Documentation
¶
Index ¶
- Variables
- func ExpectedReplaySecretRefMap(refs []models.TaskExecutionSecretRef) (map[string]models.TaskExecutionSecretRef, error)
- func ReplayDescriptorIdentityString(ref models.TaskExecutionSecretRef, key string) string
- func ReplaySecretHasRequiredDiscriminator(ref models.TaskExecutionSecretRef) bool
- func ReplaySecretIdentityFromDescriptor(ref models.TaskExecutionSecretRef) secret.Identity
- func ReplaySecretIdentityMap(identity secret.Identity) datatypes.JSONMap
- func ReplaySecretIdentityMatches(ref models.TaskExecutionSecretRef, identity secret.Identity) bool
- func ReplaySecretRefKey(envKey, ref string) string
- func ReplaySecretRequiresPinnedVaultVerification(ref models.TaskExecutionSecretRef) bool
- func VerifyReplaySecretIdentities(ctx context.Context, resolver secret.Resolver, ...) error
- func VerifyResolvedReplaySecretIdentity(ctx context.Context, resolver secret.Resolver, ...) error
- type Constructor
- type DispatchFunc
- type Dispatcher
- type Option
- type PreparedReplay
- type Request
- type Result
- type TaskDecision
Constants ¶
This section is empty.
Variables ¶
var ( ErrDispatchRequired = errors.New("replay: dispatcher is required") ErrBaselineNotTerminal = errors.New("replay: baseline run is not terminal") ErrMissingDescriptor = errors.New("replay: missing baseline execution descriptor") ErrUnsupportedDescriptor = errors.New("replay: unsupported baseline execution descriptor") ErrReplayUnsafe = errors.New("replay: baseline task is not replay safe") ErrSecretIdentity = errors.New("replay: baseline secret identity cannot be verified") ErrQuarantinedBaseline = errors.New("replay: baseline run is quarantined") // ErrFannedBaseline is the fail-closed refusal of a baseline whose fan-out // groups cannot be reconstructed. It no longer means "the baseline is // fanned": replay re-expands a group from the partition list frozen on its // producer's descriptor, so this fires only when that list is absent (a // baseline recorded before descriptors captured it), disagrees with the // instances the baseline actually materialized, or is not a valid group. ErrFannedBaseline = errors.New("replay: fan-out group cannot be re-expanded from the recorded baseline") )
Functions ¶
func ExpectedReplaySecretRefMap ¶
func ExpectedReplaySecretRefMap(refs []models.TaskExecutionSecretRef) (map[string]models.TaskExecutionSecretRef, error)
ExpectedReplaySecretRefMap keys descriptor secret refs by env key and ref.
func ReplayDescriptorIdentityString ¶
func ReplayDescriptorIdentityString(ref models.TaskExecutionSecretRef, key string) string
ReplayDescriptorIdentityString returns a trimmed string identity field from a descriptor ref.
func ReplaySecretHasRequiredDiscriminator ¶
func ReplaySecretHasRequiredDiscriminator(ref models.TaskExecutionSecretRef) bool
ReplaySecretHasRequiredDiscriminator confirms a descriptor ref has enough provider-specific identity material to fail closed on mismatch.
func ReplaySecretIdentityFromDescriptor ¶
func ReplaySecretIdentityFromDescriptor(ref models.TaskExecutionSecretRef) secret.Identity
ReplaySecretIdentityFromDescriptor converts a descriptor secret ref back to the captured identity shape used for verification.
func ReplaySecretIdentityMap ¶
ReplaySecretIdentityMap returns the descriptor-comparable fields for an identity.
func ReplaySecretIdentityMatches ¶
func ReplaySecretIdentityMatches(ref models.TaskExecutionSecretRef, identity secret.Identity) bool
ReplaySecretIdentityMatches compares a descriptor ref's recorded identity fields with a resolved or verified identity.
func ReplaySecretRefKey ¶
ReplaySecretRefKey returns the canonical map key for an env secret ref.
func ReplaySecretRequiresPinnedVaultVerification ¶
func ReplaySecretRequiresPinnedVaultVerification(ref models.TaskExecutionSecretRef) bool
ReplaySecretRequiresPinnedVaultVerification reports whether a descriptor ref carries the Vault version and HMAC key needed for baseline identity pinning.
func VerifyReplaySecretIdentities ¶
func VerifyReplaySecretIdentities(ctx context.Context, resolver secret.Resolver, expected []models.TaskExecutionSecretRef, actual []jobdefruntime.ResolvedSecretIdentity, resolvedEnv map[string]string) error
VerifyReplaySecretIdentities verifies descriptor-captured replay secret identities against the identities and values resolved for a quarantined task.
func VerifyResolvedReplaySecretIdentity ¶
func VerifyResolvedReplaySecretIdentity(ctx context.Context, resolver secret.Resolver, ref models.TaskExecutionSecretRef, resolvedValue string, identity secret.Identity) error
VerifyResolvedReplaySecretIdentity verifies one descriptor secret identity against the value and identity returned by the resolver.
Types ¶
type Constructor ¶
type Constructor struct {
// contains filtered or unexported fields
}
func New ¶
func New(store *run.Store, dispatcher Dispatcher, opts ...Option) *Constructor
func (*Constructor) Materialize ¶
func (c *Constructor) Materialize(ctx context.Context, prepared *PreparedReplay) (*Result, error)
Materialize commits a prepared replay run and dispatches pending replay work.
func (*Constructor) Prepare ¶
func (c *Constructor) Prepare(ctx context.Context, req Request) (*PreparedReplay, error)
Prepare validates the baseline and computes replay task decisions without inserting the replay run. Callers may inspect the plan before materialization.
type DispatchFunc ¶
func (DispatchFunc) DispatchReplay ¶
type Dispatcher ¶
Dispatcher is the narrow B3 seam B4/B5 use to hand a durable replay run to the already-running execution machinery.
type PreparedReplay ¶
type PreparedReplay struct {
// contains filtered or unexported fields
}
PreparedReplay is a validated replay plan that has not yet been materialized.
func (*PreparedReplay) RequiresDispatch ¶
func (p *PreparedReplay) RequiresDispatch() bool
RequiresDispatch reports whether this replay has tasks that must re-execute.
type Result ¶
type Result struct {
Run *run.JobRun
Decisions []TaskDecision
}
type TaskDecision ¶
type TaskDecision struct {
TaskID uuid.UUID
TaskName string
Partition string
BaselineHash string
ReplayHash string
CacheHit bool
Reexecute bool
}
TaskDecision is one planned row's outcome. A fanned group contributes ONE decision per instance, all sharing a TaskID — Partition is what tells them apart, and it is empty for an ordinary task.