sandboxhostprocess

type AuthenticatedDataPlaneReceiptReportingHostExecutor ¶

type AuthenticatedDataPlaneReceiptReportingHostExecutor interface {
	AuthenticatedHostExecutor
	DataPlaneReceiptReportingHostExecutor
	ExecuteAuthenticatedWithDataPlaneReceipt(context.Context, sandboxhostprotocol.Envelope, []byte, DataPlaneReceiptEmitter) error
}

AuthenticatedDataPlaneReceiptReportingHostExecutor preserves the exact control-signed wire across a data-plane authority boundary.

type AuthenticatedHostExecutor ¶

type AuthenticatedHostExecutor interface {
	HostExecutor
	ExecuteAuthenticated(context.Context, sandboxhostprotocol.Envelope, []byte) error
}

AuthenticatedHostExecutor optionally receives the exact control-signed wire that sandboxhostprocess verified before it reached the durable effect seam. The ordinary HostExecutor door remains for deterministic adapters that do not have a guest data plane.

type AuthenticatedHostReaper ¶

type AuthenticatedHostReaper interface {
	ReapAuthenticated(context.Context, sandboxhostprotocol.Envelope, []byte) error
}

AuthenticatedHostReaper carries the same verified canonical control wire into cleanup that crossed the effect boundary. A reaper must reject a substituted wire rather than reconstructing authority from journal state.

type AuthenticatedOutputReportingHostExecutor ¶

type AuthenticatedOutputReportingHostExecutor interface {
	AuthenticatedHostExecutor
	OutputReportingHostExecutor
	ExecuteAuthenticatedWithOutput(context.Context, sandboxhostprotocol.Envelope, []byte, OutputEmitter) error
}

AuthenticatedOutputReportingHostExecutor combines exact control-wire preservation with bounded guest output forwarding.

type Config ¶

type Config struct {
	// contains filtered or unexported fields
}

Config is one validated immutable reference-host declaration.

func Parse(input io.Reader) (Config, error)

type DataPlaneReceiptEmitter ¶

type DataPlaneReceiptEmitter = func(context.Context, string, []byte) error

DataPlaneReceiptEmitter sends a canonical private receipt only after its owner has fsynced it. The host process signs and obtains public-control ack.

type DataPlaneReceiptReportingHostExecutor ¶

type DataPlaneReceiptReportingHostExecutor interface {
	HostExecutor
	ExecuteWithDataPlaneReceipt(context.Context, sandboxhostprotocol.Envelope, DataPlaneReceiptEmitter) error
}

DataPlaneReceiptReportingHostExecutor is the typed private effect seam for reference-only transfer, restore, and mount terminal observations.

type ExecutionOutput ¶

type ExecutionOutput = sandboxhostprotocol.GuestOutput

ExecutionOutput is one bounded guest chunk before it is signed and durably acknowledged through the private host-control output owner.

type HostExecutor ¶

type HostExecutor interface {
	Execute(context.Context, sandboxhostprotocol.Envelope) error
}

HostExecutor is the private host-effect seam. Implementations must honor the supplied lease-derived context and must not select control authority.

type HostReaper ¶

type HostReaper interface {
	Reap(context.Context, sandboxhostprotocol.Envelope) error
}

HostReaper converges an exact started command after its guest exchange has failed or its lease context has been cancelled. It never turns recovery into another execution attempt.

type Observer ¶

type Observer func(Summary)

Observer receives one bounded content-free host-poll summary.

type Outcome ¶

type Outcome string

Outcome is the bounded result of one host poll.

const (
	// OutcomeNoWork confirms that an authenticated control poll found no eligible operation.
	OutcomeNoWork Outcome = "no_work"
	// OutcomeSucceeded confirms that one journaled reference operation completed.
	OutcomeSucceeded Outcome = "succeeded"
	// OutcomeRetrying reports a transient control-plane failure before the next retry.
	OutcomeRetrying Outcome = "retrying"
)

type OutputEmitter ¶

type OutputEmitter = sandboxhostprotocol.GuestOutputEmitter

OutputEmitter stages and acknowledges one host-signed output observation.

type OutputReportingHostExecutor ¶

type OutputReportingHostExecutor interface {
	HostExecutor
	ExecuteWithOutput(context.Context, sandboxhostprotocol.Envelope, OutputEmitter) error
}

OutputReportingHostExecutor is the optional result/output extension for a real guest transport. The ordinary executor seam remains safe for adapters without a guest data plane.

type SecretLookup ¶

type SecretLookup func(string) (string, bool)

SecretLookup resolves only explicitly named already-injected values.

type Summary ¶

type Summary struct {
	ObservedAt          time.Time
	Outcome             Outcome
	Ready               bool
	ConsecutiveFailures uint
}

Summary reports one bounded host-poll outcome without operation or secret material.

type TerminalObservationReporter ¶

type TerminalObservationReporter interface {
	TerminalObservation(context.Context, sandboxhostprotocol.Envelope, string, time.Time) (*sandboxhostprotocol.Observation, error)
}

TerminalObservationReporter returns a bounded observation that the host itself recorded while executing one exact envelope. It is deliberately an optional, result-only seam: sandboxhostprocess does not manufacture resource, output-retention, or backend facts from an admitted request.

A reporter is called only after the executor has returned and only for the terminal result that will be signed. Returning nil records no observation. Reporters must return a complete protocol observation; the protocol signer rejects partial or out-of-contract values.

type Wait ¶

type Wait func(context.Context, time.Duration) error

Wait blocks using the composition owner's cancellable scheduling primitive.