Documentation
¶
Overview ¶
Package admission evaluates deterministic pre-scheduling requirements.
Index ¶
- Constants
- func WithNamespaceEnforcer(enforcer *namespace.Enforcer) func(*Controller)
- func WithParallelism(workers int) func(*Controller)
- func WithShard(index, count int) func(*Controller)
- func WithTenantQuotas(quotaStore store.TenantQuotaStore) func(*Controller)
- type Controller
- type Decision
- type Engine
- type Limits
Constants ¶
const EvaluatorVersion = "builtin/v1"
Variables ¶
This section is empty.
Functions ¶
func WithNamespaceEnforcer ¶
func WithNamespaceEnforcer(enforcer *namespace.Enforcer) func(*Controller)
WithNamespaceEnforcer installs the namespace and per-namespace resource quota gate.
func WithParallelism ¶
func WithParallelism(workers int) func(*Controller)
WithParallelism bounds concurrent per-task processing within one reconcile batch (default 4; 1 = serial).
func WithShard ¶
func WithShard(index, count int) func(*Controller)
WithShard confines this instance to one tenant-consistent claim shard (ADR-016): it claims only tasks whose tenant maps to index of count. Count 0 disables sharding. Every controller instance must share the same count.
func WithTenantQuotas ¶
func WithTenantQuotas(quotaStore store.TenantQuotaStore) func(*Controller)
WithTenantQuotas installs the tenant aggregate consumption quota gate (v0.6): a task is admitted only while the tenant's current window usage plus the task's own budget ceiling stays within every configured limit. The store re-checks the same gate atomically at commit time, so concurrent settlements cannot slip past the read-only check here.
Types ¶
type Controller ¶
type Controller struct {
// contains filtered or unexported fields
}
func NewController ¶
func NewController(repository store.ControlStore, engine *Engine, policyEngine *policy.Engine, ownerID string, batch int, claimTTL time.Duration) *Controller
type Decision ¶
type Decision struct {
Admit bool
ReasonCode string
Reasons []store.AdmissionReason
}
type Limits ¶
type Limits struct {
RuntimeClasses []string
MaxTokens int64
MaxCostMicroUSD money.MicroUSD
MaxToolCalls int64
MaxWallSeconds int64
MaxCPU int64
MaxMemory int64
MaxLLMConcurrency int
// ContainerClasses are runtime classes that execute untrusted workloads
// in a sandboxed container (oci, microvm). Admission requires every
// task on these classes to declare explicit CPU, memory and workspace
// limits — zero values are never allowed (hardening checklist §4.1).
ContainerClasses []string
}
Source Files