selfheal

type Act string

type Actioner interface {
	Remediate(ctx context.Context, app monitor.App, service string, rung Rung) error
}

type Config struct {
	Store        *Store
	Alerts       *alertstore.Store // nil → pages are logged only (alerting disabled)
	Snap         func() *monitor.Snapshot
	Sem          *dockerexec.Semaphore
	Act          Actioner
	Policy       Policy                  // the built-in/global default
	PolicyFor    func(app string) Policy // per-app override (nil → always Policy); see spec.self_healing
	Log          *slog.Logger
	Interval     time.Duration
	FloorBytes   uint64          // memory-headroom floor (0 = gate disabled, e.g. no host metrics)
	WritePlaneOK bool            // the §0 write-plane gate result
	Protected    map[string]bool // project names that are the edge/control plane — never targets
	Now          func() int64    // injectable clock; defaults to time.Now().Unix
}

type Decision struct {
	Next   FSM    // the FSM to persist IF the action is taken (or is a no-op/page)
	Act    Act    // what the watcher should do
	Rung   Rung   // the rung to run when Act==ActRemediate
	Kind   string // the can't-fix taxonomy kind when Act==ActPage
	Reason string // human-readable, for the event/audit
}

type FSM struct {
	Phase           Phase
	UnhealthyStreak int   // consecutive failing ticks (anti-flap sustain)
	HealthyStreak   int   // consecutive healthy ticks (recovery stabilization)
	Attempts        int   // remediation attempts in the current window
	LastRung        Rung  // highest rung attempted this window
	BackoffUntil    int64 // unix sec; no remediation before this deadline
	WindowStart     int64 // unix sec; start of the current attempt window
	OOMStrikes      int   // consecutive OOM-classified failures
	DegradedSince   int64 // unix sec; first failing tick of the current episode
	Open            bool  // an infra alert is currently open for this service
}

type GateInput struct {
	Rung Rung

	// Gate 1 — §0 resource gate for the action's plane. WritePlaneOK is the global
	// ≥1 GB write-plane gate; RedeployEnabled gates the redeploy rung specifically.
	WritePlaneOK    bool
	RedeployEnabled bool

	// Gate 2 — the global one-docker-child semaphore. AcquireSemaphore is a
	// NON-BLOCKING TryAcquire supplied by the watcher; nil means "treat as busy".
	// When it returns true the caller now HOLDS the semaphore and must Release it.
	AcquireSemaphore func() bool

	// Gate 3 — memory-headroom floor. A restart momentarily runs old+new, so below
	// the floor we must not restart. HeadroomBytes is current free memory (host),
	// FloorBytes the configured minimum that must remain available.
	HeadroomBytes uint64
	FloorBytes    uint64

	// Gate 4 — edge protection. The edge slice and control plane are never targets.
	IsEdgeOrControlPlane bool
}

type GateOutcome string

type Key struct{ App, Service string }

type Observation struct {
	Running       bool
	Health        string // none|healthy|unhealthy|starting
	RestartCount  int
	OOMKilled     bool
	ExitCode      int
	WaitingOnEdge bool // a service still waiting on its edge-issued cert
	ExpectedDown  bool // a VALID write-plane lease is held for this app
}

type Phase string

type Policy struct {
	SustainTicks    int   // failing ticks before the first remediation (anti-flap)
	AttemptCap      int   // remediations per window before the circuit opens
	StabilizeTicks  int   // healthy ticks required to declare RECOVERED
	OOMStrikeCap    int   // OOM-classified failures before short-circuiting the ladder
	WindowSeconds   int64 // attempt-window length; attempts reset after it elapses
	BackoffBaseSecs int64 // exponential backoff base between attempts
	BackoffMaxSecs  int64 // backoff ceiling
	RedeployEnabled bool  // rung-3 redeploy (≥1 GB host AND operator opt-in)
}

type Rung string

type Store struct {
	// contains filtered or unexported fields
}

type Watcher struct {
	// contains filtered or unexported fields
}