runtimeoperations

Documentation

Overview

Package runtimeoperations owns the protected operational-evidence drill. It is intentionally separate from the runtime data plane: its inputs are operator-provided capabilities and it never makes a production claim from a disposable run.

Index

• Constants
• func WriteDirectLabEvidence(path string, evidence DirectLabEvidence) error
• func WriteEvidence(path string, evidence Evidence) error
• type AuditSinkEvidence
• type Config
  • func LoadConfig(getenv func(string) string) (Config, error)
  • func LoadRehearsalConfig(getenv func(string) string) (Config, error)
• type DatabaseEvidence
• type DirectLabEvidence
  • func ReadDirectLabEvidence(path string) (evidence DirectLabEvidence, err error)
  • func RunDirectLab(ctx context.Context, config Config, localCAPEM []byte) (DirectLabEvidence, error)
  • func (evidence DirectLabEvidence) Validate() error
• type Evidence
  • func ReadEvidence(path string) (evidence Evidence, err error)
  • func Run(ctx context.Context, config Config) (Evidence, error)
  • func RunRehearsal(ctx context.Context, config Config, localCAPEM []byte) (Evidence, error)
  • func (evidence Evidence) Validate() error
• type PITREvidence

Constants

const (
	RunnerContract         = "protected-runtime-operations-v1"
	SchemaVersion          = "agent-runtime.operations-evidence/v1"
	DirectLabSchemaVersion = "agent-runtime.direct-lab-evidence/v1"
	DirectLabProofLevel    = "direct_authorized_disposable_operational_lab"
)

Functions

func WriteDirectLabEvidence

func WriteDirectLabEvidence(path string, evidence DirectLabEvidence) error

WriteDirectLabEvidence writes a new redacted direct-lab record. Its schema is intentionally incompatible with WriteEvidence and protected artifacts.

func WriteEvidence

func WriteEvidence(path string, evidence Evidence) error

WriteEvidence creates a report only after a successful validated run. It never replaces an earlier artifact, preventing a local retry from masking a protected-run record.

Types

type AuditSinkEvidence

type AuditSinkEvidence struct {
	OutageStatus     int   `json:"outage_status"`
	RecoveryStatus   int   `json:"recovery_status"`
	RetentionSeconds int64 `json:"retention_seconds"`
}

type Config

type Config struct {
	SourceDSN, RestoreDSN                   string
	AuditSinkURL, AuditRetentionURL         string
	RetentionTenant, RetentionAuthorization string
	PITRTenant, PITRAuthorization           string
	PITRRecoveryPoint, SourceRevision       string
	PITRExpectedGeneration                  int64
}

Config contains only the explicit protected-run authority. It is never marshalled into the retained report.

func LoadConfig

func LoadConfig(getenv func(string) string) (Config, error)

LoadConfig requires every protected-run capability. Missing authority is a refusal, not a blocked evidence artifact.

func LoadRehearsalConfig

func LoadRehearsalConfig(getenv func(string) string) (Config, error)

LoadRehearsalConfig loads the same database, audit-sink, and restore inputs as the protected drill without accepting a runner contract. It exists only for disposable local rehearsals: callers must not write or retain Evidence from this configuration as protected operational proof.

type DatabaseEvidence

type DatabaseEvidence struct {
	AppRoleMember      bool `json:"app_role_member"`
	OperatorRoleMember bool `json:"operator_role_member"`
	RetentionScheduled bool `json:"retention_scheduled"`
	RetentionExecuted  bool `json:"retention_executed"`
	PartitionCount     int  `json:"partition_count"`
}

type DirectLabEvidence

type DirectLabEvidence struct {
	SchemaVersion  string            `json:"schema_version"`
	ProofLevel     string            `json:"proof_level"`
	Result         string            `json:"result"`
	OccurredAt     string            `json:"occurred_at"`
	SourceRevision string            `json:"source_revision"`
	Environment    string            `json:"environment"`
	Database       DatabaseEvidence  `json:"database"`
	AuditSink      AuditSinkEvidence `json:"audit_sink"`
	PITR           PITREvidence      `json:"pitr"`
	Limitations    []string          `json:"limitations"`
}

DirectLabEvidence records the same observable database, audit-sink, and isolated-restore exercise as the protected drill, but is intentionally a different schema and proof level. It cannot be mistaken for production or protected-run evidence.

func ReadDirectLabEvidence

func ReadDirectLabEvidence(path string) (evidence DirectLabEvidence, err error)

ReadDirectLabEvidence accepts only the explicitly non-production lab schema.

func RunDirectLab

func RunDirectLab(ctx context.Context, config Config, localCAPEM []byte) (DirectLabEvidence, error)

RunDirectLab performs a deliberately authorized disposable operational lab. The returned record is separate from protected evidence and contains no endpoints, credentials, tenant IDs, or authority identifiers.

func (DirectLabEvidence) Validate

func (evidence DirectLabEvidence) Validate() error

Validate checks the direct-lab schema without accepting it as protected operational evidence.

type Evidence

type Evidence struct {
	SchemaVersion  string            `json:"schema_version"`
	ProofLevel     string            `json:"proof_level"`
	Result         string            `json:"result"`
	OccurredAt     string            `json:"occurred_at"`
	SourceRevision string            `json:"source_revision"`
	Database       DatabaseEvidence  `json:"database"`
	AuditSink      AuditSinkEvidence `json:"audit_sink"`
	PITR           PITREvidence      `json:"pitr"`
	Limitations    []string          `json:"limitations"`
}

Evidence is the redacted, schema-validated outcome of one actual protected run. It deliberately contains no DSN, endpoint, credential, or authority ID.

func ReadEvidence

func ReadEvidence(path string) (evidence Evidence, err error)

ReadEvidence parses and validates a retained artifact without connecting to any external system.

func Run

func Run(ctx context.Context, config Config) (Evidence, error)

Run verifies the operator-prepared, live controls. It fails before a report is written if any authorization, database observation, sink phase, or PITR recovery check cannot be observed through the supplied capabilities.

func RunRehearsal

func RunRehearsal(ctx context.Context, config Config, localCAPEM []byte) (Evidence, error)

RunRehearsal executes the same observations using a caller-supplied local CA bundle. It is for disposable local services only and returns no retained evidence artifact itself.

func (Evidence) Validate

func (evidence Evidence) Validate() error

Validate checks the retained schema before a report is written or accepted.

type PITREvidence

type PITREvidence struct {
	ArchiveModeOn       bool   `json:"archive_mode_on"`
	SourcePrimary       bool   `json:"source_primary"`
	IsolatedTarget      bool   `json:"isolated_target"`
	RecoveredGeneration int64  `json:"recovered_generation"`
	RecoveryPoint       string `json:"recovery_point"`
}