enforcement

type CheckObservation ¶

type CheckObservation struct {
	Outcome     antiflockv1.CheckOutcome
	ReasonCode  string
	SafeMessage string
	Evidence    []*antiflockv1.EvidenceReference
}

CheckObservation is supplied by a local deterministic check implementation. The enforcer validates its evidence before a required pass can commit.

type Config ¶

type Config struct {
	DeploymentID       string
	NodeID             string
	PlanKeyID          string
	PlanPublicKey      ed25519.PublicKey
	NodeKeyID          string
	NodePrivateKey     ed25519.PrivateKey
	Capabilities       *antiflockv1.CapabilityManifest
	Driver             Driver
	StateStore         StateStore
	Clock              func() time.Time
	MaximumEvidenceAge time.Duration
	RollbackTimeout    time.Duration
}

type Driver ¶

type Driver interface {
	Check(context.Context, *antiflockv1.PlanCheck) (CheckObservation, error)
	Apply(context.Context, *antiflockv1.PlanOperation) (OperationObservation, error)
	Rollback(context.Context, *antiflockv1.PlanOperation) (OperationObservation, error)
}

Driver is the only mutation boundary. Tests and simulations should provide an in-memory implementation; production implementations belong in isolated, least-privilege platform adapters.

type Enforcer ¶

type Enforcer struct {
	// contains filtered or unexported fields
}

func New(config Config) (*Enforcer, error)

func (enforcer *Enforcer) Apply(ctx context.Context, input *antiflockv1.Plan) (*antiflockv1.PlanExecutionResult, error)

type FileStateStore ¶

type FileStateStore struct {
	// contains filtered or unexported fields
}

FileStateStore is the Linux durable replay boundary for plan execution. It uses an OS lock across processes and atomically persists every reservation before any driver mutation. An interrupted in-progress reservation remains fail-closed and requires operator recovery; it is never silently retried.

func NewFileStateStore(directory string) (*FileStateStore, error)

func (store *FileStateStore) Complete(ctx context.Context, result *antiflockv1.PlanExecutionResult) error

func (store *FileStateStore) Reserve(ctx context.Context, reservation Reservation) (*antiflockv1.PlanExecutionResult, error)

func (store *FileStateStore) Revisions(ctx context.Context) (uint64, uint64, error)

type MemoryStateStore ¶

type MemoryStateStore struct {
	// contains filtered or unexported fields
}

func NewMemoryStateStore(lastPolicyRevision, lastPlanRevision uint64) *MemoryStateStore

func (store *MemoryStateStore) Complete(ctx context.Context, result *antiflockv1.PlanExecutionResult) error

func (store *MemoryStateStore) Reserve(ctx context.Context, reservation Reservation) (*antiflockv1.PlanExecutionResult, error)

func (store *MemoryStateStore) Revisions() (uint64, uint64)

type NftablesAdapter ¶

type NftablesAdapter struct {
	// contains filtered or unexported fields
}

NftablesAdapter renders an isolated fail-closed output table. It never flushes or replaces an existing table. Rollback deletes only a table that this adapter instance successfully created.

func NewNftablesAdapter(runner NftablesRunner, config NftablesConfig) (*NftablesAdapter, error)

func (adapter *NftablesAdapter) Apply(ctx context.Context, operation *antiflockv1.PlanOperation) (OperationObservation, error)

func (adapter *NftablesAdapter) DryRunApply(operation *antiflockv1.PlanOperation) (NftablesCommand, error)

func (adapter *NftablesAdapter) DryRunRollback(operation *antiflockv1.PlanOperation) (NftablesCommand, error)

func (adapter *NftablesAdapter) Rollback(ctx context.Context, operation *antiflockv1.PlanOperation) (OperationObservation, error)

type NftablesCommand ¶

type NftablesCommand struct {
	Executable string   `json:"executable"`
	Arguments  []string `json:"arguments"`
	Input      string   `json:"input"`
}

NftablesCommand is a reviewable, shell-free dry run. Arguments and input are passed separately to the executor.

type NftablesConfig ¶

type NftablesConfig struct {
	Executable  string
	TableName   string
	EnableApply bool
}

type NftablesExecRunner ¶

type NftablesExecRunner struct{}

NftablesExecRunner invokes exactly a trusted system nft binary with -f -. It discards command output so provider or host details cannot be copied into safe API messages.

func (NftablesExecRunner) Run(ctx context.Context, executable string, arguments []string, input []byte) error

type NftablesRunner ¶

type NftablesRunner interface {
	Run(context.Context, string, []string, []byte) error
}

NftablesRunner is the explicit privileged-process boundary. Implementations receive a prevalidated nft batch on stdin and must never invoke a shell.

type OperationObservation ¶

type OperationObservation struct {
	Succeeded   bool
	ReasonCode  string
	SafeMessage string
}

OperationObservation contains no raw command output. A Driver must sanitize provider and operating-system errors before setting SafeMessage.

type Reservation ¶

type Reservation struct {
	PlanID         string
	Fingerprint    string
	PolicyRevision uint64
	PlanRevision   uint64
}

Reservation is the replay-safe identity of executable plan content.

type StateStore ¶

type StateStore interface {
	Reserve(context.Context, Reservation) (*antiflockv1.PlanExecutionResult, error)
	Complete(context.Context, *antiflockv1.PlanExecutionResult) error
}

StateStore atomically reserves a monotonic plan before mutation and records its terminal signed result. MemoryStateStore is only for tests and simulation; Linux enforcement should use FileStateStore so replay defense survives restart.