worker

type Config struct {
	Pool         *pgxpool.Pool
	Executor     *kensa.Executor
	Writer       *transactionlog.Writer
	QueueKey     []byte // scheduler.DeriveQueueKey output
	PollInterval time.Duration
	Emit         EmitFunc

	// ScanResults, when non-nil, durably records every rule's outcome +
	// evidence for every scan (the /api/v1/scans audit memory). It is
	// written alongside Writer, never instead of it. nil disables the
	// durable write (legacy tests that only assert transaction-log
	// behavior leave it unset).
	ScanResults *scanresult.Writer

	// Bus, when non-nil, receives scan.completed events after outcomes
	// persist. The serve process passes its SSE bus; the dedicated
	// worker subcommand passes nil (its in-memory bus would have no
	// subscribers — cross-process delivery is a known non-goal).
	Bus *eventbus.Bus

	// Sched, when non-nil, receives PersistAfterScan after every
	// completed scan so host_compliance_schedule tracks the fresh
	// compliance state and next_scheduled_scan. Spec system-scheduler
	// v3.0.0: both scheduler-dispatched and on-demand scans update the
	// schedule on completion.
	Sched *scheduler.Service

	// RemediationProcessor, when non-nil, handles "remediation" job_type
	// rows this worker claims. queue.Dequeue is not type-filtered, so the
	// dedicated worker subcommand routes remediation jobs to it rather than
	// dead-lettering them. Spec api-remediation.
	RemediationProcessor *RemediationWorker

	// Regressions, when non-nil, projects each completed scan's
	// transaction-log regressions (a passing rule now fails) into a grouped
	// in-app notification. Best-effort: a projection error never fails the
	// scan. nil disables the in-app rule-regression bell (legacy tests, and
	// any boot path without the notification feed). Spec system-notifications.
	Regressions RegressionProjector

	// Drift, when non-nil, runs the compliance drift detector after every
	// completed scan's outcomes have committed and before ScanCompleted is
	// published. Production passes drift.NewService in both serve and the
	// worker subcommand. A detector error is logged and never fails the
	// scan. Spec system-drift-detector C-11, C-12.
	Drift DriftDetector

	// clock allows tests to inject a controllable time source.
	// Production passes time.Now.
	Clock func() time.Time
}

type CredentialBridge struct {
	// contains filtered or unexported fields
}

type DriftDetector interface {
	DetectForScan(ctx context.Context, hostID, scanID uuid.UUID) (drift.Report, error)
}

type EmitFunc func(ctx context.Context, code audit.Code, ev audit.Event)

type GovernanceNotifier interface {
	RemediationFailed(ctx context.Context, hostID uuid.UUID, ruleID, action, finalStatus string) error
}

type HostDiscoveryRunner interface {
	RunDiscovery(ctx context.Context, hostID uuid.UUID) error
}

type RegressionProjector interface {
	ProjectScan(ctx context.Context, scanID, hostID uuid.UUID) error
}

type RemediationConfig struct {
	Pool     *pgxpool.Pool
	Executor *kensa.Executor
	Service  *remediation.Service
	Writer   *transactionlog.Writer
	QueueKey []byte
	Bus      *eventbus.Bus
	Emit     EmitFunc
	Clock    func() time.Time

	// Governance, when non-nil, receives a notification when a remediation
	// reaches a terminal FAILURE (an execute that failed, or a rollback that
	// did not restore). A successful user-initiated rollback is the intended
	// outcome and is NOT notified. Spec system-notifications (Slice 3).
	Governance GovernanceNotifier
}

type RemediationPayload struct {
	RequestID uuid.UUID
	HostID    uuid.UUID
	RuleID    string
	Action    string    // execute | rollback
	TxnID     uuid.UUID // rollback only; uuid.Nil for execute
	// ActorID is the user who invoked :execute or :rollback, so the worker's
	// terminal audit event names the same person the HTTP layer's intent
	// event did. uuid.Nil means no user initiated this job (system work),
	// and the worker then records a system actor rather than inventing one.
	// Signed when present: a job cannot be re-attributed after enqueue.
	ActorID uuid.UUID
	// ActorType is the audit actor type of ActorID: "user" for a session,
	// "api_key" for an API token (the token's own id, never its owner).
	// Empty on a payload signed before the field existed; the worker reads
	// that as "user", which is what those jobs meant. Signed when present,
	// so a token's job cannot be relabeled as a person's. bugs/OW-100.
	ActorType string
}

type RemediationWorker struct {
	// contains filtered or unexported fields
}

type ReportRenderer interface {
	ProcessJob(ctx context.Context, j *queue.Job)
}

type ScanWorker struct {
	// contains filtered or unexported fields
}

type Worker struct {
	// contains filtered or unexported fields
}