core

package
v0.1.35 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 20, 2026 License: Apache-2.0 Imports: 26 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrInvalidSessionCredential         = errors.New("invalid session credential")
	ErrSessionCredentialRequired        = errors.New("session credential is required")
	ErrSessionCredentialMismatch        = errors.New("session credential session mismatch")
	ErrSessionCredentialExpired         = errors.New("session credential expired")
	ErrSessionCredentialNotSerializable = errors.New("session credential is not serializable")
)
View Source 
var (
	ErrInvalidGroupSupervisorConfig = errors.New("invalid group supervisor config")
	ErrInvalidGroupWorkerAdmission  = errors.New("invalid group worker admission")
	ErrMultiWorkerDisabled          = errors.New("multi-worker admission is disabled")
	ErrGroupCapacity                = errors.New("group worker capacity reached")
	ErrSessionWorkerExists          = errors.New("session worker already exists")
	ErrSessionWorkerNotFound        = errors.New("session worker not found")
	ErrWorkspaceWriterExists        = errors.New("workspace already has a writer")
	ErrRecoveryAuthorityLost        = errors.New("recovery authority is unavailable")
)
View Source 
var (
	ErrProcessOwnershipUnavailable = errors.New("process ownership is unavailable")
	ErrProcessOwnershipQuarantined = errors.New("process ownership is quarantined")
	ErrProcessOwnershipUncertain   = errors.New("process ownership is uncertain")
)
View Source 
var (
	ErrChildConfidentialityUnavailable = errors.New("child confidentiality boundary is unavailable")
	ErrChildConfidentialityUnproven    = errors.New("child confidentiality boundary is unproven")
)
View Source 
var (
	ErrInvalidAdapterConnectionConfig = errors.New("invalid adapter connection config")
	ErrInvalidHelloAck                = errors.New("invalid hello ack")
	ErrCredentialRotationUnavailable  = errors.New("credential rotation unavailable")
	ErrCredentialRotationConflict     = errors.New("credential rotation conflict")
	ErrCredentialRotationStale        = errors.New("stale credential rotation")
	ErrCredentialAuthorityLost        = errors.New("credential authority lost")
	ErrCredentialRecoveryRequired     = errors.New("credential recovery required")
	ErrCredentialTerminal             = errors.New("credential lineage is terminal")
)
View Source 
var (
	ErrDurableReceiptRequired          = errors.New("durable receipt is required")
	ErrInvalidDurableReceipt           = errors.New("invalid durable receipt")
	ErrUnsupportedSessionWorkerCommand = errors.New("unsupported session worker command")
	ErrUnsafeCommandReplay             = errors.New("unsafe command replay")
)
View Source 
var (
	ErrInvalidState      = errors.New("invalid session state")
	ErrInvalidReason     = errors.New("invalid session reason")
	ErrInvalidTransition = errors.New("invalid session state transition")
	ErrTerminalState     = errors.New("session state is terminal")
)
View Source 
var (
	ErrInvalidProcessConfig = errors.New("invalid process supervisor config")
	ErrRestartLimitExceeded = errors.New("process restart limit exceeded")
)
View Source 
var ErrInvalidEventPayload = errors.New("invalid event payload")
View Source 
var ErrInvalidSessionWorkerConfig = errors.New("invalid session worker config")

Functions

func InitializeLinuxProcessOwnershipRoot added in v0.1.7 

func InitializeLinuxProcessOwnershipRoot(root string, providerUID uint32) error

func NewAdapterObservabilityHandler added in v0.1.7 

func NewAdapterObservabilityHandler(token string, metrics *AdapterMetrics, next http.Handler) http.Handler

NewAdapterObservabilityHandler is intended for a host-owned diagnostic listener. It deliberately keeps the Provider-facing listener as next and exposes no diagnostic route to a sandbox or remote caller.

func NewAdapterObservabilityHandlerAt added in v0.1.7 

func NewAdapterObservabilityHandlerAt(token string, metrics *AdapterMetrics, prefix string, next http.Handler) http.Handler

NewAdapterObservabilityHandlerAt mounts the Adapter diagnostic surface on a dedicated path prefix when Hub and Adapter share one host listener.

func StartFixedEntryHealth added in v0.1.7 

func StartFixedEntryHealth(ctx context.Context, marker string) (func(), error)

func ValidateAdapterDiagnosticsRoot added in v0.1.7 

func ValidateAdapterDiagnosticsRoot(rootPath, markerPath string, ownerUID uint32) error

Types

type AdapterConnectionConfig 

type AdapterConnectionConfig struct {
	SessionID       string
	Provider        string
	Token           string
	ProtocolVersion int
}

type AdapterConnectionState 

type AdapterConnectionState struct {
	// contains filtered or unexported fields
}

func NewAdapterConnectionState 

func NewAdapterConnectionState(cfg AdapterConnectionConfig) (*AdapterConnectionState, error)

func (*AdapterConnectionState) Hello 

func (s *AdapterConnectionState) Hello() protocol.Hello

func (*AdapterConnectionState) MarkAccepted 

func (s *AdapterConnectionState) MarkAccepted(ack protocol.HelloAck) (protocol.SessionSummary, error)

type AdapterDiagnosticsConfig added in v0.1.7 

type AdapterDiagnosticsConfig struct {
	SocketPath    string
	RootPath      string
	MarkerPath    string
	Metrics       *AdapterMetrics
	FixedEntryUID uint32
	OperatorUID   uint32
	ProviderUID   uint32
}

type AdapterDiagnosticsServer added in v0.1.7 

type AdapterDiagnosticsServer struct {
	// contains filtered or unexported fields
}

AdapterDiagnosticsServer is a fixed-entry-owned Unix diagnostic listener. It never falls back to TCP or loopback when the socket cannot be proven.

func StartAdapterDiagnostics added in v0.1.7 

func StartAdapterDiagnostics(ctx context.Context, socketPath string, metrics *AdapterMetrics) (*AdapterDiagnosticsServer, error)

func StartAdapterDiagnosticsWithConfig added in v0.1.7 

func StartAdapterDiagnosticsWithConfig(ctx context.Context, cfg AdapterDiagnosticsConfig) (*AdapterDiagnosticsServer, error)

func (*AdapterDiagnosticsServer) Close added in v0.1.7 

func (s *AdapterDiagnosticsServer) Close() error

func (*AdapterDiagnosticsServer) Path added in v0.1.7 

func (s *AdapterDiagnosticsServer) Path() string

type AdapterMetricSnapshot added in v0.1.7 

type AdapterMetricSnapshot struct {
	Workers         int64
	ActiveWorkers   int64
	QueuedWorkers   int64
	ReceiptFailures uint64
	MaskedEvents    uint64
}

func (AdapterMetricSnapshot) Prometheus added in v0.1.7 

func (s AdapterMetricSnapshot) Prometheus() string

type AdapterMetrics added in v0.1.7 

type AdapterMetrics struct {
	// contains filtered or unexported fields
}

AdapterMetrics contains only bounded process-level counters. Session IDs, command content and credential material never become metric labels.

func NewAdapterMetrics added in v0.1.7 

func NewAdapterMetrics() *AdapterMetrics

func (*AdapterMetrics) IncMaskedEvent added in v0.1.7 

func (m *AdapterMetrics) IncMaskedEvent()

func (*AdapterMetrics) IncReceiptFailure added in v0.1.7 

func (m *AdapterMetrics) IncReceiptFailure()

func (*AdapterMetrics) SetWorkerCounts added in v0.1.7 

func (m *AdapterMetrics) SetWorkerCounts(workers, active, queued int64)

func (*AdapterMetrics) Snapshot added in v0.1.7 

func (m *AdapterMetrics) Snapshot() AdapterMetricSnapshot

type ChildConfidentialityReport added in v0.1.7 

type ChildConfidentialityReport struct {
	DumpableZero      bool
	CoreLimitZero     bool
	NoNewPrivileges   bool
	CapabilitiesZero  bool
	SeccompFiltered   bool
	PtraceRestricted  bool
	ProcEnvironDenied bool
	ProcMemDenied     bool
	ProcFDsDenied     bool
	ProcessVMDenied   bool
	PidfdGetfdDenied  bool
}

ChildConfidentialityReport is deliberately evidence-shaped. A true result requires both supervisor state and a same-UID child access probe; callers must not turn an individual field into a capability decision.

func ProbeChildConfidentiality added in v0.1.7 

func ProbeChildConfidentiality(ctx context.Context) (ChildConfidentialityReport, error)

ProbeChildConfidentiality checks the actual supervisor confinement and then runs a same-UID child that attempts the credential-bearing proc accesses. Any unsupported, unverifiable or failed assertion is unavailable so callers must keep multi-Worker capability absent.

type CommandOutcome added in v0.1.7 

type CommandOutcome string
const (
	CommandOutcomeCompleted      CommandOutcome = "completed"
	CommandOutcomeOutcomeUnknown CommandOutcome = "outcome_unknown"
)

type CommandRoutingReceipt added in v0.1.7 

type CommandRoutingReceipt struct {
	CommandID string
	Status    CommandRoutingStatus
	Reason    string
}

CommandRoutingReceipt is the hop-by-hop command.ack result. It is not a durable operation result and never authorizes a Provider outcome.

type CommandRoutingStatus added in v0.1.7 

type CommandRoutingStatus string
const (
	CommandRoutingAccepted  CommandRoutingStatus = "accepted"
	CommandRoutingRejected  CommandRoutingStatus = "rejected"
	CommandRoutingDuplicate CommandRoutingStatus = "duplicate"
)

type ConnectionAuthorityLifecycle added in v0.1.7 

type ConnectionAuthorityLifecycle struct {
	// contains filtered or unexported fields
}

ConnectionAuthorityLifecycle is the concrete Adapter-side fence for one T42B0 Store-issued, non-secret receipt. The Store reader is checked before recovery construction and again while the lifecycle read lock spans the final receipt check and Provider-start callback.

func NewConnectionAuthorityLifecycle added in v0.1.7 

func NewConnectionAuthorityLifecycle(receipt store.ConnectionAuthorityReceipt, authorityStore store.AdapterConnectionStore) (*ConnectionAuthorityLifecycle, error)

func (*ConnectionAuthorityLifecycle) Replace added in v0.1.7 

func (l *ConnectionAuthorityLifecycle) Replace(receipt store.ConnectionAuthorityReceipt) error

func (*ConnectionAuthorityLifecycle) Revoke added in v0.1.7 

func (l *ConnectionAuthorityLifecycle) Revoke()

func (*ConnectionAuthorityLifecycle) RunWithConnectionAuthority added in v0.1.7 

func (l *ConnectionAuthorityLifecycle) RunWithConnectionAuthority(ctx context.Context, receipt store.ConnectionAuthorityReceipt, run func(context.Context) error) error

RunWithConnectionAuthority makes final validation and Provider start one lifecycle-critical section. Revocation/replacement waits for the callback.

func (*ConnectionAuthorityLifecycle) VerifyConnectionAuthority added in v0.1.7 

func (l *ConnectionAuthorityLifecycle) VerifyConnectionAuthority(ctx context.Context, receipt store.ConnectionAuthorityReceipt) error

type CredentialRecoveryPermit added in v0.1.7 

type CredentialRecoveryPermit struct {
	SessionID  string
	Epoch      int64
	Generation int64
}

CredentialRecoveryPermit authorizes only a bounded same-Session recovery exchange. It cannot route commands, events or Provider starts.

type CredentialRotation added in v0.1.7 

type CredentialRotation struct {
	// contains filtered or unexported fields
}

CredentialRotation owns one Session's bootstrap or target lineage. Target attachment rotations are isolated by constructing one instance per Worker.

func NewCredentialRotation added in v0.1.7 

func NewCredentialRotation(sessionID string, initial *SessionCredential, epoch int64) (*CredentialRotation, error)

func (*CredentialRotation) Activate added in v0.1.7 

func (r *CredentialRotation) Activate(receipt CredentialRotationReceipt) error

func (*CredentialRotation) ActiveReceipt added in v0.1.7 

func (r *CredentialRotation) ActiveReceipt() (CredentialRotationReceipt, error)

func (*CredentialRotation) Authorize added in v0.1.7 

func (r *CredentialRotation) Authorize(now time.Time) error

func (*CredentialRotation) MarkAuthorityLost added in v0.1.7 

func (r *CredentialRotation) MarkAuthorityLost()

func (*CredentialRotation) PossessionAck added in v0.1.7 

func (r *CredentialRotation) PossessionAck(rotationID string, acceptedEpoch int64) (CredentialRotationReceipt, error)

func (*CredentialRotation) Prepare added in v0.1.7 

func (r *CredentialRotation) Prepare(rotationID string, credential *SessionCredential) error

func (*CredentialRotation) Reconnect added in v0.1.7 

func (r *CredentialRotation) Reconnect(epoch, generation int64) error

func (*CredentialRotation) RecoveryPermit added in v0.1.7 

func (r *CredentialRotation) RecoveryPermit() (CredentialRecoveryPermit, error)

func (*CredentialRotation) RetryActivation added in v0.1.7 

func (r *CredentialRotation) RetryActivation(rotationID string) (CredentialRotationReceipt, error)

func (*CredentialRotation) Revoke added in v0.1.7 

func (r *CredentialRotation) Revoke()

func (*CredentialRotation) Terminal added in v0.1.7 

func (r *CredentialRotation) Terminal()

type CredentialRotationReceipt added in v0.1.7 

type CredentialRotationReceipt struct {
	RotationID string
	SessionID  string
	Epoch      int64
	Generation int64
	Status     CredentialRotationStatus
}

CredentialRotationReceipt is reference-only. It never contains bearer material and is valid only for the exact Session, epoch and generation.

type CredentialRotationStatus added in v0.1.7 

type CredentialRotationStatus string
const (
	CredentialRotationPending  CredentialRotationStatus = "pending"
	CredentialRotationActive   CredentialRotationStatus = "active"
	CredentialRotationRecovery CredentialRotationStatus = "recovery_required"
	CredentialRotationRevoked  CredentialRotationStatus = "revoked"
	CredentialRotationTerminal CredentialRotationStatus = "terminal"
)

type EndReason 

type EndReason string
const (
	EndReasonUserStop     EndReason = "user_stop"
	EndReasonProviderExit EndReason = "provider_exit"
	EndReasonCrash        EndReason = "crash"
	EndReasonTimeout      EndReason = "timeout"
)

type EventMasker 

type EventMasker struct {
	// contains filtered or unexported fields
}

func NewEventMasker 

func NewEventMasker(secrets []string) *EventMasker

func (*EventMasker) MaskEvent 

func (m *EventMasker) MaskEvent(ev protocol.Event) (protocol.Event, error)

func (*EventMasker) MaskWriter added in v0.1.7 

func (m *EventMasker) MaskWriter(writer io.Writer) io.WriteCloser

type EventProposalReceipt added in v0.1.7 

type EventProposalReceipt struct {
	ProposalID string
	Seq        int64
	Status     EventProposalStatus
}

EventProposalReceipt is the reference-only EventStore sequence assigned to one exact proposal ID. A retry returns the original sequence.

type EventProposalStatus added in v0.1.7 

type EventProposalStatus string
const EventProposalAccepted EventProposalStatus = "accepted"

type GroupSupervisor added in v0.1.7 

type GroupSupervisor struct {
	// contains filtered or unexported fields
}

GroupSupervisor owns bounded in-process membership. Durable lease release remains exclusively with the fixed-entry cleanup path after quiescence.

func NewGroupSupervisor added in v0.1.7 

func NewGroupSupervisor(cfg GroupSupervisorConfig) (*GroupSupervisor, error)

func (*GroupSupervisor) Admit added in v0.1.7 

func (s *GroupSupervisor) Admit(ctx context.Context, admission GroupWorkerAdmission) error

Admit reserves durable writer authority before constructing a Worker. A reservation failure therefore proves that no Provider spawn can follow.

func (*GroupSupervisor) BindRecoveryStartAdmission added in v0.1.7 

func (s *GroupSupervisor) BindRecoveryStartAdmission(provider ProcessConfig, source RecoveryStartHandleSource) (ProcessConfig, error)

BindRecoveryStartAdmission makes this GroupSupervisor the owner of the opaque lifecycle fence used by every Provider child start. The handle source remains the Hub/Store-backed authority; this method only binds the existing admission delegate and never exposes or derives the handle value.

func (*GroupSupervisor) Recover added in v0.1.7 

func (s *GroupSupervisor) Recover(ctx context.Context, recovery GroupWorkerRecovery) error

Recover reconstructs membership only after trusted live authority verifies the durable tuple. It deliberately does not reserve or release a workspace.

func (*GroupSupervisor) Run added in v0.1.7 

func (s *GroupSupervisor) Run(ctx context.Context, sessionID string) error

func (*GroupSupervisor) Stop added in v0.1.7 

func (s *GroupSupervisor) Stop(ctx context.Context, sessionID string) error

func (*GroupSupervisor) WorkerCount added in v0.1.7 

func (s *GroupSupervisor) WorkerCount() int

type GroupSupervisorConfig added in v0.1.7 

type GroupSupervisorConfig struct {
	MaxWorkers                 int
	Leases                     workspaceLeaseReserver
	AllowReferenceOnlyRecovery bool
	Activation                 MultiWorkerActivation
	ProcessOwnership           ProcessTreeOwnership
	QuiescenceLease            QuiescenceLease
	NewWorker                  func(SessionWorkerConfig) (SessionWorkerRunner, error)
}

type GroupWorkerAdmission added in v0.1.7 

type GroupWorkerAdmission struct {
	WorkerID  string
	SessionID string
	Worker    SessionWorkerConfig
	Lease     store.WorkspaceLeaseReserve
}

GroupWorkerAdmission contains the Store-derived opaque workspace tuple for one prospective writer. It is never copied into protocol frames or Provider process configuration.

type GroupWorkerRecovery added in v0.1.7 

type GroupWorkerRecovery struct {
	Admission         GroupWorkerAdmission
	Authority         RecoveryAuthority
	StartHandle       RecoveryStartHandle
	StartHandleSource RecoveryStartHandleSource
}

GroupWorkerRecovery keeps ephemeral process setup separate from the tuple that a trusted lifecycle validates against durable authority.

type LedgerOperationReceipt added in v0.1.7 

type LedgerOperationReceipt struct {
	OperationID string
	Version     int64
	Status      LedgerOperationStatus
}

LedgerOperationReceipt is the reference-only durable command operation identity. Operation ID/version are deliberately distinct from cmd_id.

type LedgerOperationStatus added in v0.1.7 

type LedgerOperationStatus string
const (
	LedgerOperationPending        LedgerOperationStatus = "pending"
	LedgerOperationCompleted      LedgerOperationStatus = "completed"
	LedgerOperationOutcomeUnknown LedgerOperationStatus = "outcome_unknown"
)

type LinuxProcessOwnershipConfig added in v0.1.7 

type LinuxProcessOwnershipConfig struct {
	Root            string
	ProviderUID     uint32
	CleanupTimeout  time.Duration
	MaxTrackedProcs int
}

type LinuxProcessTreeOwnership added in v0.1.7 

type LinuxProcessTreeOwnership struct {
	// contains filtered or unexported fields
}

func NewLinuxProcessTreeOwnership added in v0.1.7 

func NewLinuxProcessTreeOwnership(cfg LinuxProcessOwnershipConfig) (*LinuxProcessTreeOwnership, error)

func (*LinuxProcessTreeOwnership) AbortStart added in v0.1.7 

func (o *LinuxProcessTreeOwnership) AbortStart(_ context.Context, attempt int) error

func (*LinuxProcessTreeOwnership) ObserveStarted added in v0.1.7 

func (o *LinuxProcessTreeOwnership) ObserveStarted(ctx context.Context, event ProcessEvent) error

func (*LinuxProcessTreeOwnership) PrepareStart added in v0.1.7 

func (o *LinuxProcessTreeOwnership) PrepareStart(ctx context.Context, attempt int) error

func (*LinuxProcessTreeOwnership) Quarantine added in v0.1.7 

func (o *LinuxProcessTreeOwnership) Quarantine(_ context.Context) error

func (*LinuxProcessTreeOwnership) Quiesce added in v0.1.7 

func (o *LinuxProcessTreeOwnership) Quiesce(ctx context.Context) error

func (*LinuxProcessTreeOwnership) Quiescent added in v0.1.7 

func (o *LinuxProcessTreeOwnership) Quiescent() bool

type LinuxQuiescenceLease added in v0.1.7 

type LinuxQuiescenceLease struct {
	// contains filtered or unexported fields
}

func NewLinuxQuiescenceLease added in v0.1.7 

func NewLinuxQuiescenceLease(owner *LinuxProcessTreeOwnership, generation string) (*LinuxQuiescenceLease, error)

func (*LinuxQuiescenceLease) Disconnect added in v0.1.7 

func (l *LinuxQuiescenceLease) Disconnect(ctx context.Context) error

func (*LinuxQuiescenceLease) Held added in v0.1.7 

func (l *LinuxQuiescenceLease) Held() bool

func (*LinuxQuiescenceLease) Quarantine added in v0.1.7 

func (l *LinuxQuiescenceLease) Quarantine(ctx context.Context) error

func (*LinuxQuiescenceLease) Release added in v0.1.7 

func (l *LinuxQuiescenceLease) Release(_ context.Context) error

type MultiWorkerActivation added in v0.1.7 

type MultiWorkerActivation interface {
	AllowMultiWorker(context.Context) error
}

MultiWorkerActivation is a trusted, runtime-only gate. Until T42F and T42H provide a concrete implementation, a nil gate rejects every second Worker.

type ProcessCommand 

type ProcessCommand struct {
	Path       string
	Args       []string
	Env        []string
	Dir        string
	Stdin      io.Reader
	Stdout     io.Writer
	Stderr     io.Writer
	Credential *ProcessCredential
}

type ProcessConfig 

type ProcessConfig struct {
	Command        ProcessCommand
	MaxRestarts    int
	Backoff        time.Duration
	GracePeriod    time.Duration
	StartAdmission ProcessStartAdmission
}

func BindRecoveryStartAdmission added in v0.1.7 

func BindRecoveryStartAdmission(provider ProcessConfig, source RecoveryStartHandleSource) (ProcessConfig, error)

BindRecoveryStartAdmission fences every child start against the last Store-admitted handle while delegating the actual prepare/started handshake to the existing T42B2 admission.

type ProcessCredential added in v0.1.7 

type ProcessCredential struct{ UID, GID uint32 }

ProcessCredential is the fixed-entry-only identity for a Provider child.

type ProcessEvent 

type ProcessEvent struct {
	Type    ProcessEventType
	Attempt int
	PID     int
	Err     error
	Killed  bool
}

type ProcessEventType 

type ProcessEventType string
const (
	ProcessEventStarted    ProcessEventType = "started"
	ProcessEventExited     ProcessEventType = "exited"
	ProcessEventRestarting ProcessEventType = "restarting"
	ProcessEventStopped    ProcessEventType = "stopped"
)

type ProcessStartAdmission added in v0.1.7 

type ProcessStartAdmission interface {
	PrepareProcessStart(context.Context, int) error
	ConfirmProcessStarted(context.Context, int) error
}

ProcessStartAdmission binds every individual Provider child start to a trusted lifecycle. Prepare runs before exec and confirmation runs as soon as a child exists. It deliberately receives no Provider configuration.

type ProcessSupervisor 

type ProcessSupervisor struct {
	// contains filtered or unexported fields
}

func NewProcessSupervisor 

func NewProcessSupervisor(cfg ProcessConfig) (*ProcessSupervisor, error)

func (*ProcessSupervisor) Events 

func (s *ProcessSupervisor) Events() <-chan ProcessEvent

func (*ProcessSupervisor) Interrupt added in v0.1.7 

func (s *ProcessSupervisor) Interrupt(ctx context.Context) error

Interrupt cancels the current Provider turn without changing supervisor lifecycle state. The process remains available for subsequent work and no stopped event or lease cleanup is emitted.

func (*ProcessSupervisor) Run 

func (s *ProcessSupervisor) Run(ctx context.Context) error

func (*ProcessSupervisor) Stop 

func (s *ProcessSupervisor) Stop(ctx context.Context) error

type ProcessTreeOwnership added in v0.1.7 

type ProcessTreeOwnership interface {
	PrepareStart(context.Context, int) error
	AbortStart(context.Context, int) error
	ObserveStarted(context.Context, ProcessEvent) error
	Quiesce(context.Context) error
}

type QuiescenceLease added in v0.1.7 

type QuiescenceLease interface {
	Release(context.Context) error
	Quarantine(context.Context) error
}

type RecoveryAuthority added in v0.1.7 

type RecoveryAuthority struct {
	// contains filtered or unexported fields
}

func NewRecoveryAuthority added in v0.1.7 

func NewRecoveryAuthority(receipt store.ConnectionAuthorityReceipt, lifecycle *ConnectionAuthorityLifecycle) (RecoveryAuthority, error)

type RecoveryStartAuthority added in v0.1.7 

type RecoveryStartAuthority interface {
	VerifyRecoveryStart(context.Context) error
}

RecoveryStartAuthority is the lifecycle fence paired with a reference-only start handle. The production Adapter implementation is backed by Hub/Store authority; a handle alone is never durable authority.

type RecoveryStartHandle added in v0.1.7 

type RecoveryStartHandle struct {
	// contains filtered or unexported fields
}

RecoveryStartHandle is an opaque reference returned by an admitted child start. It carries no authority and has no accessor; T42B owns any later GroupSupervisor recovery consumption.

func NewRecoveryStartHandle added in v0.1.7 

func NewRecoveryStartHandle(value string) (RecoveryStartHandle, error)

type RecoveryStartHandleSource added in v0.1.7 

type RecoveryStartHandleSource interface {
	RecoveryStartHandle() (RecoveryStartHandle, error)
}

RecoveryStartHandleSource exposes only the current opaque reference. The source owns lifecycle truth; callers cannot inspect or derive its value.

type SessionCredential added in v0.1.7 

type SessionCredential struct {
	// contains filtered or unexported fields
}

SessionCredential keeps the bearer private to the trusted Adapter package. There is intentionally no getter, map key, JSON representation, or text representation that can move it across the Worker boundary.

func NewSessionCredential added in v0.1.7 

func NewSessionCredential(bearer string, metadata SessionCredentialMetadata) (*SessionCredential, error)

func (SessionCredential) Format added in v0.1.7 

func (c SessionCredential) Format(state fmt.State, verb rune)

func (SessionCredential) GoString added in v0.1.7 

func (c SessionCredential) GoString() string

func (SessionCredential) MarshalJSON added in v0.1.7 

func (c SessionCredential) MarshalJSON() ([]byte, error)

func (SessionCredential) MarshalText added in v0.1.7 

func (c SessionCredential) MarshalText() ([]byte, error)

func (*SessionCredential) Metadata added in v0.1.7 

func (c *SessionCredential) Metadata() (SessionCredentialMetadata, error)

func (SessionCredential) String added in v0.1.7 

func (c SessionCredential) String() string

type SessionCredentialLineage added in v0.1.7 

type SessionCredentialLineage struct {
	Kind     string
	AttachID string
	JTI      string
}

SessionCredentialLineage identifies one Hub-issued credential lineage without carrying bearer material or Provider data.

type SessionCredentialMetadata added in v0.1.7 

type SessionCredentialMetadata struct {
	SessionID  string
	Lineage    SessionCredentialLineage
	Generation int64
	ExpiresAt  time.Time
}

SessionCredentialMetadata is the non-secret routing metadata owned by one SessionWorker. It is safe to copy, but never contains the bearer.

type SessionState 

type SessionState string
const (
	StateStarting          SessionState = "starting"
	StateReady             SessionState = "ready"
	StateBusy              SessionState = "busy"
	StateWaitingPermission SessionState = "waiting_permission"
	StateRecovering        SessionState = "recovering"
	StateEnded             SessionState = "ended"
	StateError             SessionState = "error"
)

type SessionWorker added in v0.1.7 

type SessionWorker struct {
	// contains filtered or unexported fields
}

SessionWorker is the single-Session owner for the existing Provider process lifecycle and its receipt-gated command/event side effects. Hub connection and credential ownership remain outside this boundary.

func NewSessionWorker added in v0.1.7 

func NewSessionWorker(cfg SessionWorkerConfig) (*SessionWorker, error)

func (*SessionWorker) AcknowledgeCredentialPossession added in v0.1.7 

func (w *SessionWorker) AcknowledgeCredentialPossession(rotationID string, acceptedEpoch int64) (CredentialRotationReceipt, error)

func (*SessionWorker) ActivateCredentialRotation added in v0.1.7 

func (w *SessionWorker) ActivateCredentialRotation(receipt CredentialRotationReceipt) error

func (*SessionWorker) CredentialRecoveryPermit added in v0.1.7 

func (w *SessionWorker) CredentialRecoveryPermit() (CredentialRecoveryPermit, error)

func (*SessionWorker) DeliverCommand added in v0.1.7 

func (w *SessionWorker) DeliverCommand(ctx context.Context, command SessionWorkerCommand, apply func(context.Context) error) (CommandRoutingReceipt, error)

DeliverCommand waits for both the routing acknowledgement and durable ledger operation receipt before invoking the Provider side effect. Any ambiguous result is finalized as outcome_unknown and is never replayed.

func (*SessionWorker) Events added in v0.1.7 

func (w *SessionWorker) Events() <-chan ProcessEvent

func (*SessionWorker) MarkCredentialAuthorityLost added in v0.1.7 

func (w *SessionWorker) MarkCredentialAuthorityLost()

func (*SessionWorker) PrepareCredentialRotation added in v0.1.7 

func (w *SessionWorker) PrepareCredentialRotation(rotationID string, credential *SessionCredential) error

func (*SessionWorker) ProposeEvent added in v0.1.7 

func (w *SessionWorker) ProposeEvent(ctx context.Context, proposalID string, publish func(int64) error) (EventProposalReceipt, error)

ProposeEvent commits an exact opaque proposal ID before publishing its authoritative sequence. Repeating the same ID therefore returns the Store's original sequence and never invents a new event identity.

func (*SessionWorker) ReconnectCredential added in v0.1.7 

func (w *SessionWorker) ReconnectCredential(epoch, generation int64) error

func (*SessionWorker) RetryCredentialActivation added in v0.1.7 

func (w *SessionWorker) RetryCredentialActivation(rotationID string) (CredentialRotationReceipt, error)

func (*SessionWorker) RevokeCredential added in v0.1.7 

func (w *SessionWorker) RevokeCredential()

func (*SessionWorker) RouteCommand added in v0.1.7 

func (w *SessionWorker) RouteCommand(ctx context.Context, command SessionWorkerCommand, apply func(context.Context) error) (CommandRoutingReceipt, error)

RouteCommand verifies the private credential binding before entering the durable receipt path. A missing credential is deny-by-default for routed work; legacy callers that use DeliverCommand directly retain T42C behavior.

func (*SessionWorker) Run added in v0.1.7 

func (w *SessionWorker) Run(ctx context.Context) error

func (*SessionWorker) SessionID added in v0.1.7 

func (w *SessionWorker) SessionID() string

func (*SessionWorker) Stop added in v0.1.7 

func (w *SessionWorker) Stop(ctx context.Context) error

func (*SessionWorker) TerminalCredential added in v0.1.7 

func (w *SessionWorker) TerminalCredential()

type SessionWorkerCommand added in v0.1.7 

type SessionWorkerCommand struct {
	CommandID string
	Type      string
	// SessionID is an optional trusted routing assertion. Provider-controlled
	// values are never used to select a Worker and must match the bound Worker.
	SessionID string
}

type SessionWorkerConfig added in v0.1.7 

type SessionWorkerConfig struct {
	SessionID                 string
	Provider                  ProcessConfig
	RecoveryStartHandleSource RecoveryStartHandleSource
	RecoveryStartHandle       *RecoveryStartHandle
	DurableReceipts           SessionWorkerDurableReceipts
	Credential                *SessionCredential
	ProcessOwnership          ProcessTreeOwnership
	QuiescenceLease           QuiescenceLease
	Metrics                   *AdapterMetrics
}

type SessionWorkerDurableReceipts added in v0.1.7 

type SessionWorkerDurableReceipts interface {
	PrepareProviderStart(context.Context, string, int) error
	ConfirmProviderStarted(context.Context, string, int) error
	PrepareCommand(context.Context, string, SessionWorkerCommand) (CommandRoutingReceipt, LedgerOperationReceipt, error)
	FinalizeCommand(context.Context, string, SessionWorkerCommand, LedgerOperationReceipt, CommandOutcome) error
	CommitEventProposal(context.Context, string, string) (EventProposalReceipt, error)
}

SessionWorkerDurableReceipts is the narrow Adapter-side seam to the Hub-owned Store contracts. It accepts only bounded opaque IDs and statuses; command/event content and credentials stay with the caller's trusted Hub path. Implementations must preserve exact retry identity and fail closed on stale authority.

type SessionWorkerRunner added in v0.1.7 

type SessionWorkerRunner interface {
	Run(context.Context) error
	Stop(context.Context) error
}

SessionWorkerRunner retains only the process lifecycle needed by this pre-activation foundation. Credential delivery, command routing and cleanup are owned by their dedicated tasks.

type StateMachine 

type StateMachine struct {
	// contains filtered or unexported fields
}

func NewStateMachine 

func NewStateMachine(initial SessionState) (*StateMachine, error)

func (*StateMachine) End 

func (m *StateMachine) End(reason EndReason) (Transition, error)

func (*StateMachine) Error 

func (m *StateMachine) Error(reason string) (Transition, error)

func (*StateMachine) State 

func (m *StateMachine) State() SessionState

func (*StateMachine) Transition 

func (m *StateMachine) Transition(to SessionState, reason string) (Transition, error)

type Transition 

type Transition struct {
	From   SessionState
	To     SessionState
	Reason string
}

func (Transition) Terminal 

func (t Transition) Terminal() bool

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.