue / Halt (refuse) / Hold (human approval). Every step is
metered (jcp-energy) and sealed as an intercept/1 JCR-1 receipt carrying
the request digest before and after the step (a redaction or trim is
provable — the content itself never sealed, only its hash), hash-chained.
The per-step signed audit + honest joules are what arbitrary in-process
middleware hooks lack.
Three reference interceptors reuse existing family primitives: Redact
(content transform), CallLimit (guardrail), Approve (human-in-the-loop
hold). verify()/verify_chain() recover fields and check the chain.
8 tests green, clippy clean, jcp-rs workspace builds. Added to workspace
members + jcp/README.md.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
0a8fb7791b