tooldispatch

Documentation

Overview

Package tooldispatch exposes the private trigger boundary for broker-owned tool dispatch. Callers never receive a descriptor, grant, lease, or result.

Index

• Constants
• Variables
• func NewControlClient(ctx context.Context, endpoint, serverName string, trust MountedTrustSource, ...) (sandbox.Client, error)
• func NewHTTPServer(handler http.Handler, certificate tls.Certificate, peerPolicy string) (*http.Server, error)
• func RunTriggerLoop(ctx context.Context, client TriggerClient, scheduler TriggerScheduler, ...) error
• type Client
  • func NewClient(endpoint, token string, client *http.Client) (*Client, error)
  • func NewTrustedClient(endpoint, token, serverName, trustPath string) (*Client, error)
  • func (client *Client) DispatchOnce(ctx context.Context) (Receipt, error)
• type MountedTrustSource
  • func (source MountedTrustSource) ResolveTrustBundle(ctx context.Context, reference sandbox.TrustBundleRef) (sandbox.TrustBundle, error)
• type Process
  • func NewProcess(ctx context.Context, triggerToken string, config ProcessConfig) (*Process, error)
  • func (process *Process) Close()
  • func (process *Process) ServeHTTP(writer http.ResponseWriter, request *http.Request)
• type ProcessConfig
• type Receipt
• type ScanOnce
• type Server
  • func NewBrokerServer(token string, worker *runtimetool.Worker) (*Server, error)
  • func NewServer(token string, scan ScanOnce) (*Server, error)
  • func (server *Server) ServeHTTP(writer http.ResponseWriter, request *http.Request)
• type TokenCredentials
  • func (value TokenCredentials) Apply(_ context.Context, sink sandbox.CredentialSink) error
• type TriggerClient
• type TriggerScheduler
  • func NewRealtimeTriggerScheduler() TriggerScheduler

Constants

const (
	Audience = "runtime-tool-dispatch/v1"
	Role     = "tool"
)

Variables

var ErrTransientUnavailable = errors.New("tool dispatch temporarily unavailable")

ErrTransientUnavailable marks the narrow set of transport failures that can occur while the broker Service is being brought up. It deliberately does not cover a non-success HTTP response: authentication, authorization, and protocol failures must remain fatal to the trigger role.

Functions

func NewControlClient

func NewControlClient(ctx context.Context, endpoint, serverName string, trust MountedTrustSource, token string) (sandbox.Client, error)

NewControlClient builds the only allowed dispatch adapter transport.

func NewHTTPServer

func NewHTTPServer(handler http.Handler, certificate tls.Certificate, peerPolicy string) (*http.Server, error)

NewHTTPServer returns the bounded TLS-only server used by the dispatch role. The bearer-token peer policy is intentionally explicit: this private role authenticates callers at the handler and never accepts a plaintext listener.

func RunTriggerLoop

func RunTriggerLoop(ctx context.Context, client TriggerClient, scheduler TriggerScheduler, interval time.Duration) error

RunTriggerLoop performs an immediate bounded scan followed by interval scans. It owns no execution input and stops promptly with its context.

Types

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client is the trigger-only RoleTool authority. It has no execution request fields and cannot select a tenant, operation, or recovery mode.

func NewClient

func NewClient(endpoint, token string, client *http.Client) (*Client, error)

func NewTrustedClient

func NewTrustedClient(endpoint, token, serverName, trustPath string) (*Client, error)

NewTrustedClient creates the production trigger client from one mounted CA bundle. RoleTool cannot substitute ambient roots or skip hostname checks.

func (*Client) DispatchOnce

func (client *Client) DispatchOnce(ctx context.Context) (Receipt, error)

type MountedTrustSource

type MountedTrustSource struct {
	Path      string
	Reference sandbox.TrustBundleRef
}

MountedTrustSource resolves exactly one operator-mounted CA bundle; it never falls back to ambient system roots.

func (MountedTrustSource) ResolveTrustBundle

func (source MountedTrustSource) ResolveTrustBundle(ctx context.Context, reference sandbox.TrustBundleRef) (sandbox.TrustBundle, error)

type Process

type Process struct {
	// contains filtered or unexported fields
}

Process owns the broker worker and every private client it requires.

func NewProcess

func NewProcess(ctx context.Context, triggerToken string, config ProcessConfig) (*Process, error)

NewProcess composes one broker-owned durable tool worker. It deliberately has no public request parameters: selection, grants, descriptors, and effect recovery stay inside runtimetool.Worker.

func (*Process) Close

func (process *Process) Close()

Close releases the process-owned state connection pool. Sandbox client requests are self-contained and do not retain a closeable transport here.

func (*Process) ServeHTTP

func (process *Process) ServeHTTP(writer http.ResponseWriter, request *http.Request)

type ProcessConfig

type ProcessConfig struct {
	DatabaseDSN       string
	ContentEndpoint   string
	ContentBucket     string
	ContentAccessKey  string
	ContentSecretKey  string
	ControlEndpoint   string
	ControlServerName string
	ControlTrust      MountedTrustSource
	ControlToken      string
	Claimer           string
}

ProcessConfig contains only the private authorities held by the broker process. The trigger endpoint and receipt never expose these fields.

type Receipt

type Receipt struct {
	Attempted bool `json:"attempted"`
}

Receipt intentionally reveals no work identity or output.

type ScanOnce

type ScanOnce func(context.Context) error

ScanOnce drains already-authorized durable tool work. The implementation is broker-owned and retains every execution authority.

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server authenticates a trigger-only role to request one bounded scan.

func NewBrokerServer

func NewBrokerServer(token string, worker *runtimetool.Worker) (*Server, error)

NewBrokerServer composes the dispatch service with the broker-owned worker. The worker, not the trigger client, retains the state/content/adapter authorities required to claim, reconcile, and finalize an operation.

func NewServer

func NewServer(token string, scan ScanOnce) (*Server, error)

func (*Server) ServeHTTP

func (server *Server) ServeHTTP(writer http.ResponseWriter, request *http.Request)

type TokenCredentials

type TokenCredentials string

TokenCredentials applies the operator-provided control credential only to a sandbox client request; callers must not log or serialize this value.

func (TokenCredentials) Apply

func (value TokenCredentials) Apply(_ context.Context, sink sandbox.CredentialSink) error

type TriggerClient

type TriggerClient interface {
	DispatchOnce(context.Context) (Receipt, error)
}

TriggerClient is the narrow RoleTool authority required to ask the broker to scan already-authorized work.

type TriggerScheduler

type TriggerScheduler interface {
	After(time.Duration) <-chan time.Time
}

TriggerScheduler supplies the next declared trigger opportunity. Keeping it at the composition boundary makes the bounded loop deterministic in tests.

func NewRealtimeTriggerScheduler

func NewRealtimeTriggerScheduler() TriggerScheduler

NewRealtimeTriggerScheduler returns the production scheduler for injection at the application composition root.