dockerdeploy

package
v0.0.0-...-d0f7b40 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 16, 2026 License: MIT Imports: 65 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	ControlledSessionExecutionPlanSchemaV1 = "controlled-session-execution-plan-v1"
	ControlledSessionContainerPlanSchemaV1 = "controlled-session-container-plan-v1"
)
View Source 
const (
	ReployInternalDir    = ".reploy"
	DockerEnvFileName    = ".reploy/docker.env"
	RuntimeDirName       = ".reploy/runtime"
	ComposeFileName      = RuntimeDirName + "/compose.yaml"
	StateFileName        = ".reploy/state.json"
	ToolBinaryFileName   = ".reploy/bin/reploy"
	DefaultDeploymentDir = "reploy-staging"
)
View Source 
const (
	LocalSourceRecipeFilename         = ".reploy.yaml"
	LocalSourceRecipeSchemaV1         = 1
	LocalSourceRecipeIdentitySchemaV1 = "local-source-build-recipe-v1"
	PythonBuildTypePEP517             = pythonprovider.SourceBuildTypePEP517
	PythonBuildTypeSetuptoolsLegacy   = pythonprovider.SourceBuildTypeLegacy
)
View Source 
const (
	PortableToolProbeEvidenceSchemaV1 = "portable-tool-probe-evidence-v1"
	PortableToolProbeExecutorV1       = "portable-tool-probe-executor-v1"

	PortableToolProbeOutcomePassV1        = "pass"
	PortableToolProbeOutcomeExitV1        = "exit-failure"
	PortableToolProbeOutcomeTimeoutV1     = "timeout"
	PortableToolProbeOutcomeOutputLimitV1 = "output-limit"
)
View Source 
const (
	ProbeContainerRoot       = "/.reploy-validation"
	ProbeContainerExecutable = ProbeContainerRoot + "/" + probearchive.ExtractedFileName
)
View Source 
const (
	ControlledSessionControllerPackageSchemaV1 = "controlled-session-controller-package-v1"
)
View Source 
const MaterializationDockerfileSyntax = "docker/dockerfile:1.24.0@sha256:87999aa3d42bdc6bea60565083ee17e86d1f3339802f543c0d03998580f9cb89"
View Source 
const MaterializationRendererProfile = "docker-materialization-v1"
View Source 
const PortableToolCaseValidatorVersionV1 = "reploy-portable-tool-case-v2"
View Source 
const (
	PrivateWorkloadEnvironmentFileName = ".env"
)
View Source 
const (
	// SourceBuilderExportsDirectoryV1 is the Reploy-owned directory inside a
	// prepared source-builder image that exposes exactly the selected
	// portable-tool exports by name. It is prepended to PATH only for
	// source-build commands and never reaches an application image.
	SourceBuilderExportsDirectoryV1 = "/opt/reploy/exports"
)

Variables

View Source 
var ErrLiveRunStoppedV1 = errors.New("live run was stopped")

Functions

func AcceptMaterializationLayer 

func AcceptMaterializationLayer(
	ctx context.Context,
	input MaterializationEvidenceInput,
	run MaterializationEvidenceRunner,
) (providers.GraphNodeMaterializeResult, error)

AcceptMaterializationLayer is the publication boundary for one provider prefix. An inspected Docker image remains only a candidate until this function validates complete evidence for the transaction's generated tools and the bundle's public outputs.

func AcknowledgeControlledSessionIncidentReceiptV1 

func AcknowledgeControlledSessionIncidentReceiptV1(
	ctx context.Context,
	deploymentDirectory string,
	liveRunID string,
) (bool, error)

AcknowledgeControlledSessionIncidentReceiptV1 removes only one validated receipt after its consumer has handled it. Missing receipts are idempotent.

func AddRequestOverlayOptions 

func AddRequestOverlayOptions(ctx context.Context, dir string, arguments []string) (deploy.RequestOverlayMutationResult, error)

func AddRequestOverlayPackages 

func AddRequestOverlayPackages(ctx context.Context, dir string, component string, requirements []string) (deploy.RequestOverlayMutationResult, error)

func AppCommand 

func AppCommand(options AppCommandOptions) error

func ApplicationRuntimeLayerDockerfile 

func ApplicationRuntimeLayerDockerfile(request ApplicationRuntimeLayerBuildRequest) ([]byte, error)

func AssembleBuildLock 

func AssembleBuildLock(
	ctx context.Context,
	store providerstore.Store,
	input BuildLockAssemblyInput,
) (deploy.BuildLockV1, error)

AssembleBuildLock publishes the graph's canonical bundle manifests and constructs the immutable lock. State and image-reference publication remain a separate crash-recoverable boundary.

func AwaitControlAdmissionV1 

func AwaitControlAdmissionV1(
	ctx context.Context,
	deploymentDir string,
	operation *deploy.OperationLock,
	candidate deploy.ControlMarkerV1,
	wait bool,
) (*deploy.OperationLock, error)

AwaitControlAdmissionV1 takes ownership of operation. On success it returns the operation lock held and the marker active. On failure it releases the lock and removes the caller's waiting marker whenever possible.

func AwaitControlAdmissionWithNoticeV1 

func AwaitControlAdmissionWithNoticeV1(
	ctx context.Context,
	deploymentDir string,
	operation *deploy.OperationLock,
	candidate deploy.ControlMarkerV1,
	wait bool,
	notice io.Writer,
) (*deploy.OperationLock, error)

func AwaitLiveRunAdmissionV1 

func AwaitLiveRunAdmissionV1(
	ctx context.Context,
	deploymentDir string,
	operation *deploy.OperationLock,
	candidate deploy.LiveRunV1,
	wait bool,
) (*deploy.OperationLock, error)

AwaitLiveRunAdmissionV1 takes ownership of operation. On success it returns the operation lock held for the admitted active run. On failure it releases the lock and removes a queued entry before returning whenever possible.

func AwaitLiveRunAdmissionWithNoticeV1 

func AwaitLiveRunAdmissionWithNoticeV1(
	ctx context.Context,
	deploymentDir string,
	operation *deploy.OperationLock,
	candidate deploy.LiveRunV1,
	wait bool,
	notice io.Writer,
) (*deploy.OperationLock, error)

func BuildAndAcceptMaterializationLayer 

func BuildAndAcceptMaterializationLayer(
	ctx context.Context,
	store providerstore.Store,
	transaction providers.MaterializationTransaction,
	bundle providers.ResolvedBundle,
	platform blueprint.Platform,
	runEvidence MaterializationEvidenceRunner,
	options RunOptions,
) (providers.GraphNodeMaterializeResult, error)

BuildAndAcceptMaterializationLayer builds one provider layer and returns a graph result only after immutable inspection and exact generated/public executable validation have succeeded.

func BuildResolvedRequestV1 

func BuildResolvedRequestV1(
	document blueprint.Document,
	overlay deploy.RequestOverlayV1,
	platform blueprint.Platform,
	sources []providers.ResolvedSourceInput,
) (providers.ResolvedRequestV1, error)

func BuildResolvedRequestWithOverridesV1 

func BuildResolvedRequestWithOverridesV1(
	document blueprint.Document,
	overlay deploy.RequestOverlayV1,
	packageOverrides deploy.PackageOverrideIntentV1,
	baseImage string,
	platform blueprint.Platform,
	sources []providers.ResolvedSourceInput,
) (providers.ResolvedRequestV1, error)

func BuildResolvedRequestWithPackageOverridesV1 

func BuildResolvedRequestWithPackageOverridesV1(
	document blueprint.Document,
	overlay deploy.RequestOverlayV1,
	packageOverrides deploy.PackageOverrideIntentV1,
	platform blueprint.Platform,
	sources []providers.ResolvedSourceInput,
) (providers.ResolvedRequestV1, error)

func CollectAPTOutputEvidence 

func CollectAPTOutputEvidence(
	ctx context.Context,
	store providerstore.Store,
	descriptor deploy.ImageDescriptor,
	checks []FullImageExecutableProbe,
	bundle providers.ResolvedBundle,
) (result []providers.ExecutableEvidence, resultErr error)

CollectAPTOutputEvidence performs filesystem probing and exact dpkg owner attribution in one held, networkless validation container.

func CollectApplicationPortableNativeExportEvidenceV1 

func CollectApplicationPortableNativeExportEvidenceV1(
	ctx context.Context, store providerstore.Store, image InspectedImageCandidate,
	lock deploy.BuildLockV1, scope string, consumerPaths map[string]string,
) ([]providers.ExecutableEvidence, []providers.ExecutableEvidence, error)

CollectApplicationPortableNativeExportEvidenceV1 binds the native handoff to the complete validated application lock and its exact final image before repeating current package and file observations. A provider prefix image or independently supplied catalog cannot authorize the handoff.

func CollectFullImageExecutableEvidence 

func CollectFullImageExecutableEvidence(
	ctx context.Context,
	store providerstore.Store,
	descriptor deploy.ImageDescriptor,
	checks []FullImageExecutableProbe,
) (result []providers.ExecutableEvidence, err error)

CollectFullImageExecutableEvidence inspects every currently requested final or layer-validation path in one container. It is not a consumer prerequisite runner: those checks execute inside the existing resolver or materializer. The embedded helper is extracted once into deployment-local scratch and removed after confirmed container cleanup. If removal fails, scratch remains available to the next operation's abandoned-helper recovery.

func CollectPortableNativeExportEvidenceV1 

func CollectPortableNativeExportEvidenceV1(
	ctx context.Context, store providerstore.Store, image InspectedImageCandidate,
	lock providers.PortableToolLockV1, scope string, outputs []providers.RealizedOutput,
	consumerPaths map[string]string,
) (exports, consumers []providers.ExecutableEvidence, resultErr error)

CollectPortableNativeExportEvidenceV1 repeats exact locked APT output ownership and package-state checks on one held final-image session. Consumer paths receive ordinary file/executable observations, without asserting dpkg ownership of a filesystem alias. Both results use existing evidence records.

func CommandOutputCaptureDiagnostic 

func CommandOutputCaptureDiagnostic(err error, capture *CommandOutputCapture) string

CommandOutputCaptureDiagnostic returns only output owned by capture in the returned error chain. Structured provider errors remain a trust boundary; their arbitrary hidden causes are never inspected for this diagnostic.

func CompileRuntimePolicyFromLockV1 

func CompileRuntimePolicyFromLockV1(
	document blueprint.Document,
	lock deploy.BuildLockV1,
	plans []deploy.RuntimePlanV1,
) (deploy.RuntimePolicyV1, error)

CompileRuntimePolicyFromLockV1 performs the same policy compilation using only canonical lock contents. Runtime staleness checks therefore do not need provider bundles, artifacts, or Docker inspection.

func CompileRuntimePolicyV1 

func CompileRuntimePolicyV1(
	document blueprint.Document,
	graph providers.GraphExecutionResult,
	plans []deploy.RuntimePlanV1,
) (deploy.RuntimePolicyV1, error)

CompileRuntimePolicyV1 binds already-resolved runtime plans to the complete provider graph output/protected-root set.

func CompleteControlAdmissionV1 

func CompleteControlAdmissionV1(operation *deploy.OperationLock, markerID string, lease *deploy.ControlLeaseV1) error

func ControlledSessionContainerPlanDigestV1 

func ControlledSessionContainerPlanDigestV1(plan ControlledSessionContainerPlanV1) (canonical.Digest, error)

func CreateEnvironmentImageReference 

func CreateEnvironmentImageReference(
	ctx context.Context,
	image providers.RealizedImageV1,
	references EnvironmentImageReferences,
	kind EnvironmentReferenceKind,
	environment string,
	deploymentDir string,
) error

func CreatePortableEnvironmentReferenceV1 

func CreatePortableEnvironmentReferenceV1(ctx context.Context, operation *deploy.OperationLock, owned OwnedImageReferenceV1, generation deploy.EnvironmentGenerationState, environment, deploymentDir string) error

CreatePortableEnvironmentReferenceV1 accepts an exact pair already retained in durable publication intent. Persisting that intent belongs to the calling transition. An existing matching companion is an idempotent retry; every observed mismatch is preserved, including one observed after tagging.

func CurrentBuildMatches 

func CurrentBuildMatches(current CurrentBuild, input CurrentBuildReuseInput) (bool, error)

CurrentBuildMatches returns false for a valid but changed build input. It reads no external state; malformed current state or candidate inputs remain errors. Progress, when supplied, explains the rejected reuse boundary.

func CurrentBuildMatchesRuntimeV1 

func CurrentBuildMatchesRuntimeV1(current CurrentBuild, dockerPlan DockerExecutionPlan) (bool, error)

CurrentBuildMatchesRuntimeV1 checks the complete runtime-affecting state against the published lock without resolving a mutable base or contacting a provider. A valid state that no longer composes with the published lock is a stale build, not runtime work to repair or reproduce.

func CurrentRuntimeContainerIDV1 

func CurrentRuntimeContainerIDV1(ctx context.Context, plan DockerExecutionPlan, dockerPreflightTimeout time.Duration) (string, error)

func DeploymentOutputPrefix 

func DeploymentOutputPrefix(dir string, output io.Writer) (string, error)

func DeploymentOutputWriters 

func DeploymentOutputWriters(dir string, stdout io.Writer, stderr io.Writer) (io.Writer, io.Writer, error)

func DirectInstallProviderV1 

func DirectInstallProviderV1(options DirectInstallOptions) (string, error)

DirectInstallProviderV1 resolves a blueprint into a private state-v1 source workspace, installs it, and returns the resolved destination.

func DirectPythonDependenciesFromBuildLock 

func DirectPythonDependenciesFromBuildLock(store providerstore.Store, lock deploy.BuildLockV1) ([]string, error)

func DiscardValidatedBuild 

func DiscardValidatedBuild(
	ctx context.Context,
	operation *deploy.OperationLock,
	environment string,
	deploymentDir string,
	progress io.Writer,
) error

func Doctor 

func Doctor(options DoctorOptions) int

func ExecutableEvidenceFromProbe 

func ExecutableEvidenceFromProbe(observation probe.ExecutableObservationV1, binding ProbeExecutableBinding) (providers.ExecutableEvidence, error)

ExecutableEvidenceFromProbe converts one validated filesystem observation into common executable evidence. Links start as ordinary and unowned; a provider such as APT may add ownership or alternatives evidence before applying its provider-specific acceptance rules.

func ExecuteLifecycle 

func ExecuteLifecycle(ctx context.Context, plan LifecyclePlan, executor LifecycleExecutor) error

func ExecutePreparedPythonGraph 

func ExecutePreparedPythonGraph(
	ctx context.Context,
	input PreparedPythonGraphExecutionInput,
) (result providers.GraphExecutionResult, err error)

ExecutePreparedPythonGraph derives all cache inputs from CurrentLock, prepares the matching backend workspaces, and executes the graph. Callers do not supply reusable-artifact, cached-resolution, or per-node config maps.

func FilterSupersededPythonResolverArtifacts 

func FilterSupersededPythonResolverArtifacts(
	reusable []providerstore.ArtifactDescriptor,
	selected []pythonprovider.PortableToolVerifiedWheelInputV1,
) []providerstore.ArtifactDescriptor

FilterSupersededPythonResolverArtifacts removes reusable candidates whose resolver filename is now owned by an exact selected portable wheel. The staging operation has already verified and replaced any prior bytes at that path, so downstream resolver inputs must describe only the selected owner.

func FilterVerifiedPythonResolverArtifacts 

func FilterVerifiedPythonResolverArtifacts(
	prepared PreparedPythonResolverArtifacts,
	reusable []providerstore.ArtifactDescriptor,
) ([]providerstore.ArtifactDescriptor, error)

FilterVerifiedPythonResolverArtifacts removes corrupt staged candidates so the fresh resolver cannot select them through find-links. Missing or corrupt reusable content is a cache miss, not a resolver failure.

func FinalizationDockerfile 

func FinalizationDockerfile(request FinalizationBuildRequest) ([]byte, error)

func ForceReplaceStagedDesiredStateV1 

func ForceReplaceStagedDesiredStateV1(ctx context.Context, input ForceReplaceStagedDesiredStateInputV1) (deploy.DesiredStateUpdateResult, error)

ForceReplaceStagedDesiredStateV1 replaces staging owned by another environment. It first force-admits a serialized control operation, stopping live work that still uses the old generation, and then publishes a fresh, unbuilt desired state for the replacement blueprint.

func ForceRestageCurrentDesiredPlatformV1 

func ForceRestageCurrentDesiredPlatformV1(
	ctx context.Context,
	deploymentDir string,
	explicitPlatform string,
	options RunOptions,
) (result deploy.DesiredStateUpdateResult, err error)

ForceRestageCurrentDesiredPlatformV1 behaves like an ordinary update for current state and explicitly recovers the one recognized incompatible components-based development staging shape.

func Info 

func Info(options InfoOptions) (string, error)

func InspectCachedBase 

func InspectCachedBase(
	ctx context.Context,
	authorReference string,
	platform blueprint.Platform,
) (deploy.ImageDescriptor, deploy.BaseConfig, bool, error)

InspectCachedBase resolves only Docker's current local author reference. A missing or unusable local reference is a cache miss; it never contacts a registry. Callers use this only to test an already-published build before falling back to normal base resolution.

func InstallProviderV1 

func InstallProviderV1(options InstallOptions) error

InstallProviderV1 installs a state-v1 staging deployment through the provider build and publication pipeline.

func InstallSuccessLines 

func InstallSuccessLines(dir string, _ time.Duration) ([]string, error)

InstallSuccessLines reconstructs success output from the installed state-v1 generation. The timeout remains in the public signature until the broader Docker CLI surface stops passing it; rendering does not invoke Docker.

func ListControlledSessionIncidentReceiptsV1 

func ListControlledSessionIncidentReceiptsV1(
	ctx context.Context,
	deploymentDirectory string,
) ([]deploy.ControlledSessionIncidentReceiptV1, error)

ListControlledSessionIncidentReceiptsV1 is the read-only retrieval surface for durable post-crash watchdog evidence. It does not create deployment state or contact Docker.

func ListLiveRunsV1 

func ListLiveRunsV1(ctx context.Context, deploymentDir string) ([]deploy.LiveRunV1, error)

func ListLiveRunsWithNoticeV1 

func ListLiveRunsWithNoticeV1(ctx context.Context, deploymentDir string, notice io.Writer) ([]deploy.LiveRunV1, error)

func LoadApplicationStartupVerifierV1 

func LoadApplicationStartupVerifierV1(platform blueprint.Platform) (deploy.ApplicationStartupVerifierV1, error)

func LoadStagedPackageOverridesV1 

func LoadStagedPackageOverridesV1(
	operation *deploy.OperationLock,
	deploymentDir string,
	document blueprint.Document,
) (
	deploy.PackageOverridesV1,
	deploy.ResolvedPackageOverridesV1,
	deploy.PackageOverrideIntentV1,
	error,
)

func MatchEnvironmentCommand 

func MatchEnvironmentCommand(document blueprint.Document, arguments []string, deployedOnly bool) (string, []string, error)

func MatchLifecycleCommand 

func MatchLifecycleCommand(document blueprint.Document, arguments []string) (string, []string, error)

func MatchPortableToolCaseEvidenceV1 

func MatchPortableToolCaseEvidenceV1(
	store providerstore.Store, caseV1 toolcatalog.IntegrationCaseV1, scope string,
	reference providerstore.StoreObjectRef,
) (toolcatalog.ValidationEvidenceV1, error)

MatchPortableToolCaseEvidenceV1 requires original successful fixed-executor output and every current derived-case binding. Record presence alone, or an independently asserted v1 record, cannot pass. Store ownership is the trust boundary; this matcher does not authenticate records from an untrusted store.

func MaterializationAssemblyKey 

func MaterializationAssemblyKey(transaction providers.MaterializationTransaction, platform blueprint.Platform) (providers.AssemblyKeyV1, canonical.Digest, error)

func MaterializationDockerfile 

func MaterializationDockerfile(transaction providers.MaterializationTransaction, sources []MaterializationMountSource) ([]byte, error)

func ObserveSourceBuilderTargetIdentityV1 

func ObserveSourceBuilderTargetIdentityV1(
	ctx context.Context,
	store providerstore.Store,
	base deploy.ImageDescriptor,
) (target toolcatalog.TargetIdentityV1, resultErr error)

ObserveSourceBuilderTargetIdentityV1 observes the exact portable-tool target identity of one base image through the fixed APT base-profile probe in a networkless validation container. Image tags are never used as evidence.

func PersistPortableToolCaseEvidenceV1 

func PersistPortableToolCaseEvidenceV1(
	ctx context.Context, store providerstore.Store, observation PortableToolCaseObservationV1,
) (providerstore.StoreObjectRef, error)

PersistPortableToolCaseEvidenceV1 publishes one complete external bundle atomically through the existing immutable validation-record store. A zero observation or a failed case cannot publish passing support evidence.

func PortableToolProbeEvidenceDigestV1 

func PortableToolProbeEvidenceDigestV1(evidence PortableToolProbeEvidenceV1) (canonical.Digest, error)

PortableToolProbeEvidenceDigestV1 validates and identifies canonical probe observations. It does not turn them into external support evidence.

func PrepareControlledSessionChannelV1 

func PrepareControlledSessionChannelV1(plan ControlledSessionExecutionPlanV1) (*controlledsession.PrivateChannelV1, error)

PrepareControlledSessionChannelV1 realizes only the private controller channel from a complete immutable execution plan. It does not create or start either container.

func PrepareStagedManagedBindPathsV1 

func PrepareStagedManagedBindPathsV1(deploymentDir string, plan DockerExecutionPlan) error

PrepareStagedManagedBindPathsV1 ensures that every Reploy-owned bind source exists after a staged image build. Existing directories are preserved; path components that are files or symlinks are rejected.

func PrintInstallSuccess 

func PrintInstallSuccess(dir string, stdout io.Writer, dockerPreflightTimeout time.Duration) error

func PrintReploySystemdServices 

func PrintReploySystemdServices(stdout io.Writer) error

func ProbeDockerNativePlatform 

func ProbeDockerNativePlatform(ctx context.Context) (blueprint.Platform, error)

ProbeDockerNativePlatform reports the target platform of the selected Docker daemon. Callers only need this when selection is otherwise ambiguous.

func ProviderFinalImageConfigV1 

func ProviderFinalImageConfigV1(base deploy.BaseConfig) (providers.ImageConfigPolicy, error)

ProviderFinalImageConfigV1 derives the complete controlled image defaults used by every provider materialization layer. Base environment values remain available to normal runtime processes; all other supported fields use explicit Reploy policy instead of inheriting base execution behavior.

func PublishBuild 

func PublishBuild(
	ctx context.Context,
	operation *deploy.OperationLock,
	store providerstore.Store,
	input BuildPublicationInput,
) (deploy.StateV1, error)

func PublishBuiltPythonSourceWheels 

func PublishBuiltPythonSourceWheels(
	ctx context.Context,
	store providerstore.Store,
	prepared PreparedPythonResolverArtifacts,
	component string,
	distributions []PreparedPythonSourceDistribution,
	reusable []providerstore.ArtifactDescriptor,
) (sources []providers.ResolvedSourceInput, effective []providerstore.ArtifactDescriptor, err error)

PublishBuiltPythonSourceWheels closes the writable source-build output, publishes only its validated wheels, and exposes those exact store objects through the resolver's read-only input for the later dependency resolver.

func PublishCurrentRuntimeInputsV1 

func PublishCurrentRuntimeInputsV1(
	operation *deploy.OperationLock,
	deploymentDir string,
	plan CurrentRuntimePlanV1,
) (changed bool, err error)

PublishCurrentRuntimeInputsV1 renders and atomically replaces the Compose and environment files needed by the selected current plan. Byte-identical regular files with the expected mode are left untouched.

func PublishInstalledBuildV1 

func PublishInstalledBuildV1(
	ctx context.Context,
	sourceOperation *deploy.OperationLock,
	destinationOperation *deploy.OperationLock,
	sourceStore providerstore.Store,
	destinationStore providerstore.Store,
	input InstalledBuildPublicationInputV1,
) (deploy.StateV1, error)

PublishInstalledBuildV1 transfers and publishes one already-current staged build into an installed destination. The caller acquires and retains the source operation lock before the destination operation lock.

func PublishValidatedBuild 

func PublishValidatedBuild(
	ctx context.Context,
	operation *deploy.OperationLock,
	store providerstore.Store,
	environment string,
	deploymentDir string,
	lock deploy.BuildLockV1,
	inputs ValidatedBuildInputsV1,
) (deploy.ValidatedBuildV1, error)

func RealizeProviderBase 

func RealizeProviderBase(
	ctx context.Context,
	store providerstore.Store,
	plan providers.ProviderPlanV1,
	descriptor deploy.ImageDescriptor,
) (providers.RealizedImageV1, []providers.RealizedOutput, error)

RealizeProviderBase converts an inspected immutable Docker base into the provider graph's image identity and initial executable catalog. All declared base exports are inspected together in one image-validation session.

func RecoverMissingProviderUninstallV1 

func RecoverMissingProviderUninstallV1(ctx context.Context, input ProviderUninstallRecoveryInputV1) error

RecoverMissingProviderUninstallV1 removes a Linux system installation whose deployment directory is gone. The root-owned Reploy systemd unit is the only recovery authority; existing or corrupt deployment state never falls back to this path.

func RecoverPendingImageReferences 

func RecoverPendingImageReferences(
	ctx context.Context,
	pending deploy.PendingBuildV1,
	decision deploy.PendingRecoveryDecision,
	oldImage *providers.RealizedImageV1,
	environment string,
	deploymentDir string,
) error

func RecoverPendingPublication 

func RecoverPendingPublication(
	ctx context.Context,
	operation *deploy.OperationLock,
	store providerstore.Store,
	current *deploy.EnvironmentGenerationState,
	environment string,
	deploymentDir string,
	validateProfileOwner providers.RequirementProfileOwnerValidator,
	validateBundleOwner providers.ResolvedBundleOwnerValidator,
) (bool, error)

func RecoverPendingValidatedPublicationV1 

func RecoverPendingValidatedPublicationV1(ctx context.Context, operation *deploy.OperationLock, store providerstore.Store, environment, dir string) (bool, error)

RecoverPendingValidatedPublicationV1 uses only the persisted lock/record and exact Docker reference primitives. It never rebuilds or acquires provider data.

func RemoveBuiltImageCandidate 

func RemoveBuiltImageCandidate(ctx context.Context, candidate BuiltImageCandidate) error

RemoveBuiltImageCandidate removes exactly the deployment-owned temporary reference produced by the current build, or an exact immutable image ID for legacy/internal candidates without that ownership metadata. It never invokes a Docker prune operation or discovers other images.

func RemoveEnvironmentGenerationReference 

func RemoveEnvironmentGenerationReference(
	ctx context.Context,
	image providers.RealizedImageV1,
	reference string,
	environment string,
	deploymentDir string,
) error

RemoveEnvironmentGenerationReference removes one state-recorded, deployment-owned generation reference after verifying its exact image ID.

func RemoveEnvironmentImageReference 

func RemoveEnvironmentImageReference(
	ctx context.Context,
	image providers.RealizedImageV1,
	references EnvironmentImageReferences,
	kind EnvironmentReferenceKind,
	environment string,
	deploymentDir string,
) error

func RemovePortableEnvironmentReferenceV1 

func RemovePortableEnvironmentReferenceV1(ctx context.Context, operation *deploy.OperationLock, owned OwnedImageReferenceV1, generation deploy.EnvironmentGenerationState, environment, deploymentDir string) error

RemovePortableEnvironmentReferenceV1 retires only the exact retained pair. Cleanup inventory remains authoritative after the supporting lock is pruned.

func RemoveRequestOverlayOptions 

func RemoveRequestOverlayOptions(ctx context.Context, dir string, arguments []string) (deploy.RequestOverlayMutationResult, error)

func RemoveRequestOverlayPackages 

func RemoveRequestOverlayPackages(ctx context.Context, dir string, component string, requirements []string) (deploy.RequestOverlayMutationResult, error)

func RenderMaterializationArgv 

func RenderMaterializationArgv(transaction providers.MaterializationTransaction) ([]string, error)

RenderMaterializationArgv resolves a validated transaction's typed operands to their exact in-container strings. It deliberately returns an argv array: callers must not join or reinterpret the result as shell source.

func RequireCurrentPortableToolCaseEvidenceV1 

func RequireCurrentPortableToolCaseEvidenceV1(
	store providerstore.Store, requests []PortableToolCaseEvidenceRequestV1,
	references map[canonical.Digest]providerstore.StoreObjectRef,
) error

RequireCurrentPortableToolCaseEvidenceV1 applies the same exact matcher to a nonempty current case set. Callers select representative cases or derive the complete advertised set; this function makes no unexecuted support claim.

func RequireCurrentRuntimeInputsV1 

func RequireCurrentRuntimeInputsV1(operation *deploy.OperationLock, deploymentDir string, plan CurrentRuntimePlanV1) error

RequireCurrentRuntimeInputsV1 checks the rendered runtime files without creating, repairing, or replacing either file.

func RequireRuntimeReady 

func RequireRuntimeReady(input RuntimeReadinessInput) error

RequireRuntimeReady performs the complete pre-container check that needs no Docker probe: the current build must match exact inputs, then the selected locked plan's host sources must still match.

func RequireStagingDeployment 

func RequireStagingDeployment(dir string) error

func ResetPythonResolverOutput 

func ResetPythonResolverOutput(prepared PreparedPythonResolverArtifacts) error

ResetPythonResolverOutput removes one provisional resolver result before a second pass or local source build. It accepts only regular files in the private output directory and leaves the directory itself in place.

func ResolveBase 

func ResolveBase(ctx context.Context, authorReference string, platform blueprint.Platform) (deploy.ImageDescriptor, deploy.BaseConfig, error)

ResolveBase pulls the requested platform, captures its immutable identity, and normalizes the Docker image configuration used by later build stages.

func ResolveProviderPrefixDescriptor 

func ResolveProviderPrefixDescriptor(
	ctx context.Context,
	base deploy.ImageDescriptor,
	prefix providers.RealizedImageV1,
	platform blueprint.Platform,
) (deploy.ImageDescriptor, error)

ResolveProviderPrefixDescriptor returns the exact immutable Docker descriptor for a graph prefix. The selected base is reused directly; later local layers are recovered by immutable config ID without creating a tag or container.

func RestageCurrentDesiredPlatformV1 

func RestageCurrentDesiredPlatformV1(ctx context.Context, deploymentDir string, explicitPlatform string) (deploy.DesiredStateUpdateResult, error)

RestageCurrentDesiredPlatformV1 reselects only the target platform from the resolved blueprint already stored in state-v1.

func RetainVerifiedApplicationRuntimeLayer 

func RetainVerifiedApplicationRuntimeLayer(
	ctx context.Context,
	candidate BuiltImageCandidate,
	image providers.RealizedImageV1,
) error

func RetainVerifiedProviderLayer 

func RetainVerifiedProviderLayer(
	ctx context.Context,
	candidate BuiltImageCandidate,
	image providers.RealizedImageV1,
) error

RetainVerifiedProviderLayer gives an accepted provider-layer image a stable, content-addressed Docker reference. The build lock records the image config digest, and reploy verify must be able to inspect that exact image after the temporary build-base reference is removed during finalization.

func RetryValidatedBuildCleanup 

func RetryValidatedBuildCleanup(
	ctx context.Context,
	operation *deploy.OperationLock,
	store providerstore.Store,
	environment string,
	deploymentDir string,
) (deploy.ValidatedBuildV1, bool, error)

RetryValidatedBuildCleanup retries superseded Docker references, build locks, and provider-store objects retained by a successful validation. Cleanup failures remain durable and do not invalidate the current candidate.

func RunAdmittedTransientContainerV1 

func RunAdmittedTransientContainerV1(
	ctx context.Context,
	deploymentDir string,
	operation *deploy.OperationLock,
	runID string,
	execution TransientContainerExecutionV1,
	options RunOptions,
) error

RunAdmittedTransientContainerV1 takes ownership of operation. It creates and records the container while the lock is held, releases the lock for attached execution, and reacquires it to remove the live entry on every exit path.

func RunControlledSessionWatchdogChild 

func RunControlledSessionWatchdogChild(args []string, stderr io.Writer) (int, bool)

RunControlledSessionWatchdogChild handles the private same-executable child mode. The child accepts no resource selection in argv; it reads one frozen manifest from its inherited descriptor and then watches the parent pipe.

func RunCurrentAppCommandV1 

func RunCurrentAppCommandV1(ctx context.Context, input CurrentAppCommandRunInputV1) error

RunCurrentAppCommandV1 runs one state-v1 app command against the exact published generation and locked output catalog.

func RunCurrentRuntimeObservationV1 

func RunCurrentRuntimeObservationV1(ctx context.Context, input CurrentRuntimeObservationInputV1) error

RunCurrentRuntimeObservationV1 runs one read-only state-v1 Compose observation against the exact published runtime inputs. It does not resolve providers, build images, check mutable host sources, or repair runtime files.

func RunCurrentRuntimeTestV1 

func RunCurrentRuntimeTestV1(ctx context.Context, input CurrentRuntimeTestInputV1) error

RunCurrentRuntimeTestV1 tests the already-running workload represented by the exact published state-v1 runtime plan.

func RunCurrentShellV1 

func RunCurrentShellV1(ctx context.Context, input CurrentShellRunInputV1) error

RunCurrentShellV1 runs a shell in the exact published state-v1 generation.

func RunCurrentWorkloadLifecycleV1 

func RunCurrentWorkloadLifecycleV1(ctx context.Context, input CurrentWorkloadLifecycleInputV1) error

func RunCurrentWorkloadV1 

func RunCurrentWorkloadV1(ctx context.Context, input CurrentWorkloadRunInputV1) error

RunCurrentWorkloadV1 owns one state-v1 workload-container launch. It holds the deployment operation lock from the initial current-build read through container creation and never builds, resolves providers, or repairs pending publication state.

func RunImageProbe 

func RunImageProbe(ctx context.Context, descriptor deploy.ImageDescriptor, workspace PreparedProbeWorkspace, request probe.RequestV1) (probe.ResponseV1, error)

RunImageProbe is the one-exchange convenience boundary used when the full validation plan currently needs only filesystem evidence. Higher-level full validation can open a session and perform several fixed checks before close.

func RunInstalledServiceContainerV1 

func RunInstalledServiceContainerV1(ctx context.Context, deploymentDir string, action string, dockerPath string, options RunOptions) (err error)

RunInstalledServiceContainerV1 is the system-service container boundary. It deliberately bypasses the public control surface because systemd itself is already the admitted host-service operation.

func RunPortableToolValidationScheduleV1 

func RunPortableToolValidationScheduleV1(
	ctx context.Context,
	descriptor deploy.ImageDescriptor,
	workspace PreparedProbeWorkspace,
	schedule providers.PortableToolValidationScheduleV1,
) ([]providers.ValidationEvidence, error)

RunPortableToolValidationScheduleV1 is the direct scheduling entry point for an already-selected schedule. Production materialization uses the lock-only constructor above, then executes its construction-controlled profile view. Neither path infers image placement from tool or runtime metadata.

Scheduling decides only what runs and in what order. Executor policy stays executor-owned, and a probe result is an observation: a non-passing outcome fails the schedule rather than becoming validation evidence.

The workspace must not belong to a validation session the caller still holds open. Each probe runs in its own container whose name is derived from the workspace directory, so a shared workspace collides with that held container.

func RunProviderInstallV1 

func RunProviderInstallV1(ctx context.Context, input ProviderInstallInputV1) (deploy.StateV1, error)

func RunProviderUninstallV1 

func RunProviderUninstallV1(ctx context.Context, input ProviderUninstallInputV1) error

RunProviderUninstallV1 removes the persistent host integration for one installed state-v1 deployment under serialized runtime admission.

func RunPublishedRuntimeContainerV1 

func RunPublishedRuntimeContainerV1(
	ctx context.Context,
	input PublishedRuntimeContainerInput,
	run PublishedRuntimeContainerRunnerV1,
) error

RunPublishedRuntimeContainerV1 places the complete read-only runtime gate immediately before container creation. The runner receives the exact current build that passed the gate so it can use that generation's immutable image reference.

func Runtime 

func Runtime(options RuntimeOptions) error

func RuntimePlansV1 

func RuntimePlansV1(document blueprint.Document, dockerPlan DockerExecutionPlan) ([]deploy.RuntimePlanV1, error)

RuntimePlansV1 derives every container shape that the resolved environment may create. Host source paths are deliberately excluded from the canonical plans; only their resolved kind and container-side policy participate.

func SelectDockerTargetPlatform 

func SelectDockerTargetPlatform(document blueprint.Document, explicit string, native *blueprint.Platform) (blueprint.Platform, error)

SelectDockerTargetPlatform selects the explicit OCI target used by every later Docker and provider operation. Native may be nil when an explicit target was requested or the blueprint declares exactly one target.

func SelectPythonInterpreter 

func SelectPythonInterpreter(
	ctx context.Context,
	session *PythonResolverSession,
	launcher providers.ValidatedExecutableInput,
	requirement providers.ExecutableRequirement,
	candidates []providers.RealizedOutput,
) (providers.ExecutableEvidence, error)

SelectPythonInterpreter validates candidates in their established lower-layer-first order inside an already-open resolver session. The runtime itself supplies the accepted version; catalog or package metadata cannot.

func SelectPythonInterpreterWithTags 

func SelectPythonInterpreterWithTags(
	ctx context.Context,
	session *PythonResolverSession,
	launcher providers.ValidatedExecutableInput,
	requirement providers.ExecutableRequirement,
	candidates []providers.RealizedOutput,
	testedTags []string,
) (providers.ExecutableEvidence, error)

SelectPythonInterpreterWithTags performs the same single interpreter selection while asking the fixed inspection to test only the bounded tags projected for this Python component.

func Shell 

func Shell(options ShellOptions) error

func StageDesiredStateV1 

func StageDesiredStateV1(ctx context.Context, input DesiredStateStageInputV1) (deploy.DesiredStateUpdateResult, error)

StageDesiredStateV1 records the resolved blueprint and one selected target. It never resolves providers or builds an image.

func StagePythonPortableVerifiedWheels 

func StagePythonPortableVerifiedWheels(
	prepared PreparedPythonResolverArtifacts,
	store providerstore.Store,
	reusable []providerstore.ArtifactDescriptor,
	selected []pythonprovider.PortableToolVerifiedWheelInputV1,
) (err error)

StagePythonPortableVerifiedWheels adds exact, already verified binding wheels to the resolver's read-only input directory. A reusable wheel may share the path only when it has precisely the same descriptor.

func StagePythonResolverSourceConstraints 

func StagePythonResolverSourceConstraints(
	prepared PreparedPythonResolverArtifacts,
	request providers.CanonicalProviderRequest,
	sources []providers.ResolvedSourceInput,
	reusable []providerstore.ArtifactDescriptor,
	selected []pythonprovider.PortableToolVerifiedWheelInputV1,
) error

StagePythonResolverSourceConstraints places the provider-owned constraints beside the verified wheels before the one pip invocation consumes them.

func TestServer 

func TestServer(options TestOptions) error

func UninstallProviderNeedsRootV1 

func UninstallProviderNeedsRootV1(options UninstallOptions) bool

UninstallProviderNeedsRootV1 reports whether the recorded state-v1 install uses the Linux system scope. Failure to read state is conservative on Linux; the locked uninstall path performs the authoritative validation.

func ValidateApplicationBuildCaseV1 

func ValidateApplicationBuildCaseV1(
	ctx context.Context, input LockedProviderBuildExecutionInputV1,
	caseV1 toolcatalog.IntegrationCaseV1, scope string,
) ([]providers.ValidationEvidence, error)

ValidateApplicationBuildCaseV1 executes an ordinary prepared application build and observes its exact finalized image before publication. Observations are returned only after execution and all owned cleanup succeed; they are in-process results, not external support evidence.

func ValidateApplicationSandboxPlanV1 

func ValidateApplicationSandboxPlanV1(plan ApplicationSandboxPlanV1) error

func ValidateControlledSessionContainerPlanV1 

func ValidateControlledSessionContainerPlanV1(plan ControlledSessionContainerPlanV1) error

func ValidateControlledSessionControllerPackageV1 

func ValidateControlledSessionControllerPackageV1(packagePlan ControlledSessionControllerPackageV1) error

func ValidateControlledSessionExecutionPlanV1 

func ValidateControlledSessionExecutionPlanV1(plan ControlledSessionExecutionPlanV1) error

func ValidateEnvironmentGenerationReference 

func ValidateEnvironmentGenerationReference(reference string, environment string, deploymentDir string) error

func ValidateEnvironmentImageReferences 

func ValidateEnvironmentImageReferences(references EnvironmentImageReferences, environment string, deploymentDir string) error

func ValidateImage 

func ValidateImage(
	ctx context.Context,
	input FullImageValidationInput,
	validateProfileOwner providers.RequirementProfileOwnerValidator,
	run FullImageValidationRunner,
) (deploy.PrefixValidationV1, error)

ValidateImage performs complete image validation without publishing the resulting evidence. Callers that only audit existing state must use this path so verification cannot mutate the provider store.

func ValidateInspectedApplicationRuntimeLayerCandidate 

func ValidateInspectedApplicationRuntimeLayerCandidate(
	request ApplicationRuntimeLayerBuildRequest,
	candidate InspectedImageCandidate,
) error

func ValidateInspectedImageCandidateIdentity 

func ValidateInspectedImageCandidateIdentity(candidate InspectedImageCandidate) error

func ValidateInspectedMaterializationCandidate 

func ValidateInspectedMaterializationCandidate(transaction providers.MaterializationTransaction, candidate InspectedImageCandidate) error

ValidateInspectedMaterializationCandidate checks the configuration values Reploy explicitly controls. Unrelated metadata inherited from the trusted base image is intentionally outside this policy.

func ValidatePortableToolMaterializationV1 

func ValidatePortableToolMaterializationV1(
	ctx context.Context,
	store providerstore.Store,
	input PortableToolMaterializationValidationInputV1,
) (evidence []providers.ValidationEvidence, resultErr error)

ValidatePortableToolMaterializationV1 is the production acceptance boundary for a materialized portable-tool closure. The usage owner supplies both the exact image produced by materialization and the lock-derived selected view. This function validates that image identity, runs every selected profile, and binds the resulting evidence to the image's observed root filesystem.

The dedicated workspace matters when the usage owner is concurrently holding another validation session: each fixed-executor probe owns a fresh container whose name is derived from this workspace.

func ValidatePythonConsumer 

func ValidatePythonConsumer(
	ctx context.Context,
	session *PythonResolverSession,
	finalImageConfig providers.ImageConfigPolicy,
) (providers.GraphConsumerValidation, error)

ValidatePythonConsumer observes the fixed backend carrier and clean environment launcher in the held resolver session. Repeated calls reuse the same session observations without another Docker exec.

func ValidateRootRuntimeHostAuthorityV1 

func ValidateRootRuntimeHostAuthorityV1(policy deploy.RuntimePolicyV1, plan DockerExecutionPlan) error

func ValidateRuntimeHostSourcesV1 

func ValidateRuntimeHostSourcesV1(policy deploy.RuntimePolicyV1, planID string, runtimeUID uint32, sources []RuntimeHostSourceV1) error

func ValidateSourceBuilderBuildCaseV1 

func ValidateSourceBuilderBuildCaseV1(
	ctx context.Context,
	store providerstore.Store,
	tools *SourceBuilderPortableToolsV1,
	upstream deploy.ImageDescriptor,
	options RunOptions,
	caseV1 toolcatalog.IntegrationCaseV1,
	scope string,
) ([]providers.ValidationEvidence, error)

ValidateSourceBuilderBuildCaseV1 uses the ordinary builder materialization handoff for one derived integration case. It returns observations only after the exact inspected image has been validated and then removed successfully. These observations are not external support evidence.

func ValidateTransientContainerExecutionV1 

func ValidateTransientContainerExecutionV1(execution TransientContainerExecutionV1, runID string) error

func ValidatedBuildRecordMatchesInputs 

func ValidatedBuildRecordMatchesInputs(record deploy.ValidatedBuildV1, input ValidatedBuildInputsV1) bool

func VerifyEnvironmentGenerationReference 

func VerifyEnvironmentGenerationReference(
	ctx context.Context,
	image providers.RealizedImageV1,
	reference string,
	environment string,
	deploymentDir string,
) error

func VerifyPortableEnvironmentReferenceV1 

func VerifyPortableEnvironmentReferenceV1(ctx context.Context, operation *deploy.OperationLock, owned OwnedImageReferenceV1, generation deploy.EnvironmentGenerationState, environment, deploymentDir string) error

func VerifyPythonPortableVerifiedWheels 

func VerifyPythonPortableVerifiedWheels(
	prepared PreparedPythonResolverArtifacts,
	selected []pythonprovider.PortableToolVerifiedWheelInputV1,
) error

VerifyPythonPortableVerifiedWheels checks the exact staged bytes immediately before the resolver consumes them. Selected wheels are mandatory inputs, unlike optional reusable candidates.

func VerifyPythonResolverArtifacts 

func VerifyPythonResolverArtifacts(prepared PreparedPythonResolverArtifacts, reusable []providerstore.ArtifactDescriptor) error

VerifyPythonResolverArtifacts performs the content check only when the resolver will actually consume its staged inputs.

func WaitForHTTPReadiness 

func WaitForHTTPReadiness(ctx context.Context, endpoint EndpointExecutionPlan) error

func WaitForHTTPReadinessWithServiceCheck 

func WaitForHTTPReadinessWithServiceCheck(ctx context.Context, endpoint EndpointExecutionPlan, serviceCheck func(context.Context) error) error

func WriteLiveRunRecoveryNoticeV1 

func WriteLiveRunRecoveryNoticeV1(output io.Writer, recovery deploy.LiveRunRecoveryV1)

WriteLiveRunRecoveryNoticeV1 reports successful automatic recovery without exposing the queue's internal control-marker representation.

func WriteRuntimeStatusV1 

func WriteRuntimeStatusV1(output io.Writer, status RuntimeStatusV1, plan DockerExecutionPlan) error

Types

type APTArchiveInventoryEntry 

type APTArchiveInventoryEntry struct {
	Filename      string
	HostPath      string
	Artifact      providerstore.ArtifactDescriptor
	UnchangedSeed bool
}

APTArchiveInventoryEntry is one exact post-download cache file. Membership in this inventory is not bundle membership; later control inspection joins entries to the selected package plan. UnchangedSeed distinguishes reusable cache input from content produced or replaced by the current APT run.

func InventoryAPTResolverArchives 

func InventoryAPTResolverArchives(ctx context.Context, prepared PreparedAPTResolverWorkspace) ([]APTArchiveInventoryEntry, error)

InventoryAPTResolverArchives hashes every real .deb in the private archive cache after a successful download. It rejects partial and unexpected output and publishes nothing.

type APTBaseValidation 

type APTBaseValidation struct {
	Profile     aptprovider.BaseProfileEvidenceV1
	Executables []providers.ValidatedExecutableInput
}

type APTCachedNodeValidator 

type APTCachedNodeValidator func(
	context.Context,
	*APTResolverSession,
	providers.ResolveNodeRequest,
	providers.ResolveResult,
) (providers.GraphConsumerValidation, error)

type APTFreshNodeResolver 

type APTFreshNodeResolver func(
	context.Context,
	*APTResolverSession,
	providers.ResolveNodeRequest,
) (providers.ResolveResult, providers.GraphConsumerValidation, error)

type APTNodePreparer 

type APTNodePreparer struct {
	Descriptor     deploy.ImageDescriptor
	ProbeWorkspace PreparedProbeWorkspace
	Resolver       PreparedAPTResolverWorkspace
	RunOptions     RunOptions
	ValidateCached APTCachedNodeValidator
	ResolveFresh   APTFreshNodeResolver
}

APTNodePreparer owns one resolver-container lifecycle for the shared APT node. A rejected cache hit receives exactly one fresh resolution in the same session and never changes supplier or prefix.

func (APTNodePreparer) Prepare 

func (preparer APTNodePreparer) Prepare(
	ctx context.Context,
	request providers.GraphNodePrepareRequest,
) (result providers.GraphNodePreparation, resultErr error)

type APTResolverSession 

type APTResolverSession struct {
	// contains filtered or unexported fields
}

func OpenAPTResolverSession 

func OpenAPTResolverSession(
	ctx context.Context,
	descriptor deploy.ImageDescriptor,
	probeWorkspace PreparedProbeWorkspace,
	resolverWorkspace PreparedAPTResolverWorkspace,
	options RunOptions,
) (*APTResolverSession, error)

OpenAPTResolverSession starts the one held container that will validate the exact prefix and, in later typed operations, resolve its APT transaction.

func (*APTResolverSession) Close 

func (session *APTResolverSession) Close(ctx context.Context) error

func (*APTResolverSession) DownloadPackages 

func (session *APTResolverSession) DownloadPackages(ctx context.Context, request providers.CanonicalProviderRequest) error

DownloadPackages runs one unsplit download-only install transaction after the successful private-index refresh. It does not inspect or publish the resulting archives; those are separate acceptance steps.

func (*APTResolverSession) InspectArchives 

func (session *APTResolverSession) InspectArchives(ctx context.Context, exclusiveRoots []string) ([]aptprovider.BundlePackage, error)

InspectArchives binds exactly the selected add/upgrade closure to inspected .deb metadata and streamed file-list evidence. Unrelated unchanged seeds are ignored; any unrelated current-run output is rejected.

func (*APTResolverSession) InventoryArchives 

func (session *APTResolverSession) InventoryArchives(ctx context.Context) ([]APTArchiveInventoryEntry, error)

InventoryArchives records the exact post-download archive-cache contents. It does not decide bundle membership or publish any artifact.

func (*APTResolverSession) PlanPackages 

func (session *APTResolverSession) PlanPackages(ctx context.Context, request providers.CanonicalProviderRequest) (aptprovider.ResolvePlanV1, error)

PlanPackages runs one read-only APT dependency pass against the freshly acquired private indexes. The complete marker stream must match the provider-owned capability grammar; no partial plan is accepted.

func (*APTResolverSession) ProbeBaseProfile 

func (session *APTResolverSession) ProbeBaseProfile(ctx context.Context) (APTBaseValidation, error)

ProbeBaseProfile is the fixed first resolver operation. It observes all required executable paths together, then invokes only their fixed read-only identity and architecture interfaces through the validated clean launcher.

func (*APTResolverSession) PublishBundleArtifacts 

func (session *APTResolverSession) PublishBundleArtifacts(ctx context.Context, store providerstore.Store) (aptprovider.BundleV1, error)

PublishBundleArtifacts publishes only selected, fully inspected archives with their expected descriptors, then constructs the canonical APT payload. It does not publish the resolved-bundle manifest.

func (*APTResolverSession) PublishResolvedBundle 

func (session *APTResolverSession) PublishResolvedBundle(ctx context.Context, store providerstore.Store, node providers.NodeSpec) (providers.ResolveResult, providerstore.StoreObjectRef, error)

PublishResolvedBundle validates and atomically publishes the common resolved-bundle manifest after every selected artifact is present.

func (*APTResolverSession) ReadBasePackageState 

func (session *APTResolverSession) ReadBasePackageState(ctx context.Context) ([]aptprovider.PackageTuple, error)

ReadBasePackageState verifies the exact installed tuple for every package that the dependency plan retains from, or upgrades over, the immutable base.

func (*APTResolverSession) RefreshIndexes 

func (session *APTResolverSession) RefreshIndexes(ctx context.Context) error

RefreshIndexes runs the one apt-get update permitted for this resolver miss. Successful repeated calls are idempotent; a failed refresh cannot be retried in the same session under weaker or changed conditions.

type AdmittedControlV1 

type AdmittedControlV1 struct {
	Operation    *deploy.OperationLock
	Marker       deploy.ControlMarkerV1
	Lease        *deploy.ControlLeaseV1
	CanceledRuns []deploy.LiveRunV1
	StoppedRuns  []deploy.LiveRunV1
}

func AdmitControlOperationV1 

func AdmitControlOperationV1(
	ctx context.Context,
	deploymentDir string,
	operation *deploy.OperationLock,
	input ControlAdmissionInputV1,
) (AdmittedControlV1, error)

type AppCommandListEntry 

type AppCommandListEntry struct {
	Trigger      []string `json:"trigger"`
	Name         string   `json:"name"`
	ForwardArgs  bool     `json:"forward_args"`
	ForwardFlags []string `json:"forward_flags,omitempty"`
}

type AppCommandListOptions 

type AppCommandListOptions struct {
	Dir          string
	DeployedOnly bool
}

type AppCommandListResult 

type AppCommandListResult struct {
	AppID    string                `json:"app_id"`
	Commands []AppCommandListEntry `json:"commands"`
}

func AppCommandList 

func AppCommandList(options AppCommandListOptions) (AppCommandListResult, error)

type AppCommandOptions 

type AppCommandOptions struct {
	Dir                    string
	CommandArgs            []string
	DeployedOnly           bool
	OutputDir              string
	OutputFile             string
	Wait                   bool
	Stdout                 io.Writer
	Stderr                 io.Writer
	DockerPreflightTimeout time.Duration
}

type ApplicationKernelPolicyV1 

type ApplicationKernelPolicyV1 struct {
	DropAllCapabilities bool
	NoNewPrivileges     bool
	SeccompProfile      string
	Privileged          bool
	HostNamespaces      []string
	HostDevices         []string
}

type ApplicationNetworkPolicyV1 

type ApplicationNetworkPolicyV1 struct {
	Public    blueprint.NetworkAccess
	Local     blueprint.NetworkAccess
	Ambiguous blueprint.AmbiguousNetworkAccess
}

type ApplicationPortablePythonGraphResultV1 

type ApplicationPortablePythonGraphResultV1 struct {
	Graph        providers.GraphExecutionResult
	Plan         providers.PortableToolPlanV1
	Acquisitions []providers.PortableToolArtifactAcquisitionInputV1
}

ApplicationPortablePythonGraphResultV1 retains the exact binding acquisition handoff for the subsequent runtime-payload and lock transaction. It does not publish an application image or make an ordinary runtime request consumable.

func ExecuteApplicationPortablePythonGraphV1 

func ExecuteApplicationPortablePythonGraphV1(
	ctx context.Context,
	selected *ApplicationPortableToolPlanV1,
	input PreparedPythonGraphExecutionInput,
) (ApplicationPortablePythonGraphResultV1, error)

ExecuteApplicationPortablePythonGraphV1 consumes the complete selected application preflight through the existing Python graph. A matching lock replays its exact wheels; otherwise the provider acquires the selected wheels after interpreter eligibility and before resolver staging.

type ApplicationPortableToolPlanV1 

type ApplicationPortableToolPlanV1 struct {
	Target              toolcatalog.TargetIdentityV1
	Plan                providers.PortableToolPlanV1
	DAG                 providers.PortableToolProviderDAGV1
	Closures            []toolcatalog.SelectedClosureV1
	Snapshot            toolcatalog.ImmutableOperationSnapshotV1
	ProjectedComponents []providers.ResolvedComponentRequestV1
	PythonProjection    pythonprovider.PortableToolPythonProjectionV1
	// contains filtered or unexported fields
}

ApplicationPortableToolPlanV1 is selection and provider preflight only. The ordinary request boundary continues to reject tools until materialization owns the complete selected plan.

func PlanApplicationPortableToolsV1 

func PlanApplicationPortableToolsV1(ctx context.Context, input PlanApplicationPortableToolsInputV1) (*ApplicationPortableToolPlanV1, error)

PlanApplicationPortableToolsV1 selects exactly the resolved application's runtime requirements. Ordinary component requests are projected into the same immutable selection operation, and the existing provider projections and DAG reject conflicts before any portable artifact is acquired.

type ApplicationRuntimeLayerBuildRequest 

type ApplicationRuntimeLayerBuildRequest struct {
	Source   InspectedImageCandidate
	Verifier deploy.ApplicationStartupVerifierV1
	Account  deploy.ApplicationLocalAccountV1
	Platform blueprint.Platform
}

type ApplicationSandboxPlanV1 

type ApplicationSandboxPlanV1 struct {
	RuntimeUser     RuntimeUserPlan
	Network         ApplicationNetworkPolicyV1
	ReadOnlyRoot    bool
	TemporaryHome   string
	StartupVerifier deploy.ApplicationStartupVerifierV1
	Kernel          ApplicationKernelPolicyV1
}

ApplicationSandboxPlanV1 is the common security boundary consumed by every application-container renderer. It contains only policies that Reploy currently enforces; later sandbox slices extend this plan rather than adding renderer-specific flags.

type BuildKitCapabilities 

type BuildKitCapabilities struct {
	ServerVersion   string
	ServerOS        string
	OperatingSystem string
	Context         string
	Engine          DockerEngineKind
}

func ProbeBuildKitCapabilities 

func ProbeBuildKitCapabilities(ctx context.Context) (BuildKitCapabilities, error)

ProbeBuildKitCapabilities verifies the common Linux daemon contract used on native Linux and by Docker Desktop. The generated-build smoke test remains the final proof that the daemon's BuildKit frontend supports RUN mounts.

type BuildLockAssemblyInput 

type BuildLockAssemblyInput struct {
	BlueprintDigest      canonical.Digest
	ResolvedRequest      providers.ResolvedRequestV1
	Overlay              deploy.RequestOverlayV1
	PackageOverrides     deploy.PackageOverrideIntentV1
	Base                 deploy.ImageDescriptor
	Graph                providers.GraphExecutionResult
	PortableTools        *providers.PortableToolLockV1
	PortableRuntimeLayer *deploy.PortableRuntimeLayerV1
	RuntimePolicy        deploy.RuntimePolicyV1
	RuntimeLayer         deploy.ApplicationRuntimeLayerV1
	ValidationRecord     providerstore.StoreObjectRef
	FinalImage           providers.RealizedImageV1
}

type BuildPublicationInput 

type BuildPublicationInput struct {
	Environment   string
	DeploymentDir string
	Document      blueprint.Document
	Lock          deploy.BuildLockV1
	NoCache       bool
}

type BuildValidationResult 

type BuildValidationResult struct {
	Layers []PublishedImageValidation
	Final  PublishedImageValidation
}

func ValidateBuildImages 

func ValidateBuildImages(
	ctx context.Context,
	store providerstore.Store,
	layers []FullImageValidationInput,
	final FullImageValidationInput,
	validateProfileOwner providers.RequirementProfileOwnerValidator,
	run FullImageValidationRunner,
) (BuildValidationResult, error)

type BuiltImageCandidate 

type BuiltImageCandidate struct {
	ImageID            canonical.Digest
	TemporaryReference string
	Workspace          string
	// contains filtered or unexported fields
}

BuiltImageCandidate is deliberately not providers.RealizedImageV1. It has not yet passed image inspection or final validation and cannot be published.

func BuildApplicationRuntimeLayerCandidate 

func BuildApplicationRuntimeLayerCandidate(
	store providerstore.Store,
	request ApplicationRuntimeLayerBuildRequest,
	options RunOptions,
) (result BuiltImageCandidate, resultErr error)

func BuildFinalizedImageCandidate 

func BuildFinalizedImageCandidate(store providerstore.Store, request FinalizationBuildRequest, options RunOptions) (result BuiltImageCandidate, resultErr error)

type CommandOutputCapture 

type CommandOutputCapture struct {
	// contains filtered or unexported fields
}

CommandOutputCapture identifies one build invocation's explicit diagnostic channel. Its non-zero-sized token makes each operation's owner distinct.

func NewCommandOutputCapture 

func NewCommandOutputCapture() *CommandOutputCapture

NewCommandOutputCapture creates an operation-owned diagnostic channel.

func (*CommandOutputCapture) Wrap 

func (capture *CommandOutputCapture) Wrap(err error, output string) error

Wrap attaches bounded live output to an error without changing its rendered message or its errors.Is/errors.As behavior.

type CommandSpec 

type CommandSpec struct {
	Name string
	Args []string
	Dir  string
	Env  []string
	// contains filtered or unexported fields
}

func MaterializationBuildCommand 

func MaterializationBuildCommand(plan MaterializationBuildPlan) (CommandSpec, error)

func RuntimeCommand 

func RuntimeCommand(dir string, action string) (CommandSpec, error)

func RuntimeCommandWithOptions 

func RuntimeCommandWithOptions(dir string, action string, options RuntimeCommandOptions) (CommandSpec, error)

func RuntimeContainerLogsCommandV1 

func RuntimeContainerLogsCommandV1(containerID string, options RuntimeCommandOptions) (CommandSpec, error)

func ShellCommandSpec 

func ShellCommandSpec(plan DockerExecutionPlan, interactive bool, tty bool) CommandSpec

func TemporaryContainerCleanupCommand 

func TemporaryContainerCleanupCommand(containerName string) CommandSpec

func TemporaryContainerStopCommand 

func TemporaryContainerStopCommand(containerName string) CommandSpec

func TransientCommandSpec 

func TransientCommandSpec(plan DockerExecutionPlan, command ResolvedEnvironmentCommand, output *transientOutputMount, interactive bool, tty bool) (CommandSpec, error)

type ControlAdmissionInputV1 

type ControlAdmissionInputV1 struct {
	Operation              deploy.ControlOperationV1
	GenerationReference    string
	Mode                   ControlAdmissionModeV1
	DockerPreflightTimeout time.Duration
	Notice                 io.Writer
}

type ControlAdmissionModeV1 

type ControlAdmissionModeV1 string
const (
	ControlAdmissionImmediateV1 ControlAdmissionModeV1 = "immediate"
	ControlAdmissionWaitV1      ControlAdmissionModeV1 = "wait"
	ControlAdmissionDrainV1     ControlAdmissionModeV1 = "drain"
	ControlAdmissionForceV1     ControlAdmissionModeV1 = "force"
)

type ControlledSessionChannelPlanV1 

type ControlledSessionChannelPlanV1 struct {
	HostDirectory      string `json:"host_directory"`
	ContainerDirectory string `json:"container_directory"`
	ContainerSocket    string `json:"container_socket"`
}

type ControlledSessionContainerPlanV1 

type ControlledSessionContainerPlanV1 struct {
	Schema              string                                `json:"schema"`
	Role                ControlledSessionRoleV1               `json:"role"`
	LiveRunID           string                                `json:"live_run_id"`
	DeploymentID        string                                `json:"deployment_id"`
	DeploymentDirectory string                                `json:"deployment_directory"`
	GenerationReference string                                `json:"generation_reference"`
	BuildIdentity       canonical.Digest                      `json:"build_identity"`
	Image               string                                `json:"image"`
	ControllerPackage   *ControlledSessionControllerPackageV1 `json:"controller_package,omitempty"`
	Container           string                                `json:"container"`
	RuntimeIdentity     controlledsession.RuntimeIdentityV1   `json:"runtime_identity"`
	Network             string                                `json:"network"`
	NetworkPolicy       ApplicationNetworkPolicyV1            `json:"network_policy"`
	SessionNetwork      ControlledSessionNetworkPlanV1        `json:"session_network"`
	ReadOnlyRoot        bool                                  `json:"read_only_root"`
	TemporaryHome       string                                `json:"temporary_home"`
	StartupVerifier     string                                `json:"startup_verifier"`
	SetupCapabilities   []string                              `json:"setup_capabilities"`
	SecurityOptions     []string                              `json:"security_options"`
	Environment         []string                              `json:"environment"`
	Labels              []ControlledSessionLabelV1            `json:"labels"`
	Mounts              []ControlledSessionMountV1            `json:"mounts"`
	Masks               []ControlledSessionMaskV1             `json:"masks"`
	Command             []string                              `json:"command"`
	TTY                 bool                                  `json:"tty"`
	OpenStdin           bool                                  `json:"open_stdin"`
	InitialColumns      string                                `json:"initial_columns"`
	InitialRows         string                                `json:"initial_rows"`
	Create              ControlledSessionDockerCommandV1      `json:"create"`
	Start               ControlledSessionDockerCommandV1      `json:"start"`
	Cleanup             ControlledSessionDockerCommandV1      `json:"cleanup"`
}

type ControlledSessionControllerOutputKindV1 

type ControlledSessionControllerOutputKindV1 string
const (
	ControlledSessionControllerOutputNotRequestedV1      ControlledSessionControllerOutputKindV1 = "not-requested"
	ControlledSessionControllerOutputDirectoryRetainedV1 ControlledSessionControllerOutputKindV1 = "directory-retained"
	ControlledSessionControllerOutputFilePublishedV1     ControlledSessionControllerOutputKindV1 = "file-published"
	ControlledSessionControllerOutputFileDiscardedV1     ControlledSessionControllerOutputKindV1 = "file-discarded"
	ControlledSessionControllerOutputFailedV1            ControlledSessionControllerOutputKindV1 = "failed"
)

type ControlledSessionControllerOutputStatusV1 

type ControlledSessionControllerOutputStatusV1 struct {
	Kind   ControlledSessionControllerOutputKindV1 `json:"kind"`
	Reason string                                  `json:"reason,omitempty"`
}

type ControlledSessionControllerPackageV1 

type ControlledSessionControllerPackageV1 struct {
	Schema      string                    `json:"schema"`
	Platform    blueprint.Platform        `json:"platform"`
	Release     probearchive.ReleaseV1    `json:"release"`
	Artifact    canonical.Digest          `json:"artifact"`
	SourceImage providers.RealizedImageV1 `json:"source_image"`
	Image       providers.RealizedImageV1 `json:"image"`
	Executable  string                    `json:"executable"`
}

type ControlledSessionDockerCommandV1 

type ControlledSessionDockerCommandV1 struct {
	Name string   `json:"name"`
	Args []string `json:"args"`
}

type ControlledSessionEndpointPlanV1 

type ControlledSessionEndpointPlanV1 struct {
	ID     string `json:"id"`
	Scheme string `json:"scheme"`
	Host   string `json:"host"`
	Port   string `json:"port"`
}

type ControlledSessionExecutionPlanV1 

type ControlledSessionExecutionPlanV1 struct {
	Schema        string                            `json:"schema"`
	LiveRunID     string                            `json:"live_run_id"`
	Channel       ControlledSessionChannelPlanV1    `json:"channel"`
	Controller    ControlledSessionContainerPlanV1  `json:"controller"`
	Workload      ControlledSessionContainerPlanV1  `json:"workload"`
	Authorization controlledsession.AuthorizationV1 `json:"authorization"`
}

func PlanControlledSessionV1 

func PlanControlledSessionV1(input ControlledSessionPlanInputV1) (ControlledSessionExecutionPlanV1, error)

PlanControlledSessionV1 derives the complete immutable Docker authority for one prospective controller/workload run before admission. It is read-only and creates no host or Docker resources.

type ControlledSessionLabelV1 

type ControlledSessionLabelV1 struct {
	Name  string `json:"name"`
	Value string `json:"value"`
}

type ControlledSessionMaskV1 

type ControlledSessionMaskV1 struct {
	Kind   string `json:"kind"`
	Target string `json:"target"`
}

type ControlledSessionMountV1 

type ControlledSessionMountV1 struct {
	Name       string `json:"name"`
	Type       string `json:"type"`
	Source     string `json:"source"`
	SourceKind string `json:"source_kind"`
	Target     string `json:"target"`
	ReadOnly   bool   `json:"read_only"`
}

type ControlledSessionNetworkPlanV1 

type ControlledSessionNetworkPlanV1 struct {
	Enabled   bool                              `json:"enabled"`
	Name      string                            `json:"name"`
	Internal  bool                              `json:"internal"`
	Alias     string                            `json:"alias"`
	PeerAlias string                            `json:"peer_alias"`
	Endpoints []ControlledSessionEndpointPlanV1 `json:"endpoints"`
}

type ControlledSessionPlanInputV1 

type ControlledSessionPlanInputV1 struct {
	Handle                       string
	LiveRunID                    string
	ControllerCurrent            CurrentBuild
	ControllerPackage            ControlledSessionControllerPackageV1
	ControllerRuntime            CurrentRuntimePlanV1
	ControllerCommand            string
	ControllerForwardedArguments []string

	WorkloadCurrent CurrentBuild
	WorkloadRuntime CurrentRuntimePlanV1
	EndpointIDs     []string
	InitialColumns  uint32
	InitialRows     uint32
	// contains filtered or unexported fields
}

type ControlledSessionRoleV1 

type ControlledSessionRoleV1 string
const (
	ControlledSessionRoleControllerV1 ControlledSessionRoleV1 = "controller"
	ControlledSessionRoleWorkloadV1   ControlledSessionRoleV1 = "workload"
)

type ControlledSessionRunOptionsV1 

type ControlledSessionRunOptionsV1 struct {
	StartupTimeout                time.Duration
	TerminationGrace              time.Duration
	ControllerFinalizationTimeout time.Duration
	ResultAcknowledgementTimeout  time.Duration
	CleanupTimeout                time.Duration
}

type ControlledSessionRunResultV1 

type ControlledSessionRunResultV1 struct {
	SessionResult              controlledsession.ResultV1
	ResultDelivered            bool
	ResultAcknowledged         bool
	ControllerStatus           controlledsession.ProcessStatusV1
	DeliveryTailCleanupStatus  controlledsession.CleanupStatusV1
	DeliveryTailRecoveryAction controlledsession.RecoveryActionV1
}

ControlledSessionRunResultV1 separates the authoritative session result delivered over the private channel from delivery-tail facts that can exist only after that channel and the controller have been removed.

func RunControlledSessionV1 

func RunControlledSessionV1(
	ctx context.Context,
	operation *deploy.OperationLock,
	plan ControlledSessionExecutionPlanV1,
	options ControlledSessionRunOptionsV1,
) (ControlledSessionRunResultV1, error)

RunControlledSessionV1 takes ownership of the admitted workload operation lock. The caller must retain the live-run queue-entry lease until this call returns. The supervisor durably records the exact private network, both inert containers, and the private channel before releasing the lock and starting either process.

type CurrentAppCommandRunInputV1 

type CurrentAppCommandRunInputV1 struct {
	DeploymentDir string
	Arguments     []string
	DeployedOnly  bool
	OutputDir     string
	OutputFile    string
	Wait          bool
	Runtime       StagedProviderBuildRuntimeV1
	TTY           bool
	RunOptions    RunOptions
}

type CurrentBuild 

type CurrentBuild struct {
	State      deploy.StateV1
	Generation deploy.EnvironmentGenerationState
	Lock       deploy.BuildLockV1
}

func LoadRecordedCurrentBuildV1 

func LoadRecordedCurrentBuildV1(
	ctx context.Context,
	operation *deploy.OperationLock,
	store providerstore.Store,
	environment string,
	deploymentDir string,
) (CurrentBuild, bool, error)

LoadRecordedCurrentBuildV1 validates the recorded state and lock without inspecting Docker. It is for read-only metadata rendering after an operation has already validated and published the image.

func RequirePublishedRuntimeReady 

func RequirePublishedRuntimeReady(ctx context.Context, input PublishedRuntimeReadinessInput) (CurrentBuild, error)

func ValidateCurrentBuild 

func ValidateCurrentBuild(
	ctx context.Context,
	operation *deploy.OperationLock,
	store providerstore.Store,
	environment string,
	deploymentDir string,
) (CurrentBuild, bool, error)

ValidateCurrentBuild is read-only and intentionally does not rehash the provider-store closure. Runtime operations need the selected lock and exact owned Docker reference checks; install transfer validates artifacts separately when it consumes them. Absence is reported separately, while a state, lock, or Docker-reference mismatch is corruption rather than absence.

type CurrentBuildImageMissingErrorV1 

type CurrentBuildImageMissingErrorV1 struct {
	Subject string
	ImageID canonical.Digest
	// contains filtered or unexported fields
}

func (*CurrentBuildImageMissingErrorV1) Error 

func (err *CurrentBuildImageMissingErrorV1) Error() string

func (*CurrentBuildImageMissingErrorV1) Unwrap 

func (err *CurrentBuildImageMissingErrorV1) Unwrap() error

type CurrentBuildReuseInput 

type CurrentBuildReuseInput struct {
	ResolvedRequest  providers.ResolvedRequestV1
	Overlay          deploy.RequestOverlayV1
	PackageOverrides deploy.PackageOverrideIntentV1
	Base             deploy.ImageDescriptor
	Document         blueprint.Document
	DockerPlan       DockerExecutionPlan
	StartupVerifier  deploy.ApplicationStartupVerifierV1
	PortableToolPlan *providers.PortableToolPlanV1
	Progress         io.Writer
}

type CurrentBuildVerificationInputV1 

type CurrentBuildVerificationInputV1 struct {
	Operation     *deploy.OperationLock
	DeploymentDir string
	Store         providerstore.Store
	Current       CurrentBuild
	Runtime       CurrentRuntimePlanV1
	RunValidation FullImageValidationRunner
}

type CurrentBuildVerificationResultV1 

type CurrentBuildVerificationResultV1 struct {
	StoreObjects int
	Images       int
	Commands     int
}

func VerifyLoadedCurrentBuildV1 

func VerifyLoadedCurrentBuildV1(
	ctx context.Context,
	input CurrentBuildVerificationInputV1,
) (CurrentBuildVerificationResultV1, error)

VerifyLoadedCurrentBuildV1 audits an already loaded current generation. It fully hashes the provider-store closure, re-inspects every immutable image, reruns cumulative provider validation, and proves the recorded runtime policy and command catalog. It does not publish, repair, or replace state.

type CurrentControlledSessionRunInputV1 

type CurrentControlledSessionRunInputV1 struct {
	ControllerDeploymentDir string
	WorkloadDeploymentDir   string
	ControllerCommand       string
	ControllerArguments     []string
	EndpointIDs             []string
	OutputDir               string
	OutputFile              string
	InitialColumns          uint32
	InitialRows             uint32
	Runtime                 StagedProviderBuildRuntimeV1
	SupervisorOptions       ControlledSessionRunOptionsV1
	Notice                  io.Writer
}

CurrentControlledSessionRunInputV1 selects two exact current generations, one declared controller command, and an optional controller-only output for a controlled session. Admission is intentionally immediate: a future queued form must preserve the same atomic two-deployment generation check while it waits.

type CurrentControlledSessionRunResultV1 

type CurrentControlledSessionRunResultV1 struct {
	ControlledSessionRunResultV1
	ControllerOutput ControlledSessionControllerOutputStatusV1
}

func RunCurrentControlledSessionV1 

func RunCurrentControlledSessionV1(
	ctx context.Context,
	input CurrentControlledSessionRunInputV1,
) (CurrentControlledSessionRunResultV1, error)

RunCurrentControlledSessionV1 validates and admits one exact controller and workload pair before delegating all resource and lifecycle ownership to the controlled-session supervisor. It retains the controller deployment lock for the supervisor's complete lifetime, so another app, shell, control operation, or controlled session cannot use that controller generation concurrently.

type CurrentRuntimeObservationInputV1 

type CurrentRuntimeObservationInputV1 struct {
	DeploymentDir string
	Action        string
	Runtime       StagedProviderBuildRuntimeV1
	Command       RuntimeCommandOptions
	RunOptions    RunOptions
}

type CurrentRuntimePlanInputV1 

type CurrentRuntimePlanInputV1 struct {
	DeploymentDir string
	Current       CurrentBuild
	Runtime       StagedProviderBuildRuntimeV1
	// AllowConfiguringRepair permits install/uninstall recovery to reconstruct
	// the recorded plan while ordinary runtime operations remain blocked.
	AllowConfiguringRepair bool
}

type CurrentRuntimePlanV1 

type CurrentRuntimePlanV1 struct {
	Document blueprint.Document
	Docker   DockerExecutionPlan
}

func PlanCurrentRuntimeV1 

func PlanCurrentRuntimeV1(input CurrentRuntimePlanInputV1) (CurrentRuntimePlanV1, error)

PlanCurrentRuntimeV1 reconstructs the exact container plan represented by a current state-v1 generation. It is read-only: system-account lookup is allowed, but account creation, provider work, image construction, and Docker commands are not.

type CurrentRuntimeTestInputV1 

type CurrentRuntimeTestInputV1 struct {
	DeploymentDir          string
	Runtime                StagedProviderBuildRuntimeV1
	Timeout                time.Duration
	Stdout                 io.Writer
	RestartingDiagnostics  string
	DockerPreflightTimeout time.Duration
}

type CurrentShellRunInputV1 

type CurrentShellRunInputV1 struct {
	DeploymentDir string
	Wait          bool
	ReadOnly      bool
	Runtime       StagedProviderBuildRuntimeV1
	TTY           bool
	RunOptions    RunOptions
}

type CurrentWorkloadLifecycleInputV1 

type CurrentWorkloadLifecycleInputV1 struct {
	Operation           *deploy.OperationLock
	Store               providerstore.Store
	Current             CurrentBuild
	Plan                CurrentRuntimePlanV1
	Environment         string
	DeploymentDir       string
	Action              string
	RunOptions          RunOptions
	Progress            io.Writer
	StartCommand        *CommandSpec
	StopCommand         *CommandSpec
	PrivateEnvironment  privateWorkloadEnvironmentV1
	PrivateRuntimeMasks []privateRuntimeMaskV1
}

type CurrentWorkloadRunInputV1 

type CurrentWorkloadRunInputV1 struct {
	DeploymentDir string
	Action        string
	ControlMode   ControlAdmissionModeV1
	Runtime       StagedProviderBuildRuntimeV1
	RunOptions    RunOptions
	Progress      io.Writer
	Notice        io.Writer
}

type DesiredStateStageInputV1 

type DesiredStateStageInputV1 struct {
	DeploymentDir    string
	Document         blueprint.Document
	ExplicitPlatform string
	BlueprintSource  string
	InitialOverrides *deploy.PackageOverridesV1
	Create           bool
}

type DirectInstallOptions 

type DirectInstallOptions struct {
	Pack                   deploy.PackRef
	Target                 string
	ControlMode            ControlAdmissionModeV1
	Scope                  InstallScope
	Service                string
	PortOverrides          []PortOverride
	Replace                []string
	Clean                  bool
	Start                  bool
	DryRun                 bool
	Stdout                 io.Writer
	Progress               io.Writer
	DockerPreflightTimeout time.Duration
}

type DirectProviderInstallInputV1 

type DirectProviderInstallInputV1 struct {
	Pack             deploy.PackRef
	ExplicitPlatform string
	Target           string
	Runtime          StagedProviderBuildRuntimeV1
	ControlMode      ControlAdmissionModeV1
	Scope            InstallScope
	Service          string
	PortOverrides    []PortOverride
	Replace          []string
	Clean            bool
	Start            bool
	RunOptions       RunOptions
}

type DirectProviderInstallResultV1 

type DirectProviderInstallResultV1 struct {
	Target  string
	State   deploy.StateV1
	Install ProviderInstallResultV1
}

func RunDirectProviderInstallV1 

func RunDirectProviderInstallV1(ctx context.Context, input DirectProviderInstallInputV1) (DirectProviderInstallResultV1, error)

type DockerControlInput 

type DockerControlInput struct {
	Script      string
	Environment string
	HasWorkload bool
}

type DockerControllerV1 

type DockerControllerV1 struct {
	// contains filtered or unexported fields
}

DockerControllerV1 is the narrow Docker boundary for the trusted controller container. Creation uses the immutable planned name; every later operation uses the exact full container ID returned by that successful create.

func PrepareDockerControllerV1 

func PrepareDockerControllerV1(
	ctx context.Context,
	plan ControlledSessionContainerPlanV1,
) (*DockerControllerV1, error)

PrepareDockerControllerV1 verifies that the private channel is ready and creates the exact controller container without starting it.

func (*DockerControllerV1) Cleanup 

func (controller *DockerControllerV1) Cleanup(ctx context.Context) error

Cleanup force-removes the exact created controller by its full container ID. Successful cleanup is idempotent within this adapter; a failed attempt may be retried.

func (*DockerControllerV1) ContainerID 

func (controller *DockerControllerV1) ContainerID() string

func (*DockerControllerV1) ForceStop 

func (controller *DockerControllerV1) ForceStop(ctx context.Context) error

ForceStop delivers SIGKILL to the controller.

func (*DockerControllerV1) RequestGracefulStop 

func (controller *DockerControllerV1) RequestGracefulStop(ctx context.Context) error

RequestGracefulStop delivers SIGTERM to the controller. The lifecycle supervisor owns the grace deadline and follows with ForceStop when needed.

func (*DockerControllerV1) Start 

func (controller *DockerControllerV1) Start(ctx context.Context) error

Start starts the inert controller and begins independent Docker exit observation. A failed start is terminal because Docker may have started the process before its response was lost; the exact container is force-removed.

func (*DockerControllerV1) Wait 

func (controller *DockerControllerV1) Wait(ctx context.Context) (controlledsession.ProcessStatusV1, error)

Wait returns the immutable Docker-observed controller exit status. Caller cancellation stops only this wait; independent host observation continues.

type DockerEngineKind 

type DockerEngineKind string
const (
	DockerEngineLinux   DockerEngineKind = "linux-engine"
	DockerEngineDesktop DockerEngineKind = "docker-desktop"
)

type DockerExecutionPlan 

type DockerExecutionPlan struct {
	EnvironmentID string
	// DeploymentDir is the host deployment root whose private runtime files
	// must be masked from every container-visible bind-mount alias.
	DeploymentDir string
	Phase         blueprint.Phase
	Scope         *blueprint.InstallScope
	Image         string
	ContainerName string
	NetworkName   string
	Restart       string
	// PrivateEnvironment is a deployment-local runtime property. It controls
	// launcher rendering only and is never persisted in build state or locks.
	PrivateEnvironment bool
	Workload           *WorkloadExecutionPlan
	Mounts             []MountExecutionPlan
	Sandbox            ApplicationSandboxPlanV1
}

func PlanDockerExecution 

func PlanDockerExecution(document blueprint.Document, context DockerPlanContext) (DockerExecutionPlan, error)

type DockerPlanContext 

type DockerPlanContext struct {
	DeploymentDir     string
	InstallTarget     string
	Phase             blueprint.Phase
	Scope             *blueprint.InstallScope
	GeneratedImage    string
	Host              blueprint.HostOS
	UID               uint32
	GID               uint32
	SupplementaryGIDs []uint32
	SystemUser        string
	SystemGroup       string
	PortOverrides     map[string]int
	PortOverrideArgs  []PortOverride
}

type DockerPlanStatus 

type DockerPlanStatus struct {
	Environment string
	Phase       string
	Scope       string
	Image       string
	Container   string
	Endpoints   []string
}

type DockerRenderedInputs 

type DockerRenderedInputs struct {
	Compose     []byte
	Environment map[string]string
	DryRun      []string
	Status      DockerPlanStatus
	Control     DockerControlInput
	// contains filtered or unexported fields
}

func RenderDockerInputs 

func RenderDockerInputs(plan DockerExecutionPlan, controlScript string) (DockerRenderedInputs, error)

type DockerSessionNetworkV1 

type DockerSessionNetworkV1 struct {
	// contains filtered or unexported fields
}

DockerSessionNetworkV1 owns one exact engine-internal Docker network. The adapter accepts only the two exact container IDs selected at attachment time and refuses cleanup if inspection finds a different member or ownership label.

func PrepareDockerSessionNetworkV1 

func PrepareDockerSessionNetworkV1(
	ctx context.Context,
	plan ControlledSessionExecutionPlanV1,
) (*DockerSessionNetworkV1, error)

PrepareDockerSessionNetworkV1 creates and verifies the exact planned engine-internal network without attaching either inert container.

func (*DockerSessionNetworkV1) Attach 

func (network *DockerSessionNetworkV1) Attach(ctx context.Context, controllerID string, workloadID string) error

Attach verifies the exact controller and workload inert containers, connects participants that retain separately granted ordinary networking, and then verifies that the session network contains only those two exact full IDs.

func (*DockerSessionNetworkV1) Cleanup 

func (network *DockerSessionNetworkV1) Cleanup(ctx context.Context) error

Cleanup disconnects only the exact selected containers, removes the exact full network ID, and independently verifies absence. Ownership-label or unexpected-member mismatches fail closed without mutating the network.

func (*DockerSessionNetworkV1) ID 

func (network *DockerSessionNetworkV1) ID() string

func (*DockerSessionNetworkV1) Name 

func (network *DockerSessionNetworkV1) Name() string

func (*DockerSessionNetworkV1) Realization 

func (network *DockerSessionNetworkV1) Realization() controlledSessionNetworkRealizationV1

func (*DockerSessionNetworkV1) Subnets 

func (network *DockerSessionNetworkV1) Subnets() []string

func (*DockerSessionNetworkV1) Verify 

func (network *DockerSessionNetworkV1) Verify(ctx context.Context) error

Verify checks exact network ownership, isolation mode, subnets, and member identities without changing Docker state.

func (*DockerSessionNetworkV1) VerifyStarted 

func (network *DockerSessionNetworkV1) VerifyStarted(ctx context.Context) error

VerifyStarted requires the controller and every still-running workload to appear as exact network members after Docker has started them. A workload that has already exited retains its verified fixed IPAM request without being misclassified as a startup failure.

type DockerWorkloadPTYV1 

type DockerWorkloadPTYV1 struct {
	// contains filtered or unexported fields
}

DockerWorkloadPTYV1 is the narrow Docker boundary owned by the attached controlled-session host operation. Closing it closes only the PTY attachment; container cleanup remains the lifecycle supervisor's job.

func PrepareDockerWorkloadPTYV1 

func PrepareDockerWorkloadPTYV1(
	ctx context.Context,
	plan ControlledSessionContainerPlanV1,
) (*DockerWorkloadPTYV1, error)

PrepareDockerWorkloadPTYV1 creates the exact workload container without starting it and establishes the Docker PTY attachment before returning.

func (*DockerWorkloadPTYV1) Cleanup 

func (workload *DockerWorkloadPTYV1) Cleanup(ctx context.Context) error

Cleanup force-removes the exact planned workload container. Successful cleanup is idempotent within this adapter; a failed attempt may be retried. The lifecycle supervisor must finalize or close PTY output before calling it.

func (*DockerWorkloadPTYV1) Close 

func (workload *DockerWorkloadPTYV1) Close() error

Close closes only the PTY attachment and permanently unblocks its reader.

func (*DockerWorkloadPTYV1) ContainerID 

func (workload *DockerWorkloadPTYV1) ContainerID() string

func (*DockerWorkloadPTYV1) ForceStop 

func (workload *DockerWorkloadPTYV1) ForceStop(ctx context.Context) error

ForceStop delivers SIGKILL to the workload container.

func (*DockerWorkloadPTYV1) Output 

func (workload *DockerWorkloadPTYV1) Output() (io.ReadCloser, error)

Output returns the one ordered raw PTY output source. It may be claimed once before Start so the output pump is ready before workload code can execute.

func (*DockerWorkloadPTYV1) RequestGracefulStop 

func (workload *DockerWorkloadPTYV1) RequestGracefulStop(ctx context.Context) error

RequestGracefulStop delivers SIGTERM to the workload container. The caller owns the grace deadline and must follow with ForceStop if exit is not observed in time.

func (*DockerWorkloadPTYV1) Resize 

func (workload *DockerWorkloadPTYV1) Resize(ctx context.Context, columns uint32, rows uint32) error

Resize applies one terminal window size through Docker.

func (*DockerWorkloadPTYV1) Start 

func (workload *DockerWorkloadPTYV1) Start(ctx context.Context) error

Start starts the already-attached inert container, begins independent exit observation, and applies the immutable initial terminal dimensions before returning success. Docker does not permit resizing a created container, so the initial resize is the first post-start operation and activation must not be declared until Start returns successfully.

func (*DockerWorkloadPTYV1) Started 

func (workload *DockerWorkloadPTYV1) Started() bool

Started reports whether Docker accepted the workload start. Start can fail after this becomes true—for example, while applying the initial PTY size—so the supervisor uses it to select the full teardown and output barrier.

func (*DockerWorkloadPTYV1) Wait 

func (workload *DockerWorkloadPTYV1) Wait(ctx context.Context) (controlledsession.ProcessStatusV1, error)

Wait returns the immutable Docker-observed exit status. Caller cancellation stops only that wait; the independent host observation continues.

func (*DockerWorkloadPTYV1) WriteInput 

func (workload *DockerWorkloadPTYV1) WriteInput(ctx context.Context, data []byte) error

WriteInput writes all bytes exactly as supplied to the Docker PTY.

type DoctorFinding 

type DoctorFinding struct {
	Status  string
	Message string
}

type DoctorOptions 

type DoctorOptions struct {
	Dir                    string
	Preinstall             bool
	Scope                  InstallScope
	Quiet                  bool
	SuppressWarnings       bool
	Stdout                 io.Writer
	DockerPreflightTimeout time.Duration
}

type EmbeddedControlMetadataV1 

type EmbeddedControlMetadataV1 struct {
	EnvironmentID string
	ControlScript string
	SystemdUnit   string
	Deployed      bool
}

func LoadEmbeddedControlMetadataV1 

func LoadEmbeddedControlMetadataV1(ctx context.Context, dir string) (metadata EmbeddedControlMetadataV1, found bool, err error)

LoadEmbeddedControlMetadataV1 reads only the state needed by a staged or installed self-contained control wrapper. A false result means the deployment does not use state-v1.

type EndpointExecutionPlan 

type EndpointExecutionPlan struct {
	Scheme         string
	ContainerPort  int
	BindAddress    string
	PublishAddress string
	PublishedPort  int
	ProbeHost      string
	Readiness      *blueprint.Readiness
}

type EnvironmentImageReferences 

type EnvironmentImageReferences struct {
	Temporary  string
	Generation string
}

func NewEnvironmentImageReferences 

func NewEnvironmentImageReferences(environment string, deploymentDir string) (EnvironmentImageReferences, error)

type EnvironmentReferenceKind 

type EnvironmentReferenceKind string
const (
	EnvironmentReferenceTemporary  EnvironmentReferenceKind = "temporary"
	EnvironmentReferenceGeneration EnvironmentReferenceKind = "generation"
)

type FinalizationBuildRequest 

type FinalizationBuildRequest struct {
	Source              InspectedImageCandidate
	Validation          deploy.PrefixValidationV1
	ValidationReference providerstore.StoreObjectRef
	Platform            blueprint.Platform
}

type FinalizedBuildValidationResult 

type FinalizedBuildValidationResult struct {
	Validation   BuildValidationResult
	RuntimeLayer deploy.ApplicationRuntimeLayerV1
	Image        InspectedImageCandidate
	Candidate    BuiltImageCandidate
}

func ValidateAndFinalizeBuild 

func ValidateAndFinalizeBuild(
	ctx context.Context,
	store providerstore.Store,
	layers []FullImageValidationInput,
	final FullImageValidationInput,
	validateProfileOwner providers.RequirementProfileOwnerValidator,
	runValidation FullImageValidationRunner,
	verifier deploy.ApplicationStartupVerifierV1,
	account deploy.ApplicationLocalAccountV1,
	options RunOptions,
) (FinalizedBuildValidationResult, error)

type ForceReplaceStagedDesiredStateInputV1 

type ForceReplaceStagedDesiredStateInputV1 struct {
	DesiredState DesiredStateStageInputV1
	RunOptions   RunOptions
}

type FullImageExecutableProbe 

type FullImageExecutableProbe struct {
	ID             string
	InvocationPath string
	Binding        ProbeExecutableBinding
}

type FullImageValidationInput 

type FullImageValidationInput struct {
	Image         InspectedImageCandidate
	Profiles      []providers.RequirementProfile
	Outputs       []providers.RealizedOutput
	RuntimePolicy deploy.RuntimePolicyV1
}

type FullImageValidationRunner 

type FullImageValidationRunner func(
	context.Context,
	FullImageValidationInput,
) ([]providers.ValidationEvidence, []providers.ExecutableEvidence, error)

type ImageValidationSession 

type ImageValidationSession struct {
	// contains filtered or unexported fields
}

func OpenAPTImageValidationSession 

func OpenAPTImageValidationSession(
	ctx context.Context,
	descriptor deploy.ImageDescriptor,
	workspace PreparedProbeWorkspace,
	aptWorkspace PreparedAPTResolverWorkspace,
) (*ImageValidationSession, error)

OpenAPTImageValidationSession starts the same networkless validation container with the private APT scratch mount required by apt-resolve-v1's fixed profile commands. It does not grant package-network access.

func OpenImageValidationSession 

func OpenImageValidationSession(ctx context.Context, descriptor deploy.ImageDescriptor, workspace PreparedProbeWorkspace) (*ImageValidationSession, error)

OpenImageValidationSession starts one held, networkless container for full final-image or additive layer validation. Its public operations remain closed: callers may invoke the fixed filesystem probe and close the session, but cannot execute arbitrary commands.

func (*ImageValidationSession) Close 

func (session *ImageValidationSession) Close(ctx context.Context) error

Close force-removes exactly this validation container. It is idempotent after successful removal.

func (*ImageValidationSession) Probe 

func (session *ImageValidationSession) Probe(ctx context.Context, request probe.RequestV1) (probe.ResponseV1, error)

Probe performs one fixed canonical filesystem-observation exchange in the already-running validation container.

func (*ImageValidationSession) ProbeAPTBaseProfile 

func (session *ImageValidationSession) ProbeAPTBaseProfile(ctx context.Context) (APTBaseValidation, error)

ProbeAPTBaseProfile reproduces the same canonical APT base facts used by resolution inside this already-held networkless validation container.

func (*ImageValidationSession) ProbeSameFile 

func (session *ImageValidationSession) ProbeSameFile(ctx context.Context, request probe.RequestV1) (probe.ResponseV1, error)

ProbeSameFile verifies actual regular-file identity inside the held image. It uses the ordinary closed request and response, with one fixed helper mode.

func (*ImageValidationSession) QueryAlternative 

func (session *ImageValidationSession) QueryAlternative(ctx context.Context, group string) ([]byte, error)

QueryAlternative performs one fixed read-only query for a link-group name derived from an already-observed /etc/alternatives path.

func (*ImageValidationSession) QueryDPKGOwners 

func (session *ImageValidationSession) QueryDPKGOwners(ctx context.Context, paths []string) ([]byte, error)

QueryDPKGOwners performs the one fixed read-only ownership operation used for already-observed APT output paths. It does not enumerate packages or files and cannot execute a caller-selected command.

func (*ImageValidationSession) QueryDPKGPackageState 

func (session *ImageValidationSession) QueryDPKGPackageState(ctx context.Context, names []string) ([]byte, error)

QueryDPKGPackageState performs one fixed read-only exact-state query for already-known owner package names. It never enumerates installed packages.

func (*ImageValidationSession) ValidateBuildScratchAbsent 

func (session *ImageValidationSession) ValidateBuildScratchAbsent(ctx context.Context) error

ValidateBuildScratchAbsent performs the one fixed absence check required before provider mount roots can be trusted. It cannot inspect a caller-selected path.

func (*ImageValidationSession) ValidatePathsAbsent 

func (session *ImageValidationSession) ValidatePathsAbsent(ctx context.Context, paths []string) error

ValidatePathsAbsent performs the fixed absence check for exact absolute paths, rejecting existing entries and dangling symbolic links alike. Paths travel only as positional arguments to the fixed shell body; data never selects the command.

type InfoOptions 

type InfoOptions struct {
	Dir string
}

type InspectedImageCandidate 

type InspectedImageCandidate struct {
	Descriptor deploy.ImageDescriptor
	Config     deploy.BaseConfig
	Labels     map[string]string
	Image      providers.RealizedImageV1
}

InspectedImageCandidate records Docker's immutable observation of a built candidate. It is not final validation evidence and is not publishable state.

func InspectApplicationRuntimeLayerCandidate 

func InspectApplicationRuntimeLayerCandidate(
	ctx context.Context,
	built BuiltImageCandidate,
	request ApplicationRuntimeLayerBuildRequest,
) (InspectedImageCandidate, error)

func InspectBuiltImageCandidate 

func InspectBuiltImageCandidate(ctx context.Context, candidate BuiltImageCandidate, platform blueprint.Platform) (InspectedImageCandidate, error)

func InspectFinalizedImageCandidate 

func InspectFinalizedImageCandidate(ctx context.Context, built BuiltImageCandidate, request FinalizationBuildRequest) (InspectedImageCandidate, error)

type InspectedMaterializationLayerCandidate 

type InspectedMaterializationLayerCandidate struct {
	AssemblyKey       providers.AssemblyKeyV1
	AssemblyKeyDigest canonical.Digest
	Image             InspectedImageCandidate
	// contains filtered or unexported fields
}

InspectedMaterializationLayerCandidate has passed immutable Docker identity and controlled config inspection, but not final prefix validation.

func InspectMaterializationLayerCandidate 

func InspectMaterializationLayerCandidate(ctx context.Context, candidate MaterializationLayerCandidate, request MaterializationLayerRequest) (InspectedMaterializationLayerCandidate, error)

type InstallOptions 

type InstallOptions struct {
	Dir                    string
	Target                 string
	ControlMode            ControlAdmissionModeV1
	Scope                  InstallScope
	Service                string
	PortOverrides          []PortOverride
	Replace                []string
	Clean                  bool
	Start                  bool
	DryRun                 bool
	Stdout                 io.Writer
	Progress               io.Writer
	DockerPreflightTimeout time.Duration
}

type InstallScope 

type InstallScope string
const (
	InstallScopeUser   InstallScope = "user"
	InstallScopeSystem InstallScope = "system"
)

func ParseInstallScope 

func ParseInstallScope(value string) (InstallScope, error)

type InstalledBuildPublicationInputV1 

type InstalledBuildPublicationInputV1 struct {
	Environment              string
	SourceDeploymentDir      string
	DestinationDeploymentDir string
	Source                   CurrentBuild
	Build                    deploy.BuildLockV1
	Installation             deploy.InstallationStateV1
	References               EnvironmentImageReferences
}

type LifecycleExecutor 

type LifecycleExecutor struct {
	Materialize func(context.Context) error
	RunCommand  func(context.Context, ResolvedEnvironmentCommand) error
	Readiness   func(context.Context, EndpointExecutionPlan) error
	Start       func(context.Context) error
	Stop        func(context.Context) error
	Success     func(context.Context, []string) error
}

type LifecycleOperation 

type LifecycleOperation struct {
	Kind     LifecycleOperationKind
	Event    string
	Command  *ResolvedEnvironmentCommand
	Endpoint *EndpointExecutionPlan
	Lines    []string
}

type LifecycleOperationKind 

type LifecycleOperationKind string
const (
	LifecycleMaterialize LifecycleOperationKind = "materialize"
	LifecycleCommand     LifecycleOperationKind = "command"
	LifecycleReadiness   LifecycleOperationKind = "readiness"
	LifecycleStart       LifecycleOperationKind = "start"
	LifecycleStop        LifecycleOperationKind = "stop"
	LifecycleSuccess     LifecycleOperationKind = "success"
)

type LifecyclePlan 

type LifecyclePlan struct {
	Operations []LifecycleOperation
}

type LiveRunConcurrencyDecisionV1 

type LiveRunConcurrencyDecisionV1 struct {
	AllowsOverlap bool
	WritableMount string
	WritablePaths []string
}

LiveRunConcurrencyDecisionV1 records whether one app command or shell may overlap another outstanding run under the resolved blueprint policy.

func PlanLiveRunConcurrencyV1 

func PlanLiveRunConcurrencyV1(
	document blueprint.Document,
	plan DockerExecutionPlan,
	output *transientOutputMount,
) (LiveRunConcurrencyDecisionV1, error)

PlanLiveRunConcurrencyV1 applies the resolved blueprint policy to the effective runtime mounts. Output-file staging is private to one run, while output-dir is a shared writable mount.

type LiveRunStopResultV1 

type LiveRunStopResultV1 struct {
	Found    bool
	Run      deploy.LiveRunV1
	Recovery deploy.LiveRunRecoveryV1
}

func StopLiveRunV1 

func StopLiveRunV1(ctx context.Context, deploymentDir string, id string, dockerPreflightTimeout time.Duration) (LiveRunStopResultV1, error)

type LoadedBuildRequestV1 

type LoadedBuildRequestV1 struct {
	State            deploy.StateV1
	Document         blueprint.Document
	PackageOverrides deploy.PackageOverrideIntentV1
	BaseImage        string
	Request          providers.ResolvedRequestV1
}

func LoadBuildRequestV1 

func LoadBuildRequestV1(
	operation *deploy.OperationLock,
	sources []providers.ResolvedSourceInput,
) (LoadedBuildRequestV1, error)

LoadBuildRequestV1 derives the canonical provider request from the desired inputs stored under an already-held deployment operation lock. Source manifests are explicit inputs because observing local source content is a separate build phase; this function performs no Docker or provider work.

func LoadBuildRequestWithPackageOverridesV1 

func LoadBuildRequestWithPackageOverridesV1(
	operation *deploy.OperationLock,
	packageOverrides deploy.PackageOverrideIntentV1,
	baseImage string,
	sources []providers.ResolvedSourceInput,
) (LoadedBuildRequestV1, error)

type LoadedPackDesiredStateStageInputV1 

type LoadedPackDesiredStateStageInputV1 struct {
	DeploymentDir      string
	Blueprint          deploy.LoadedBlueprint
	ExplicitPlatform   string
	Create             bool
	Force              bool
	RunOptions         RunOptions
	SkipControlSurface bool
}

type LockedProviderBuildExecutionInputV1 

type LockedProviderBuildExecutionInputV1 struct {
	Preparation    LockedProviderBuildPreparationV1
	SourceWheels   []providerstore.ArtifactDescriptor
	LocalOverrides []PythonLocalOverrideV1
	// DesiredPortableToolPlan is the selected application-scoped portable
	// plan for this graph. A nil value means that no runtime portable tools are
	// selected and prevents an older build lock from supplying bindings.
	DesiredPortableToolPlan *providers.PortableToolPlanV1
	ValidateChoices         bool
	RunValidation           FullImageValidationRunner
	Progress                io.Writer
	BuildProgress           buildprogress.Reporter
	RunOptions              RunOptions
	// contains filtered or unexported fields
}

type LockedProviderBuildExecutionResultV1 

type LockedProviderBuildExecutionResultV1 struct {
	State               deploy.StateV1
	Lock                deploy.BuildLockV1
	Reused              bool
	Republished         bool
	Validated           bool
	VerificationFailure string
	Warnings            []string
}

func ExecuteLockedProviderBuildV1 

func ExecuteLockedProviderBuildV1(
	ctx context.Context,
	input LockedProviderBuildExecutionInputV1,
) (LockedProviderBuildExecutionResultV1, error)

ExecuteLockedProviderBuildV1 consumes a preparation made under the same held operation lock. It either returns the exact reused generation without backend work or executes the provider graph, plans complete validation, and publishes the resulting generation. Local-source observation occurs during fresh graph preparation after package selection; lock acquisition belongs to the caller.

func RunLockedProviderBuildV1 

func RunLockedProviderBuildV1(
	ctx context.Context,
	input LockedProviderBuildRunInputV1,
) (LockedProviderBuildExecutionResultV1, error)

RunLockedProviderBuildV1 runs the canonical provider build while retaining ownership of a caller-held deployment lock. This lets install keep the same source lock held through a later transfer without recursively acquiring it.

func RunProviderBuildV1 

func RunProviderBuildV1(
	ctx context.Context,
	input ProviderBuildRunInputV1,
) (LockedProviderBuildExecutionResultV1, error)

RunProviderBuildV1 owns one complete deployment-locked provider build from reuse selection through provider execution, validation, and publication.

type LockedProviderBuildPreparationInputV1 

type LockedProviderBuildPreparationInputV1 struct {
	Operation          *deploy.OperationLock
	Store              providerstore.Store
	Environment        string
	DeploymentDir      string
	PackageOverrides   deploy.PackageOverrideIntentV1
	BaseImage          string
	Sources            []providers.ResolvedSourceInput
	LocalOverrides     []PythonLocalOverrideV1
	ReployVersion      string
	DockerPlan         DockerExecutionPlan
	NoCache            bool
	Progress           io.Writer
	ValidatedCandidate *ValidatedBuildCandidateV1
	ValidatedInputs    ValidatedBuildInputsV1
}

type LockedProviderBuildPreparationV1 

type LockedProviderBuildPreparationV1 struct {
	Operation        *deploy.OperationLock
	Store            providerstore.Store
	Environment      string
	DeploymentDir    string
	DockerPlan       DockerExecutionPlan
	BlueprintDigest  canonical.Digest
	ReployVersion    string
	Loaded           LoadedBuildRequestV1
	SelectedBase     SelectedProviderBase
	PreparedBase     *PreparedProviderBase
	FinalImageConfig providers.ImageConfigPolicy
	ApplicationTools *ApplicationPortableToolPlanV1
	StartupVerifier  deploy.ApplicationStartupVerifierV1
	// Current is the verified previously published generation, including when
	// it is stale. ReusableLock is the only cache input for later provider work
	// and is nil under NoCache. PublicationLock is the lock bound to the desired
	// staged blueprint when an otherwise exact current or validated build is
	// reused.
	Current            *CurrentBuild
	ReusableLock       *deploy.BuildLockV1
	PublicationLock    *deploy.BuildLockV1
	ValidatedCandidate *ValidatedBuildCandidateV1
	ValidatedInputs    ValidatedBuildInputsV1
	NoCache            bool
	ReusedCandidate    bool
	Recovered          bool
	Reused             bool
}

func PrepareLockedProviderBuildV1 

func PrepareLockedProviderBuildV1(
	ctx context.Context,
	input LockedProviderBuildPreparationInputV1,
) (LockedProviderBuildPreparationV1, error)

PrepareLockedProviderBuildV1 performs the read/recovery and reuse boundary under a caller-held deployment lock. Exact reuse first checks the current local base selection and avoids registry resolution when it still matches. A stale or absent build realizes base outputs but does not start a provider resolver or construct a provider layer.

type LockedProviderBuildRunInputV1 

type LockedProviderBuildRunInputV1 struct {
	Operation       *deploy.OperationLock
	Store           providerstore.Store
	DeploymentDir   string
	Runtime         StagedProviderBuildRuntimeV1
	Automatic       bool
	NoCache         bool
	Verify          bool
	ValidateChoices bool
	Progress        io.Writer
	BuildProgress   buildprogress.Reporter
	RunOptions      RunOptions
}

type MaterializationBuildPlan 

type MaterializationBuildPlan struct {
	BaseReference   string
	OutputReference string
	Platform        blueprint.Platform
	DockerfilePath  string
	ContextDir      string
	IIDFile         string
	NoCache         bool
	// contains filtered or unexported fields
}

type MaterializationEvidenceInput 

type MaterializationEvidenceInput struct {
	Candidate   InspectedMaterializationLayerCandidate
	Transaction providers.MaterializationTransaction
	Bundle      providers.ResolvedBundle
}

MaterializationEvidenceInput gives the validation runner the exact inspected image and the closed transaction and bundle that produced it.

type MaterializationEvidenceRunner 

type MaterializationEvidenceRunner func(
	context.Context,
	MaterializationEvidenceInput,
) ([]providers.RealizedGeneratedExecutable, []providers.RealizedOutput, error)

type MaterializationLayerCandidate 

type MaterializationLayerCandidate struct {
	Built             BuiltImageCandidate
	AssemblyKey       providers.AssemblyKeyV1
	AssemblyKeyDigest canonical.Digest
}

MaterializationLayerCandidate binds the predicted assembly identity to an uninspected Docker result. It is not validated or publishable state.

func BuildMaterializationLayer 

func BuildMaterializationLayer(store providerstore.Store, request MaterializationLayerRequest, options RunOptions) (result MaterializationLayerCandidate, resultErr error)

type MaterializationLayerRequest 

type MaterializationLayerRequest struct {
	Transaction providers.MaterializationTransaction
	MountInputs []MaterializationMountInput
	Platform    blueprint.Platform
}

type MaterializationMountFile 

type MaterializationMountFile struct {
	RelativePath string
	Artifact     providerstore.ArtifactDescriptor
	// contains filtered or unexported fields
}

type MaterializationMountInput 

type MaterializationMountInput struct {
	ID           string
	SourceDigest canonical.Digest
	Files        []MaterializationMountFile
}

func MaterializationMountInputs 

func MaterializationMountInputs(bundle providers.ResolvedBundle, transaction providers.MaterializationTransaction) ([]MaterializationMountInput, error)

MaterializationMountInputs maps a previously validated resolved bundle to the immutable files referenced by a closed materialization transaction. The returned records contain logical paths and descriptors only; store paths are resolved later by PrepareMaterializationContext.

type MaterializationMountSource 

type MaterializationMountSource struct {
	ID          string
	ContextPath string
}

type MountExecutionPlan 

type MountExecutionPlan struct {
	Name       string
	Mode       blueprint.MountMode
	Source     string
	SourceKind string
	Target     string
	ReadOnly   bool
	Update     blueprint.UpdatePolicy
}

type OverrideDiscoveredPackageV1 

type OverrideDiscoveredPackageV1 struct {
	Provider string
	Package  string
}

type OwnedImageReferenceV1 

type OwnedImageReferenceV1 = deploy.OwnedImageReferenceV1

OwnedImageReferenceV1 is an exact pair retained by a generation owner or its pending cleanup inventory. Its presence is not proof of build acceptance.

func ProjectEnvironmentOwnedReferencesV1 

func ProjectEnvironmentOwnedReferencesV1(
	generation deploy.EnvironmentGenerationState,
	lock deploy.BuildLockV1,
	environment, deploymentDir string,
) ([]OwnedImageReferenceV1, error)

ProjectEnvironmentOwnedReferencesV1 returns the primary pair first, followed by the optional portable companion. The accepted lock is the only source of portable image identity; no Docker access or persisted-state change occurs.

type PackDesiredStateStageInputV1 

type PackDesiredStateStageInputV1 struct {
	DeploymentDir      string
	Pack               deploy.PackRef
	ExplicitPlatform   string
	Create             bool
	SkipControlSurface bool
}

type PackDesiredStateStageResultV1 

type PackDesiredStateStageResultV1 struct {
	AppID        string
	DesiredState deploy.DesiredStateUpdateResult
}

func StageLoadedPackDesiredStateV1 

func StageLoadedPackDesiredStateV1(ctx context.Context, input LoadedPackDesiredStateStageInputV1) (PackDesiredStateStageResultV1, error)

StageLoadedPackDesiredStateV1 stages a pack that the caller has already resolved, avoiding a second remote blueprint fetch at command boundaries.

func StagePackDesiredStateV1 

func StagePackDesiredStateV1(ctx context.Context, input PackDesiredStateStageInputV1) (PackDesiredStateStageResultV1, error)

StagePackDesiredStateV1 resolves one blueprint reference, records the deployment's desired state, and materializes the user-facing staged control surface. It does not prepare providers or an image.

type PathUpdateAction 

type PathUpdateAction struct {
	Name   string
	Kind   PathUpdateActionKind
	Source string
	Target string
}

func PlanPathUpdates 

func PlanPathUpdates(staging DockerExecutionPlan, installed DockerExecutionPlan, installTarget string, options PathUpdateOptions) ([]PathUpdateAction, error)

type PathUpdateActionKind 

type PathUpdateActionKind string
const (
	PathPreserveManagedBind PathUpdateActionKind = "preserve-managed-bind"
	PathReplaceManagedBind  PathUpdateActionKind = "replace-managed-bind"
	PathPreserveVolume      PathUpdateActionKind = "preserve-volume"
	PathReplaceVolume       PathUpdateActionKind = "replace-volume"
	PathPreservePrivateEnv  PathUpdateActionKind = "preserve-private-environment"
	PathReplacePrivateEnv   PathUpdateActionKind = "replace-private-environment"
	PathValidateUnmanaged   PathUpdateActionKind = "validate-unmanaged"
	PathTmpfsNoop           PathUpdateActionKind = "tmpfs-noop"
)

type PathUpdateOptions 

type PathUpdateOptions struct {
	ReplaceAll bool
	Clean      bool
	Replace    []string
}

type PendingPublicationRecovery 

type PendingPublicationRecovery struct {
	Pending         deploy.PendingBuildV1
	Decision        deploy.PendingRecoveryDecision
	SelectedLock    *deploy.BuildLockV1
	SelectedDigest  canonical.Digest
	OldImage        *providers.RealizedImageV1
	ObservedCurrent *deploy.EnvironmentGenerationState
}

func PreparePendingPublicationRecovery 

func PreparePendingPublicationRecovery(
	current *deploy.EnvironmentGenerationState,
	pending deploy.PendingBuildV1,
	store providerstore.Store,
	environment string,
	deploymentDir string,
	validateProfileOwner providers.RequirementProfileOwnerValidator,
	validateBundleOwner providers.ResolvedBundleOwnerValidator,
	load deploy.PendingBuildLockLoader,
) (PendingPublicationRecovery, error)

type PlanApplicationPortableToolsInputV1 

type PlanApplicationPortableToolsInputV1 struct {
	Document         blueprint.Document
	Components       []providers.ResolvedComponentRequestV1
	Platform         blueprint.Platform
	Store            providerstore.Store
	Base             deploy.ImageDescriptor
	FinalImageConfig providers.ImageConfigPolicy
	ReployVersion    string
}

type PlanSourceBuilderPortableToolsInputV1 

type PlanSourceBuilderPortableToolsInputV1 struct {
	Store           providerstore.Store
	Base            deploy.ImageDescriptor
	ProviderPlan    providers.ProviderPlanV1
	SelectedRecipes []SourceBuilderSelectedRecipeV1
	BlueprintDigest canonical.Digest
	ReployVersion   string
}

PlanSourceBuilderPortableToolsInputV1 carries the exact inputs one build supplies to source-builder portable-tool planning: the selected base image, the provider plan that owns the builder domains, selected immutable recipe data, and the blueprint and client identities sealed into the resolution snapshot.

type PortOverride 

type PortOverride struct {
	Name     string
	HostPort string
}

type PortableRuntimePayloadImageV1 

type PortableRuntimePayloadImageV1 struct {
	Image InspectedImageCandidate
	// contains filtered or unexported fields
}

PortableRuntimePayloadImageV1 is a disposable, inspected payload layer. It is not browser-support evidence: native dependencies and non-root launch remain mandatory downstream checks.

func PreparePortableRuntimePayloadLayerV1 

func PreparePortableRuntimePayloadLayerV1(
	ctx context.Context, store providerstore.Store, payloads *PortableRuntimePayloadsV1,
	upstream deploy.ImageDescriptor, options RunOptions,
) (*PortableRuntimePayloadImageV1, error)

PreparePortableRuntimePayloadLayerV1 checks upstream destinations before ADD, builds only from verified offline staging, and compares the exact selected destination inventory in the resulting image with staged entries. It returns no capability or support evidence.

func (*PortableRuntimePayloadImageV1) Cleanup 

func (image *PortableRuntimePayloadImageV1) Cleanup(ctx context.Context) error

type PortableRuntimePayloadsV1 

type PortableRuntimePayloadsV1 struct {
	Lock        providers.PortableToolLockV1
	Environment []providers.PortableToolEnvironmentVariableV1
	// contains filtered or unexported fields
}

PortableRuntimePayloadsV1 is an offline, disposable build context. Nothing in it is accepted as browser support until the native-package and launch checks have run on the resulting image.

func MaterializePortableRuntimePayloadsFreshV1 

func MaterializePortableRuntimePayloadsFreshV1(
	ctx context.Context, store providerstore.Store, dag providers.PortableToolProviderDAGV1,
	closures []toolcatalog.SelectedClosureV1, other []providers.PortableToolArtifactAcquisitionInputV1,
) (*PortableRuntimePayloadsV1, error)

MaterializePortableRuntimePayloadsFreshV1 acquires only selected payloads. Other selected artifacts (for example eligible Python wheels) must arrive through their owning provider's verified acquisition handoff. The complete lock is built before any payload is extracted.

func MaterializePortableRuntimePayloadsLockedV1 

func MaterializePortableRuntimePayloadsLockedV1(
	ctx context.Context, store providerstore.Store, lock providers.PortableToolLockV1,
) (result *PortableRuntimePayloadsV1, resultErr error)

MaterializePortableRuntimePayloadsLockedV1 never loads the embedded catalog or opens a network source. Every selected descriptor is reopened and hashed before extraction, and the archive primitive hashes it again at use.

func (*PortableRuntimePayloadsV1) Cleanup 

func (payloads *PortableRuntimePayloadsV1) Cleanup() error

func (*PortableRuntimePayloadsV1) Dockerfile 

func (payloads *PortableRuntimePayloadsV1) Dockerfile() ([]byte, error)

Dockerfile produces only fixed ADD and ENV instructions from the validated lock. The caller must collision-check the upstream image and inspect and validate the result before accepting it.

type PortableToolCaseEvidenceRequestV1 

type PortableToolCaseEvidenceRequestV1 struct {
	Case  toolcatalog.IntegrationCaseV1
	Scope string
}

PortableToolCaseEvidenceRequestV1 selects an exact derived case and its ordinary resolution scope for current-evidence matching.

type PortableToolCaseObservationV1 

type PortableToolCaseObservationV1 struct {
	// contains filtered or unexported fields
}

PortableToolCaseObservationV1 can only be constructed by a successful case lifecycle. Its bytes are owned, immutable and include the original executor output. It is not an authenticated attestation: persisted evidence relies on the project-controlled workflow and provider store.

func ObserveApplicationBuildCaseV1 

func ObserveApplicationBuildCaseV1(
	ctx context.Context, input LockedProviderBuildExecutionInputV1,
	caseV1 toolcatalog.IntegrationCaseV1, scope string,
) (PortableToolCaseObservationV1, error)

ObserveApplicationBuildCaseV1 retains original executor observations only after the ordinary application build, publication and cleanup all succeed.

func ObserveSourceBuilderBuildCaseV1 

func ObserveSourceBuilderBuildCaseV1(
	ctx context.Context, store providerstore.Store, tools *SourceBuilderPortableToolsV1,
	upstream deploy.ImageDescriptor, options RunOptions,
	caseV1 toolcatalog.IntegrationCaseV1, scope string,
) (PortableToolCaseObservationV1, error)

ObserveSourceBuilderBuildCaseV1 uses the ordinary builder case validator, retaining output only after the exact inspected image is removed successfully.

type PortableToolMaterializationValidationInputV1 

type PortableToolMaterializationValidationInputV1 struct {
	Image InspectedImageCandidate
	// contains filtered or unexported fields
}

PortableToolMaterializationValidationInputV1 is an in-process, construction-controlled handoff from a validated lock to one concrete image. It does not infer image placement from the tool or runtime metadata.

func PortableToolApplicationCaseValidationInputFromBuildLockV1 

func PortableToolApplicationCaseValidationInputFromBuildLockV1(
	image InspectedImageCandidate, lock deploy.BuildLockV1,
	closures []toolcatalog.SelectedClosureV1, caseV1 toolcatalog.IntegrationCaseV1, scope string,
) (PortableToolMaterializationValidationInputV1, error)

PortableToolApplicationCaseValidationInputFromBuildLockV1 combines exact final-image authority with the catalog-derived case's selected scope.

func PortableToolApplicationValidationInputFromBuildLockV1 

func PortableToolApplicationValidationInputFromBuildLockV1(
	image InspectedImageCandidate, lock deploy.BuildLockV1, scope string,
) (PortableToolMaterializationValidationInputV1, error)

PortableToolApplicationValidationInputFromBuildLockV1 derives one scoped schedule from the complete validated lock and exact final image. It performs no profile execution and retains no schedule alongside persisted authority.

func PortableToolBuildCaseValidationInputFromLockV1 

func PortableToolBuildCaseValidationInputFromLockV1(
	image InspectedImageCandidate,
	lock providers.PortableToolLockV1,
	closures []toolcatalog.SelectedClosureV1,
	caseV1 toolcatalog.IntegrationCaseV1,
	scope string,
) (PortableToolMaterializationValidationInputV1, error)

PortableToolBuildCaseValidationInputFromLockV1 binds one catalog-derived build case to the exact resolution scope in the materialized lock. The caller owns the scope: neither tool identity nor runtime metadata chooses which image or lock entries belong to the case.

func PortableToolMaterializationValidationInputFromLockV1 

func PortableToolMaterializationValidationInputFromLockV1(
	image InspectedImageCandidate,
	lock providers.PortableToolLockV1,
) (PortableToolMaterializationValidationInputV1, error)

type PortableToolProbeEvidenceV1 

type PortableToolProbeEvidenceV1 struct {
	Schema            string                                `json:"schema"`
	ExecutorVersion   string                                `json:"executor_version"`
	Profile           toolcatalog.RecordReferenceV1         `json:"profile"`
	ProfileDefinition toolcatalog.ValidationProfileRecordV1 `json:"profile_definition"`
	SubjectRootFS     canonical.Digest                      `json:"subject_rootfs"`
	Platform          blueprint.Platform                    `json:"platform"`
	Policy            PortableToolProbePolicyV1             `json:"policy"`
	Results           []PortableToolProbeResultV1           `json:"results"`
}

func RunPortableToolValidationProfile 

func RunPortableToolValidationProfile(
	ctx context.Context,
	descriptor deploy.ImageDescriptor,
	workspace PreparedProbeWorkspace,
	profile toolcatalog.ValidationProfileRecordV1,
	runtime *providers.PortableToolRuntimeProjectionV1,
) (PortableToolProbeEvidenceV1, error)

RunPortableToolValidationProfile executes every exact profile probe through one fixed Reploy-owned policy. Each probe receives a fresh read-only, networkless container so timeout cleanup cannot leak work into another observation. Process outcomes are evidence; Docker or cleanup failures are infrastructure errors.

type PortableToolProbeOutputV1 

type PortableToolProbeOutputV1 struct {
	Size      string           `json:"size"`
	SHA256    canonical.Digest `json:"sha256"`
	Content   string           `json:"content_base64"`
	Truncated bool             `json:"truncated"`
}

type PortableToolProbePolicyV1 

type PortableToolProbePolicyV1 struct {
	NetworkDisabled  bool   `json:"network_disabled"`
	WorkingDirectory string `json:"working_directory"`
	// Environment is the executor-owned fixed profile. ContractEnvironment is
	// the selected closure's additional runtime projection. They are recorded
	// separately so evidence proves the fixed set was applied unchanged and
	// shows exactly what the contract added on top of it.
	Environment          []toolcatalog.RecordEnvironmentVariableV1 `json:"environment"`
	ContractEnvironment  []toolcatalog.RecordEnvironmentVariableV1 `json:"contract_environment"`
	InstallRoot          string                                    `json:"install_root"`
	TimeoutMillis        string                                    `json:"timeout_milliseconds"`
	CleanupTimeoutMillis string                                    `json:"cleanup_timeout_milliseconds"`
	OutputLimitBytes     string                                    `json:"output_limit_bytes"`
	MemoryLimitBytes     string                                    `json:"memory_limit_bytes"`
	TemporaryBytes       string                                    `json:"temporary_bytes"`
	PIDLimit             string                                    `json:"pid_limit"`
	CPULimitMillis       string                                    `json:"cpu_limit_millis"`
	OpenFilesLimit       string                                    `json:"open_files_limit"`
}

type PortableToolProbeResultV1 

type PortableToolProbeResultV1 struct {
	Probe    toolcatalog.RecordProbeV1 `json:"probe"`
	Outcome  string                    `json:"outcome"`
	ExitCode *string                   `json:"exit_code"`
	Stdout   PortableToolProbeOutputV1 `json:"stdout"`
	Stderr   PortableToolProbeOutputV1 `json:"stderr"`
}

type PortableToolPythonFreshPlanV1 

type PortableToolPythonFreshPlanV1 struct {
	Plan     providers.PortableToolPlanV1
	Closures []toolcatalog.SelectedClosureV1
	// contains filtered or unexported fields
}

PortableToolPythonFreshPlanV1 is the complete selected input needed to acquire application-scoped Python binding wheels during fresh resolution. Selection and provider projection happen before graph execution; this value keeps the selected plan and catalog closures together until the owning Python node has observed an eligible interpreter.

type PortableToolPythonLockedPlanV1 

type PortableToolPythonLockedPlanV1 struct {
	// contains filtered or unexported fields
}

PortableToolPythonLockedPlanV1 owns a validated snapshot of the persisted lock and its derived Python selection. Neither the plan nor its projection is retained as an independently mutable authority.

type PreparedAPTNodeConfig 

type PreparedAPTNodeConfig struct {
	ReusableDebs   []providerstore.ArtifactDescriptor
	ExclusiveRoots []string
}

type PreparedAPTNodeOperations 

type PreparedAPTNodeOperations struct {
	Store            providerstore.Store
	Validators       providers.ProviderOwnerValidators
	FinalImageConfig providers.ImageConfigPolicy
	ReusableDebs     []providerstore.ArtifactDescriptor
	ExclusiveRoots   []string
	RunOptions       RunOptions
}

PreparedAPTNodeOperations connects the shared APT resolver session to the provider graph while keeping all scratch and artifacts deployment-local.

func (PreparedAPTNodeOperations) Prepare 

func (operations PreparedAPTNodeOperations) Prepare(
	ctx context.Context,
	descriptor deploy.ImageDescriptor,
	probeWorkspace PreparedProbeWorkspace,
	request providers.GraphNodePrepareRequest,
) (result providers.GraphNodePreparation, resultErr error)

Prepare creates and removes one deployment-local resolver workspace around the one-session cache-validation/fresh-resolution lifecycle.

type PreparedAPTResolverWorkspace 

type PreparedAPTResolverWorkspace struct {
	HostDir        string
	ContainerDir   string
	SeededArchives []providerstore.ArtifactDescriptor
}

PreparedAPTResolverWorkspace is one initially empty, deployment-local resolver scratch directory. It is removed after the containing operation.

func PrepareAPTResolverWorkspace 

func PrepareAPTResolverWorkspace(store providerstore.Store) (PreparedAPTResolverWorkspace, func(), error)

func SeedAPTResolverArchives 

func SeedAPTResolverArchives(
	ctx context.Context,
	store providerstore.Store,
	prepared PreparedAPTResolverWorkspace,
	reusable []providerstore.ArtifactDescriptor,
) (PreparedAPTResolverWorkspace, error)

SeedAPTResolverArchives copies verified deployment-store .deb objects into the disposable archive cache. Copies deliberately do not share inodes with immutable store blobs that APT may unlink or otherwise mutate as root.

type PreparedMaterializationContext 

type PreparedMaterializationContext struct {
	Dir     string
	Sources []MaterializationMountSource
}

func PrepareMaterializationContext 

func PrepareMaterializationContext(store providerstore.Store, transaction providers.MaterializationTransaction, inputs []MaterializationMountInput) (PreparedMaterializationContext, func(), error)

type PreparedProbeWorkspace 

type PreparedProbeWorkspace struct {
	HostDir             string
	HostExecutable      string
	ContainerDir        string
	ContainerExecutable string
	ReadOnly            bool
	Platform            blueprint.Platform
	SHA256              canonical.Digest
}

func PrepareProbeWorkspace 

func PrepareProbeWorkspace(ctx context.Context, store providerstore.Store, platform blueprint.Platform) (PreparedProbeWorkspace, func() error, error)

PrepareProbeWorkspace extracts one platform helper beneath the deployment's private provider store. The returned directory is the complete read-only bind-mount source and must be removed with cleanup after the container exits.

type PreparedProviderBase 

type PreparedProviderBase struct {
	Plan       providers.ProviderPlanV1
	Descriptor deploy.ImageDescriptor
	Config     deploy.BaseConfig
	Image      providers.RealizedImageV1
	Catalog    []providers.RealizedOutput
}

func PrepareProviderBase 

func PrepareProviderBase(
	ctx context.Context,
	store providerstore.Store,
	request providers.ResolvedRequestV1,
) (PreparedProviderBase, error)

PrepareProviderBase plans a validated resolved request, resolves its exact platform base, and creates the initial image/catalog inputs for graph execution. It performs no provider-node resolution or materialization.

func RealizeSelectedProviderBase 

func RealizeSelectedProviderBase(
	ctx context.Context,
	store providerstore.Store,
	selected SelectedProviderBase,
) (PreparedProviderBase, error)

RealizeSelectedProviderBase validates declared base outputs and produces the graph's initial image and catalog after a caller has ruled out exact reuse.

type PreparedPythonGraphBackend 

type PreparedPythonGraphBackend struct {
	BaseDescriptor deploy.ImageDescriptor
	Workspace      PreparedProbeWorkspace
	Operations     map[providers.NodeID]PreparedPythonNodeOperations
	APTOperations  map[providers.NodeID]PreparedAPTNodeOperations
	Materializer   ProviderGraphMaterializer
}

func PreparePreparedPythonGraphBackend 

func PreparePreparedPythonGraphBackend(
	ctx context.Context,
	store providerstore.Store,
	plan providers.ProviderPlanV1,
	baseDescriptor deploy.ImageDescriptor,
	finalImageConfig providers.ImageConfigPolicy,
	pythonConfigs map[providers.NodeID]PreparedPythonNodeConfig,
	aptConfigs map[providers.NodeID]PreparedAPTNodeConfig,
	options RunOptions,
) (PreparedPythonGraphBackend, func() error, error)

PreparePreparedPythonGraphBackend assembles the deployment-scoped provider graph backend and extracts one platform probe helper beneath the same deployment-owned provider store. The returned cleanup removes all scratch workspaces.

func (PreparedPythonGraphBackend) MaterializeNode 

func (backend PreparedPythonGraphBackend) MaterializeNode(
	ctx context.Context,
	request providers.GraphNodeMaterializeRequest,
) (providers.GraphNodeMaterializeResult, error)

MaterializeNode is the graph materialization callback paired with PrepareNode. Only explicitly configured provider nodes can reach Docker.

func (PreparedPythonGraphBackend) PrepareNode 

func (backend PreparedPythonGraphBackend) PrepareNode(
	ctx context.Context,
	request providers.GraphNodePrepareRequest,
) (providers.GraphNodePreparation, error)

PrepareNode is the graph preparation callback for the prepared provider path. Every supported node must have an explicit provider-specific operation.

type PreparedPythonGraphExecutionInput 

type PreparedPythonGraphExecutionInput struct {
	Store          providerstore.Store
	Plan           providers.ProviderPlanV1
	BaseDescriptor deploy.ImageDescriptor
	BaseCatalog    []providers.RealizedOutput
	Sources        []providers.ResolvedSourceInput
	SourceWheels   []providerstore.ArtifactDescriptor
	LocalOverrides []PythonLocalOverrideV1
	PortablePython *PortableToolPythonFreshPlanV1
	// DesiredPortableToolPlan identifies the application-scoped portable
	// selections for this graph. A nil value means that the graph has no
	// current runtime portable-tool selection; an old lock must not supply one.
	DesiredPortableToolPlan *providers.PortableToolPlanV1
	SourceBuilder           *SourceBuilderCoordinatorV1
	CurrentLock             *deploy.BuildLockV1
	FinalImageConfig        providers.ImageConfigPolicy
	Progress                io.Writer
	BuildProgress           buildprogress.Reporter
	RunOptions              RunOptions
	// contains filtered or unexported fields
}

PreparedPythonGraphExecutionInput contains the complete temporary Python graph path until APT joins the same registry-backed executor.

type PreparedPythonGraphReuse 

type PreparedPythonGraphReuse struct {
	ReusableArtifacts map[providers.NodeID][]providerstore.StoreObjectRef
	CachedResolutions map[providers.NodeID]providers.ResolveResult
	NodeConfigs       map[providers.NodeID]PreparedPythonNodeConfig
	APTNodeConfigs    map[providers.NodeID]PreparedAPTNodeConfig
}

PreparedPythonGraphReuse contains only provider content reachable from the current deployment lock. The maps plug directly into GraphExecutionRequest and the per-node configs used by PreparePreparedPythonGraphBackend.

func LoadPreparedPythonGraphReuse 

func LoadPreparedPythonGraphReuse(
	store providerstore.Store,
	plan providers.ProviderPlanV1,
	platform blueprint.Platform,
	sources []providers.ResolvedSourceInput,
	sourceWheels []providerstore.ArtifactDescriptor,
	current *deploy.BuildLockV1,
) (PreparedPythonGraphReuse, error)

LoadPreparedPythonGraphReuse derives APT and Python cache candidates from one current build lock. It never scans older locks or unreferenced store blobs.

type PreparedPythonNodeConfig 

type PreparedPythonNodeConfig struct {
	ReusableWheels         []providerstore.ArtifactDescriptor
	LocalOverrides         []PythonLocalOverrideV1
	PortableToolBindings   *pythonprovider.PortableToolPythonComponentV1
	PortableToolFreshPlan  *PortableToolPythonFreshPlanV1
	PortableToolLockedPlan *PortableToolPythonLockedPlanV1
	SourceBuilder          *SourceBuilderCoordinatorV1
	// contains filtered or unexported fields
}

type PreparedPythonNodeOperations 

type PreparedPythonNodeOperations struct {
	Store                  providerstore.Store
	Validators             providers.ProviderOwnerValidators
	FinalImageConfig       providers.ImageConfigPolicy
	Artifacts              PreparedPythonResolverArtifacts
	ReusableWheels         []providerstore.ArtifactDescriptor
	LocalOverrides         []PythonLocalOverrideV1
	PortableToolBindings   *pythonprovider.PortableToolPythonComponentV1
	PortableToolFreshPlan  *PortableToolPythonFreshPlanV1
	PortableToolLockedPlan *PortableToolPythonLockedPlanV1
	SourceBuilder          *SourceBuilderCoordinatorV1
	Progress               io.Writer
	ShowApplicationContext bool
	RunOptions             RunOptions
	// contains filtered or unexported fields
}

PreparedPythonNodeOperations connects one-session wheel resolution to the typed provider graph and deployment-owned store.

func (PreparedPythonNodeOperations) Preparer 

func (operations PreparedPythonNodeOperations) Preparer(
	descriptor deploy.ImageDescriptor,
	workspace PreparedProbeWorkspace,
) PythonNodePreparer

type PreparedPythonResolverArtifacts 

type PreparedPythonResolverArtifacts struct {
	HostDir            string
	InputHostDir       string
	OutputHostDir      string
	InputContainerDir  string
	OutputContainerDir string
}

PreparedPythonResolverArtifacts separates immutable reusable wheels from the initially empty writable output of one disposable resolver.

func PreparePythonResolverArtifacts 

func PreparePythonResolverArtifacts(
	store providerstore.Store,
	reusable []providerstore.ArtifactDescriptor,
) (PreparedPythonResolverArtifacts, func(), error)

PreparePythonResolverArtifacts exposes verified store wheels as hardlinks in a read-only flat find-links directory. Resolver output is a separate, initially empty directory beneath the same deployment-owned store.

type PreparedPythonSourceDistribution 

type PreparedPythonSourceDistribution struct {
	Distribution           string
	Version                string
	ArchiveRoot            string
	HostDir                string
	ContainerDir           string
	SourceInputDigest      canonical.Digest
	BuildEnvironmentDigest canonical.Digest
	BuilderProfile         string
	BuildSettings          providers.CanonicalProviderData
	Artifact               providerstore.ArtifactDescriptor
}

func PublishBuiltPythonSourceDistributions 

func PublishBuiltPythonSourceDistributions(
	ctx context.Context,
	store providerstore.Store,
	prepared PreparedPythonResolverArtifacts,
	snapshots []PreparedPythonSourceSnapshot,
	buildEnvironmentDigest canonical.Digest,
) (distributions []PreparedPythonSourceDistribution, err error)

PublishBuiltPythonSourceDistributions validates and retains the exact sdists before replacing source projections with securely extracted closed inputs.

func PublishBuiltPythonSourceDistributionsWithIdentities 

func PublishBuiltPythonSourceDistributionsWithIdentities(
	ctx context.Context,
	store providerstore.Store,
	prepared PreparedPythonResolverArtifacts,
	snapshots []PreparedPythonSourceSnapshot,
	identities map[string]PythonSourceBuildIdentityV1,
) (distributions []PreparedPythonSourceDistribution, err error)

PublishBuiltPythonSourceDistributionsWithIdentities retains each selected source's recipe-owned build protocol and exact builder environment.

type PreparedPythonSourceSnapshot 

type PreparedPythonSourceSnapshot struct {
	Distribution      string
	HostDir           string
	ContainerDir      string
	SourceInputDigest canonical.Digest
}

func StagePythonLocalSourceSnapshots 

func StagePythonLocalSourceSnapshots(
	prepared PreparedPythonResolverArtifacts,
	sources []PythonLocalSource,
) (snapshots []PreparedPythonSourceSnapshot, err error)

StagePythonLocalSourceSnapshots copies exactly the entries covered by each recorded manifest into the resolver's existing read-only input mount. The live checkout is never mounted into the resolver container.

type ProbeExecutableBinding 

type ProbeExecutableBinding struct {
	Requirement *providers.ExecutableRequirement
	Output      providers.QualifiedOutput
	Facts       providers.CanonicalProviderData
}

ProbeExecutableBinding supplies the policy-owned fields that the low-level filesystem probe cannot determine. A nil Requirement creates evidence for a final exposed output; a non-nil requirement creates consumer-selection evidence.

type ProviderBuildCompletionInput 

type ProviderBuildCompletionInput struct {
	Environment          string
	DeploymentDir        string
	Document             blueprint.Document
	DockerPlan           DockerExecutionPlan
	ResolvedRequest      providers.ResolvedRequestV1
	Overlay              deploy.RequestOverlayV1
	PackageOverrides     deploy.PackageOverrideIntentV1
	BaseImage            string
	Base                 deploy.ImageDescriptor
	BaseCatalog          []providers.RealizedOutput
	Graph                providers.GraphExecutionResult
	PortableTools        *providers.PortableToolLockV1
	ApplicationTools     *ApplicationPortableToolPlanV1
	PortableRuntimeLayer *deploy.PortableRuntimeLayerV1
	Validation           ProviderGraphValidationPlan
	StartupVerifier      deploy.ApplicationStartupVerifierV1
	RunValidation        FullImageValidationRunner
	RunOptions           RunOptions
	ValidateChoices      bool
	ValidatedInputs      ValidatedBuildInputsV1
	NoCache              bool
	// contains filtered or unexported fields
}

type ProviderBuildCompletionResult 

type ProviderBuildCompletionResult struct {
	State          deploy.StateV1
	Lock           deploy.BuildLockV1
	Validated      bool
	ValidatedBuild deploy.ValidatedBuildV1
}

func CompleteProviderBuild 

func CompleteProviderBuild(
	ctx context.Context,
	operation *deploy.OperationLock,
	store providerstore.Store,
	input ProviderBuildCompletionInput,
) (ProviderBuildCompletionResult, error)

CompleteProviderBuild is the canonical completion path from a materialized provider graph to current deployment state. It finalizes validation first, assembles the complete immutable lock second, and enters recoverable publication last.

type ProviderBuildRunInputV1 

type ProviderBuildRunInputV1 struct {
	DeploymentDir   string
	Runtime         StagedProviderBuildRuntimeV1
	Automatic       bool
	NoCache         bool
	Verify          bool
	ValidateChoices bool
	Progress        io.Writer
	BuildProgress   buildprogress.Reporter
	RunOptions      RunOptions
}

type ProviderFullImageValidationRunner 

type ProviderFullImageValidationRunner struct {
	Store providerstore.Store
}

func (ProviderFullImageValidationRunner) Run 

func (runner ProviderFullImageValidationRunner) Run(
	ctx context.Context,
	input FullImageValidationInput,
) (profiles []providers.ValidationEvidence, outputs []providers.ExecutableEvidence, resultErr error)

Run performs one complete image validation in one held networkless container. Provider scratch and the embedded probe workspace are deployment-local. They are removed after confirmed container cleanup or retained for the next operation's abandoned-helper recovery.

type ProviderGraphMaterializer 

type ProviderGraphMaterializer struct {
	Store       providerstore.Store
	Platform    blueprint.Platform
	RunEvidence MaterializationEvidenceRunner
	RetainLayer materializationCandidateRetainer
	RunOptions  RunOptions
	// contains filtered or unexported fields
}

func (ProviderGraphMaterializer) Materialize 

func (materializer ProviderGraphMaterializer) Materialize(
	ctx context.Context,
	request providers.GraphNodeMaterializeRequest,
) (providers.GraphNodeMaterializeResult, error)

Materialize is the graph callback for the typed Docker backend. Provider registry materialization is followed by the sole build-and-accept pipeline; an unvalidated image candidate is never returned to the graph.

type ProviderGraphValidationPlan 

type ProviderGraphValidationPlan struct {
	Layers []FullImageValidationInput
	Final  FullImageValidationInput
}

func PrepareProviderGraphValidation 

func PrepareProviderGraphValidation(
	ctx context.Context,
	base deploy.ImageDescriptor,
	baseCatalog []providers.RealizedOutput,
	graph providers.GraphExecutionResult,
	policy deploy.RuntimePolicyV1,
) (ProviderGraphValidationPlan, error)

PrepareProviderGraphValidation converts a completed provider graph into the cumulative immutable-image checks used by final validation. Every component prefix is re-inspected by config ID; graph records alone are not accepted as proof that a validation target still exists unchanged.

type ProviderInstallInputV1 

type ProviderInstallInputV1 struct {
	SourceDeploymentDir      string
	DestinationDeploymentDir string
	Runtime                  StagedProviderBuildRuntimeV1
	ControlMode              ControlAdmissionModeV1
	Scope                    InstallScope
	Service                  string
	PortOverrides            []PortOverride
	Replace                  []string
	Clean                    bool
	Start                    bool
	RunOptions               RunOptions
	// contains filtered or unexported fields
}

type ProviderInstallResultV1 

type ProviderInstallResultV1 struct {
	State         deploy.StateV1
	Environment   string
	TargetDir     string
	ControlScript string
	Service       string
	Updated       bool
	ImageReused   bool
	Started       bool
	PathUpdates   []PathUpdateAction
	Warnings      []string
}

ProviderInstallResultV1 describes what a completed install actually did. It is derived from the locked install plan and prior destination state.

func DirectInstallProviderResultV1 

func DirectInstallProviderResultV1(options DirectInstallOptions) (ProviderInstallResultV1, error)

DirectInstallProviderResultV1 resolves, builds, and installs a blueprint and returns the facts needed for user-facing completion output.

func InstallProviderResultV1 

func InstallProviderResultV1(options InstallOptions) (ProviderInstallResultV1, error)

InstallProviderResultV1 installs a staged deployment and returns the facts needed for user-facing completion output.

func RunProviderInstallResultV1 

func RunProviderInstallResultV1(ctx context.Context, input ProviderInstallInputV1) (ProviderInstallResultV1, error)

RunProviderInstallResultV1 installs one staged deployment and returns the facts needed to present the completed operation.

type ProviderMaterializationEvidenceRunner 

type ProviderMaterializationEvidenceRunner struct {
	Store providerstore.Store
}

func (ProviderMaterializationEvidenceRunner) Run 

func (runner ProviderMaterializationEvidenceRunner) Run(
	ctx context.Context,
	input MaterializationEvidenceInput,
) ([]providers.RealizedGeneratedExecutable, []providers.RealizedOutput, error)

Run validates all generated and public executables from one completed layer in a single image-validation container and returns only observed evidence.

type ProviderStoreCleanResultV1 

type ProviderStoreCleanResultV1 struct {
	Path      string
	Removed   bool
	Recovered bool
}

func CleanProviderStoreV1 

func CleanProviderStoreV1(ctx context.Context, deploymentDir string) (ProviderStoreCleanResultV1, error)

CleanProviderStoreV1 removes only the selected deployment's provider cache. The committed generation, its build lock, and its Docker reference remain current and runtime-usable. Recovery runs first under the same operation lock so clean cannot race an interrupted publication or install transfer.

type ProviderUninstallInputV1 

type ProviderUninstallInputV1 struct {
	DeploymentDir string
	Runtime       StagedProviderBuildRuntimeV1
	ControlMode   ControlAdmissionModeV1
	Service       string
	RemoveDir     bool
	RunOptions    RunOptions
	// contains filtered or unexported fields
}

type ProviderUninstallRecoveryInputV1 

type ProviderUninstallRecoveryInputV1 struct {
	RequestedDir string
	Service      string
	Runtime      StagedProviderBuildRuntimeV1
	ControlMode  ControlAdmissionModeV1
	RemoveDir    bool
	RunOptions   RunOptions
}

type ProviderUninstallResultV1 

type ProviderUninstallResultV1 struct {
	AlreadyAbsent     bool
	DeploymentDir     string
	Environment       string
	Service           string
	RemovedDirectory  bool
	RetainedDirectory bool
}

func UninstallProviderV1 

func UninstallProviderV1(options UninstallOptions) (ProviderUninstallResultV1, error)

UninstallProviderV1 removes an installed state-v1 deployment through the serialized provider runtime path.

type PublishedImageValidation 

type PublishedImageValidation struct {
	Record    deploy.PrefixValidationV1
	Reference providerstore.StoreObjectRef
}

func ValidateAndPublishImage 

func ValidateAndPublishImage(
	ctx context.Context,
	store providerstore.Store,
	input FullImageValidationInput,
	validateProfileOwner providers.RequirementProfileOwnerValidator,
	run FullImageValidationRunner,
) (PublishedImageValidation, error)

type PublishedRuntimeContainerInput 

type PublishedRuntimeContainerInput struct {
	Operation     *deploy.OperationLock
	Store         providerstore.Store
	Environment   string
	DeploymentDir string
	DockerPlan    DockerExecutionPlan
	Invocation    RuntimeInvocationV1
}

type PublishedRuntimeContainerRunnerV1 

type PublishedRuntimeContainerRunnerV1 func(context.Context, CurrentBuild) error

type PublishedRuntimeReadinessInput 

type PublishedRuntimeReadinessInput struct {
	Operation     *deploy.OperationLock
	Store         providerstore.Store
	Environment   string
	DeploymentDir string
	DockerPlan    DockerExecutionPlan
	PlanID        string
	Sources       []RuntimeHostSourceV1
}

type PythonCachedNodeValidator 

type PythonCachedNodeValidator func(
	context.Context,
	*PythonResolverSession,
	providers.ResolveNodeRequest,
	providers.ResolveResult,
) (providers.GraphConsumerValidation, error)

type PythonFreshNodeResolver 

type PythonFreshNodeResolver func(
	context.Context,
	*PythonResolverSession,
	providers.ResolveNodeRequest,
) (providers.ResolveResult, providers.GraphConsumerValidation, error)

type PythonLocalOverrideV1 

type PythonLocalOverrideV1 struct {
	Distribution string
	HostDir      string
	Exclude      []string
}

PythonLocalOverrideV1 is a staging-only physical locator plus its normalized input exclusions. Constructing it never accesses HostDir; source observation is demand-driven after a direct request or resolved package closure identifies a matching distribution.

func PythonLocalOverridesV1 

func PythonLocalOverridesV1(
	overrides deploy.ResolvedPackageOverridesV1,
) ([]PythonLocalOverrideV1, error)

PythonLocalOverridesV1 extracts local Python override locators without inspecting any target path.

type PythonLocalSource 

type PythonLocalSource struct {
	Distribution      string
	HostDir           string
	Manifest          PythonSourceManifestV1
	SourceInputDigest canonical.Digest
}

PythonLocalSource is a staging-only physical locator paired with the path-free provisional source input from which Python packaging defines a retained sdist. HostDir and Manifest never cross into the provider graph or build lock.

func ObserveSelectedPythonLocalSources 

func ObserveSelectedPythonLocalSources(
	overrides []PythonLocalOverrideV1,
	distributions []string,
) ([]PythonLocalSource, error)

ObserveSelectedPythonLocalSources observes only selected normalized distributions. Unselected override paths are never statted or walked.

type PythonLocalSourceRecipeV1 

type PythonLocalSourceRecipeV1 struct {
	Found        bool
	Project      string
	Build        string
	Requirements []toolrequest.CanonicalRequirementGroupV1
	Digest       canonical.Digest
}

PythonLocalSourceRecipeV1 is normalized, path-free build metadata read from an immutable selected local-source snapshot. Found=false means the project did not opt into the recipe contract.

func ReadPythonLocalSourceRecipeV1 

func ReadPythonLocalSourceRecipeV1(
	sourceDir string,
	distribution string,
) (PythonLocalSourceRecipeV1, error)

ReadPythonLocalSourceRecipeV1 reads only the selected immutable snapshot. It never consults an unselected override or the original live checkout.

type PythonNodePreparer 

type PythonNodePreparer struct {
	Descriptor     deploy.ImageDescriptor
	Workspace      PreparedProbeWorkspace
	Artifacts      PreparedPythonResolverArtifacts
	ReusableWheels []providerstore.ArtifactDescriptor
	ValidateCached PythonCachedNodeValidator
	ResolveFresh   PythonFreshNodeResolver
}

PythonNodePreparer owns the resolver-container lifecycle for one Python graph node. It always opens dependency resolution on the unmodified node prefix. A distinct source-build consumer is prepared later, and only when dependency resolution selects an immutable local snapshot whose recipe declares portable tools.

func (PythonNodePreparer) Prepare 

func (preparer PythonNodePreparer) Prepare(
	ctx context.Context,
	request providers.GraphNodePrepareRequest,
) (result providers.GraphNodePreparation, err error)

type PythonResolverSession 

type PythonResolverSession struct {
	// contains filtered or unexported fields
}

func OpenPythonResolverSession 

func OpenPythonResolverSession(
	ctx context.Context,
	descriptor deploy.ImageDescriptor,
	workspace PreparedProbeWorkspace,
	artifacts PreparedPythonResolverArtifacts,
) (*PythonResolverSession, error)

OpenPythonResolverSession starts a disposable consumer container used for Python prerequisite validation, wheel resolution, or selected source builds. Its public methods expose only fixed provider-owned operations.

func (*PythonResolverSession) BindSourceBuilder 

func (session *PythonResolverSession) BindSourceBuilder(environment *SourceBuilderEnvironmentV1) error

BindSourceBuilder records that this session's container was created from a prepared source-builder image. Source-build environment identity binds the exact builder image and portable-tool selections, and source-build commands see only the selected exports.

func (*PythonResolverSession) BuildSourceDistributions 

func (session *PythonResolverSession) BuildSourceDistributions(
	ctx context.Context,
	launcher providers.ValidatedExecutableInput,
	requirement providers.ExecutableRequirement,
	interpreter providers.ExecutableEvidence,
	snapshots []PreparedPythonSourceSnapshot,
) error

BuildSourceDistributions copies immutable source inputs into container-local scratch and asks each declared backend for exactly one portable sdist.

func (*PythonResolverSession) BuildSourceWheels 

func (session *PythonResolverSession) BuildSourceWheels(
	ctx context.Context,
	launcher providers.ValidatedExecutableInput,
	requirement providers.ExecutableRequirement,
	interpreter providers.ExecutableEvidence,
	distributions []PreparedPythonSourceDistribution,
) error

BuildSourceWheels copies only the securely extracted retained sdists into container-local scratch and builds one wheel from each closed artifact.

func (*PythonResolverSession) Close 

func (session *PythonResolverSession) Close(ctx context.Context) error

func (*PythonResolverSession) InspectAndBindInterpreter 

func (session *PythonResolverSession) InspectAndBindInterpreter(
	ctx context.Context,
	launcher providers.ValidatedExecutableInput,
	requirement providers.ExecutableRequirement,
	output providers.QualifiedOutput,
	testedTags []string,
) (providers.ValidatedExecutableInput, pythonprovider.InterpreterInspectionFactsV2, error)

InspectAndBindInterpreter validates the currently probed candidate, runs the fixed Python inspection, and only then returns selected-output evidence with observed version facts.

func (*PythonResolverSession) InspectInterpreter 

func (session *PythonResolverSession) InspectInterpreter(
	ctx context.Context,
	launcher providers.ValidatedExecutableInput,
	interpreter providers.ValidatedExecutableInput,
	testedTags []string,
) (pythonprovider.InterpreterInspectionFactsV2, error)

InspectInterpreter runs only Python's fixed isolated inspection through an already-validated clean-environment launcher in this resolver container.

func (*PythonResolverSession) Probe 

func (session *PythonResolverSession) Probe(ctx context.Context, request probe.RequestV1) (probe.ResponseV1, error)

Probe performs the fixed filesystem observation as the first operation in this already-running resolver container.

func (*PythonResolverSession) ResolveWheels 

func (session *PythonResolverSession) ResolveWheels(
	ctx context.Context,
	launcher providers.ValidatedExecutableInput,
	requirement providers.ExecutableRequirement,
	interpreter providers.ExecutableEvidence,
	request providers.CanonicalProviderRequest,
	sources []providers.ResolvedSourceInput,
	reusable []providerstore.ArtifactDescriptor,
	selected []pythonprovider.PortableToolVerifiedWheelInputV1,
) error

ResolveWheels runs the one provider-owned pip invocation after the selected interpreter has been observed in this exact container.

func (*PythonResolverSession) SourceBuildEnvironmentDigest 

func (session *PythonResolverSession) SourceBuildEnvironmentDigest(
	interpreter providers.ExecutableEvidence,
) (canonical.Digest, error)

func (*PythonResolverSession) Stop 

func (session *PythonResolverSession) Stop(ctx context.Context) error

Stop ends the resolver before host-side output ingestion.

func (*PythonResolverSession) ValidatedExecutableInput 

func (session *PythonResolverSession) ValidatedExecutableInput(
	role string,
	requirement providers.ExecutableRequirement,
	output providers.QualifiedOutput,
	facts providers.CanonicalProviderData,
) (providers.ValidatedExecutableInput, error)

ValidatedExecutableInput binds one typed consumer input to filesystem evidence observed by this resolver container's preceding probe.

type PythonSourceBuildIdentityV1 

type PythonSourceBuildIdentityV1 struct {
	BuildEnvironmentDigest canonical.Digest
	BuilderProfile         string
	BuildSettings          providers.CanonicalProviderData
}

type PythonSourceManifestEntryV1 

type PythonSourceManifestEntryV1 struct {
	Path          string           `json:"path"`
	Kind          string           `json:"kind"`
	Mode          string           `json:"mode"`
	ContentDigest canonical.Digest `json:"content_digest"`
	LinkTarget    string           `json:"link_target"`
}

type PythonSourceManifestV1 

type PythonSourceManifestV1 struct {
	Schema  string                        `json:"schema"`
	Exclude []string                      `json:"exclude"`
	Entries []PythonSourceManifestEntryV1 `json:"entries"`
}

func ObservePythonSourceManifest 

func ObservePythonSourceManifest(sourceDir string) (PythonSourceManifestV1, canonical.Digest, error)

ObservePythonSourceManifest records the complete immutable input exposed to the build backend, excluding only repository metadata that v1 deliberately withholds.

func ObservePythonSourceManifestWithExclusions 

func ObservePythonSourceManifestWithExclusions(
	sourceDir string,
	exclusions []string,
) (PythonSourceManifestV1, canonical.Digest, error)

ObservePythonSourceManifestWithExclusions additionally withholds exact source-relative paths and their descendants before their metadata is read. Packaging metadata still defines the retained sdist from the selected input.

type ReploySystemdService 

type ReploySystemdService struct {
	ServiceName    string
	TargetDir      string
	ComposeProject string
	UnitPath       string
}

func ListReploySystemdServices 

func ListReploySystemdServices() ([]ReploySystemdService, error)

type RequestOverlayEntry 

type RequestOverlayEntry struct {
	Kind      string
	Component string
	Value     string
}

func ListRequestOverlay 

func ListRequestOverlay(ctx context.Context, dir string) ([]RequestOverlayEntry, error)

type RequestOverlayOptionEntry 

type RequestOverlayOptionEntry struct {
	Name        string
	Description string
}

func ListRequestOverlayOptions 

func ListRequestOverlayOptions(ctx context.Context, dir string) ([]RequestOverlayOptionEntry, error)

type ResolvedEnvironmentCommand 

type ResolvedEnvironmentCommand struct {
	Name         string
	Trigger      []string
	Native       bool
	Deployed     bool
	ForwardFlags []string
	Argv         []string
}

func PlanCurrentAppCommandV1 

func PlanCurrentAppCommandV1(
	plan CurrentRuntimePlanV1,
	catalog []providers.RealizedOutput,
	arguments []string,
	deployedOnly bool,
) (ResolvedEnvironmentCommand, error)

PlanCurrentAppCommandV1 matches a public command trigger and resolves its executable exclusively from the current build's locked output catalog.

type RunOptions 

type RunOptions struct {
	Context                context.Context
	Stdin                  io.Reader
	Stdout                 io.Writer
	Stderr                 io.Writer
	Progress               io.Writer
	DockerPreflightTimeout time.Duration
	NoCache                bool
	Capture                *CommandOutputCapture
}

type RuntimeCommandOptions 

type RuntimeCommandOptions struct {
	Follow     bool
	Tail       string
	Since      string
	Timestamps bool
}

type RuntimeHostSourceV1 

type RuntimeHostSourceV1 struct {
	Destination string
	HostPath    string
	SourceKind  string
	Authority   string
	ReadOnly    bool
}

func RuntimeHostSourcesV1 

func RuntimeHostSourcesV1(plan DockerExecutionPlan, output *transientOutputMount) ([]RuntimeHostSourceV1, error)

type RuntimeInvocationV1 

type RuntimeInvocationV1 struct {
	PlanID  string
	Sources []RuntimeHostSourceV1
}

func CommandRuntimeInvocationV1 

func CommandRuntimeInvocationV1(plan DockerExecutionPlan, commandName string, output *transientOutputMount) (RuntimeInvocationV1, error)

func ShellRuntimeInvocationV1 

func ShellRuntimeInvocationV1(plan DockerExecutionPlan) (RuntimeInvocationV1, error)

func WorkloadRuntimeInvocationV1 

func WorkloadRuntimeInvocationV1(plan DockerExecutionPlan) (RuntimeInvocationV1, error)

type RuntimeOptions 

type RuntimeOptions struct {
	Dir                    string
	Action                 string
	ControlMode            ControlAdmissionModeV1
	Follow                 bool
	Tail                   string
	Timestamps             bool
	Verbose                bool
	Stdout                 io.Writer
	Stderr                 io.Writer
	Progress               io.Writer
	DockerPreflightTimeout time.Duration
}

type RuntimeReadinessInput 

type RuntimeReadinessInput struct {
	Current    CurrentBuild
	DockerPlan DockerExecutionPlan
	PlanID     string
	Sources    []RuntimeHostSourceV1
}

type RuntimeStatusV1 

type RuntimeStatusV1 struct {
	Status  string
	Started string
}

func ObserveRuntimeStatusV1 

func ObserveRuntimeStatusV1(ctx context.Context, plan DockerExecutionPlan, dockerPreflightTimeout time.Duration) (RuntimeStatusV1, error)

type RuntimeUserPlan 

type RuntimeUserPlan struct {
	User              string
	Group             string
	LocalUser         string
	UID               uint32
	GID               uint32
	SupplementaryGIDs []uint32
	DockerUser        string
	Warnings          []string
}

type SelectedProviderBase 

type SelectedProviderBase struct {
	Plan       providers.ProviderPlanV1
	Descriptor deploy.ImageDescriptor
	Config     deploy.BaseConfig
}

SelectedProviderBase contains the immutable base selection and normalized config needed to decide exact build reuse. It deliberately contains no output evidence; collecting that evidence is a separate realization step.

func SelectCachedProviderBase 

func SelectCachedProviderBase(
	ctx context.Context,
	request providers.ResolvedRequestV1,
	expected deploy.ImageDescriptor,
) (SelectedProviderBase, bool, error)

SelectCachedProviderBase plans the request but inspects only Docker's local author reference. It is a warm-reuse probe, not normal base resolution.

func SelectProviderBase 

func SelectProviderBase(
	ctx context.Context,
	request providers.ResolvedRequestV1,
) (SelectedProviderBase, error)

SelectProviderBase plans the request and resolves the exact immutable base descriptor and normalized config. It does not inspect declared base outputs.

type ShellOptions 

type ShellOptions struct {
	Dir                    string
	Wait                   bool
	ReadOnly               bool
	Stdin                  io.Reader
	Stdout                 io.Writer
	Stderr                 io.Writer
	DockerPreflightTimeout time.Duration
}

type SourceBuilderCoordinatorInputV1 

type SourceBuilderCoordinatorInputV1 struct {
	Store           providerstore.Store
	Base            deploy.ImageDescriptor
	ProviderPlan    providers.ProviderPlanV1
	BlueprintDigest canonical.Digest
	ReployVersion   string
	RunOptions      RunOptions
}

SourceBuilderCoordinatorInputV1 fixes the build-wide authority used when a selected immutable source snapshot first declares portable build tools.

type SourceBuilderCoordinatorV1 

type SourceBuilderCoordinatorV1 struct {
	// contains filtered or unexported fields
}

SourceBuilderCoordinatorV1 owns selection-triggered portable-tool planning, acquisition, offline materialization, and disposable builder preparation. Python supplies only path-free recipes read from snapshots dependency resolution already selected; it never solves or materializes a tool.

func NewSourceBuilderCoordinatorV1 

func NewSourceBuilderCoordinatorV1(input SourceBuilderCoordinatorInputV1) *SourceBuilderCoordinatorV1

func (*SourceBuilderCoordinatorV1) Cleanup 

func (coordinator *SourceBuilderCoordinatorV1) Cleanup() error

Cleanup removes every host materialization tree accumulated while selected recipe scopes expanded. Disposable builder images have separate ownership.

func (*SourceBuilderCoordinatorV1) PortableToolLock 

func (coordinator *SourceBuilderCoordinatorV1) PortableToolLock() *providers.PortableToolLockV1

PortableToolLock returns the complete selected lock after graph execution.

func (*SourceBuilderCoordinatorV1) Prepare 

func (coordinator *SourceBuilderCoordinatorV1) Prepare(
	ctx context.Context,
	upstream deploy.ImageDescriptor,
	selected []SourceBuilderSelectedRecipeV1,
) (*SourceBuilderEnvironmentV1, error)

Prepare merges newly selected immutable recipes into the operation snapshot, resolves and materializes the complete selected closure, and prepares a validated disposable builder from upstream. Calls are serialized so concurrently ready Python nodes cannot observe a partial union.

type SourceBuilderEnvironmentV1 

type SourceBuilderEnvironmentV1 struct {
	Descriptor       deploy.ImageDescriptor
	Upstream         deploy.ImageDescriptor
	Image            InspectedImageCandidate
	Exports          []providers.PortableToolExportV1
	ExportsDirectory string
	Selections       []SourceBuilderPortableToolSelectionV1
	Recipes          map[string]SourceBuilderRecipeIdentityV1
	Evidence         []providers.ValidationEvidence
	NativePackages   *providers.GraphExecutionResult
	NativeExports    []providers.ExecutableEvidence
	// contains filtered or unexported fields
}

SourceBuilderEnvironmentV1 is one Python node's prepared, inspected, and validated disposable source-builder image together with the exact exports and recipes it was prepared for.

func PrepareSourceBuilderEnvironmentV1 

func PrepareSourceBuilderEnvironmentV1(
	ctx context.Context,
	store providerstore.Store,
	tools *SourceBuilderPortableToolsV1,
	upstream deploy.ImageDescriptor,
	options RunOptions,
) (*SourceBuilderEnvironmentV1, error)

PrepareSourceBuilderEnvironmentV1 builds one Python node's disposable builder image from the node's prefix image and the shared materialized tree, inspects it, and runs every scheduled build-scope validation profile against that exact image through the PTD-21.5 boundary before any consumer opens it. A failed probe removes the image and fails the build.

func (*SourceBuilderEnvironmentV1) Cleanup 

func (environment *SourceBuilderEnvironmentV1) Cleanup(ctx context.Context) error

Cleanup removes the disposable builder image. It is idempotent.

type SourceBuilderPortableToolPlanV1 

type SourceBuilderPortableToolPlanV1 struct {
	Target   toolcatalog.TargetIdentityV1
	Plan     providers.PortableToolPlanV1
	DAG      providers.PortableToolProviderDAGV1
	Closures []toolcatalog.SelectedClosureV1
	Recipes  map[string]SourceBuilderRecipeIdentityV1
	Snapshot toolcatalog.ImmutableOperationSnapshotV1
}

SourceBuilderPortableToolPlanV1 is the resolved, not yet acquired, portable-tool plan for the immutable local-source recipes selected so far in one build. Exact reuse obtains the same selected identities from the already validated lock only after selected source identity matches.

func PlanSourceBuilderPortableToolsV1 

func PlanSourceBuilderPortableToolsV1(
	ctx context.Context,
	input PlanSourceBuilderPortableToolsInputV1,
) (*SourceBuilderPortableToolPlanV1, error)

PlanSourceBuilderPortableToolsV1 resolves canonical build-scope tool requirements read from selected immutable source snapshots against the embedded portable catalog for the observed base target, then compiles the PTD-21 plan and provider DAG. A selection whose recipes declare no tool requirements plans nothing and returns nil. No acquisition or materialization happens here.

func (*SourceBuilderPortableToolPlanV1) RecipeFor 

func (plan *SourceBuilderPortableToolPlanV1) RecipeFor(distribution string) (SourceBuilderRecipeIdentityV1, bool)

RecipeFor returns the recipe identity planned for one distribution's isolated source builder, when its recipe declared tools.

type SourceBuilderPortableToolSelectionV1 

type SourceBuilderPortableToolSelectionV1 struct {
	Scope                 string           `json:"scope"`
	Tool                  string           `json:"tool"`
	Version               string           `json:"version"`
	Revision              string           `json:"revision"`
	ManifestDigest        canonical.Digest `json:"manifest_digest"`
	SelectedClosureDigest canonical.Digest `json:"selected_closure_digest"`
}

SourceBuilderPortableToolSelectionV1 identifies one selected closure by the release provenance and closure identity that fix its built bytes. It is the only portable-tool contribution to source-build environment identity. The complete identity also binds the exact prepared builder image and interpreter, so reuse requires those inputs and the selection to remain unchanged.

type SourceBuilderPortableToolsV1 

type SourceBuilderPortableToolsV1 struct {
	Plan       *SourceBuilderPortableToolPlanV1
	Lock       providers.PortableToolLockV1
	Selections []SourceBuilderPortableToolSelectionV1
	Exports    []providers.PortableToolExportV1
	// contains filtered or unexported fields
}

SourceBuilderPortableToolsV1 is the build-wide, already acquired and offline-materialized portable-tool closure set for every isolated source builder. Its lock is the persisted portable-tool portion of the build lock; its materialized tree is copied into each Python node's disposable builder image and removed with Cleanup after the build.

func MaterializeSourceBuilderPortableToolsV1 

func MaterializeSourceBuilderPortableToolsV1(
	ctx context.Context,
	store providerstore.Store,
	plan *SourceBuilderPortableToolPlanV1,
) (result *SourceBuilderPortableToolsV1, resultErr error)

MaterializeSourceBuilderPortableToolsV1 acquires every selected artifact through the verified acquisition primitive while networking is permitted, locks the acquisition provenance, and only then materializes each verified archive offline into a host tree through the reviewed archive primitive. It exposes exactly the selected exports as named links and runs no tool.

func (*SourceBuilderPortableToolsV1) Cleanup 

func (tools *SourceBuilderPortableToolsV1) Cleanup() error

Cleanup removes the materialized host tree. Builder images built from it are independent Docker artifacts removed by their own environment cleanup.

type SourceBuilderRecipeIdentityV1 

type SourceBuilderRecipeIdentityV1 struct {
	Scope  string
	Digest canonical.Digest
	Groups []toolrequest.CanonicalRequirementGroupV1
}

SourceBuilderRecipeIdentityV1 binds one local-source recipe's requirement groups to the immutable recipe digest that produced them, so the consumer can prove the snapshot it builds from is the recipe the plan resolved.

type SourceBuilderSelectedRecipeV1 

type SourceBuilderSelectedRecipeV1 struct {
	Distribution string
	Recipe       PythonLocalSourceRecipeV1
}

SourceBuilderSelectedRecipeV1 is path-free recipe data read from one immutable local-source snapshot after dependency resolution selected it.

type StagedDeploymentRemoveInputV1 

type StagedDeploymentRemoveInputV1 struct {
	DeploymentDir string
	ControlMode   ControlAdmissionModeV1
	RunOptions    RunOptions
}

type StagedDeploymentRemoveResultV1 

type StagedDeploymentRemoveResultV1 struct {
	DeploymentDir string
	Environment   string
}

func RemoveStagedDeploymentV1 

func RemoveStagedDeploymentV1(
	ctx context.Context,
	input StagedDeploymentRemoveInputV1,
) (StagedDeploymentRemoveResultV1, error)

RemoveStagedDeploymentV1 removes one complete staging directory and only the Docker resources whose ownership is proven by its retained state.

type StagedOverrideValidationV1 

type StagedOverrideValidationV1 struct {
	Validated bool
	Packages  []OverrideDiscoveredPackageV1
	Unused    []OverrideDiscoveredPackageV1
}

func InspectStagedOverrideValidation 

func InspectStagedOverrideValidation(ctx context.Context, deploymentDir string) (result StagedOverrideValidationV1, resultErr error)

type StagedProviderBuildRuntimeV1 

type StagedProviderBuildRuntimeV1 struct {
	Host              blueprint.HostOS
	UID               uint32
	GID               uint32
	SupplementaryGIDs []uint32
}

func CurrentStagedProviderBuildRuntimeV1 

func CurrentStagedProviderBuildRuntimeV1() (StagedProviderBuildRuntimeV1, error)

type TestOptions 

type TestOptions struct {
	Dir                    string
	Timeout                time.Duration
	Stdout                 io.Writer
	RestartingDiagnostics  string
	DockerPreflightTimeout time.Duration
}

type TransientContainerExecutionV1 

type TransientContainerExecutionV1 struct {
	Container string
	Create    CommandSpec
	Start     CommandSpec
	Cleanup   CommandSpec
}

func PlanTransientContainerExecutionV1 

func PlanTransientContainerExecutionV1(
	plan DockerExecutionPlan,
	command ResolvedEnvironmentCommand,
	output *transientOutputMount,
	runID string,
	interactive bool,
	tty bool,
) (TransientContainerExecutionV1, error)

type UninstallOptions 

type UninstallOptions struct {
	From        string
	ServiceName string
	RemoveDir   bool
	Stdout      io.Writer
	Progress    io.Writer
	ControlMode ControlAdmissionModeV1

	DockerPreflightTimeout time.Duration
}

type UpdateResult 

type UpdateResult struct {
	Path      string
	Status    deploy.UpdateStatus
	Ownership string
	Reason    string
}

type ValidatedBuildCandidateV1 

type ValidatedBuildCandidateV1 struct {
	Record  deploy.ValidatedBuildV1
	Current CurrentBuild
}

func LoadValidatedBuildCandidate 

func LoadValidatedBuildCandidate(
	ctx context.Context,
	operation *deploy.OperationLock,
	store providerstore.Store,
	document blueprint.Document,
	state deploy.StateV1,
	overrides deploy.PackageOverridesV1,
	deploymentDir string,
	verifyCache bool,
	verifyImage bool,
) (ValidatedBuildCandidateV1, bool, error)

LoadValidatedBuildCandidate validates a recorded trial build without making it current. verifyImage is intentionally selectable: the editor can report the durable input-bound result while offline, whereas promotion verifies the Docker reference before trusting it.

type ValidatedBuildInputsV1 

type ValidatedBuildInputsV1 struct {
	BlueprintDigest        canonical.Digest
	OverlayDigest          canonical.Digest
	PackageOverridesDigest canonical.Digest
	PackageOverrides       deploy.PackageOverrideIntentV1
	BaseImage              string
	Platform               blueprint.Platform
}

func ValidatedBuildInputs 

func ValidatedBuildInputs(
	document blueprint.Document,
	overlay deploy.RequestOverlayV1,
	overrides deploy.PackageOverridesV1,
	deploymentDir string,
	platform blueprint.Platform,
) (ValidatedBuildInputsV1, error)

type VerifyCurrentBuildInputV1 

type VerifyCurrentBuildInputV1 struct {
	DeploymentDir string
	Runtime       StagedProviderBuildRuntimeV1
}

type VerifyCurrentBuildResultV1 

type VerifyCurrentBuildResultV1 struct {
	Environment string
	Reference   string
	Details     CurrentBuildVerificationResultV1
}

func VerifyCurrentBuildV1 

func VerifyCurrentBuildV1(
	ctx context.Context,
	input VerifyCurrentBuildInputV1,
) (VerifyCurrentBuildResultV1, error)

VerifyCurrentBuildV1 holds the existing deployment lock through a complete, read-only audit of the current staged generation.

type WorkloadExecutionPlan 

type WorkloadExecutionPlan struct {
	Command   string
	Argv      []string
	Endpoints map[string]EndpointExecutionPlan
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.