Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Control ¶
type Control struct {
Field string `json:"field"`
Requested string `json:"requested"`
Observed string `json:"observed,omitempty"`
Outcome string `json:"outcome"`
Source string `json:"source"`
}
Control reports allowlisted metadata, never raw engine or process output.
type ExecutionConfig ¶
type ExecutionConfig struct {
Mode string `yaml:"mode" json:"mode"`
UID *uint32 `yaml:"uid,omitempty" json:"uid,omitempty"`
GID *uint32 `yaml:"gid,omitempty" json:"gid,omitempty"`
NoNewPrivileges *bool `yaml:"no_new_privileges,omitempty" json:"no_new_privileges,omitempty"`
ReadOnly *bool `yaml:"read_only,omitempty" json:"read_only,omitempty"`
DropCapabilities *[]string `yaml:"drop_capabilities,omitempty" json:"drop_capabilities,omitempty"`
MemoryBytes *int64 `yaml:"memory_bytes,omitempty" json:"memory_bytes,omitempty"`
CPUMillis *int64 `yaml:"cpu_millis,omitempty" json:"cpu_millis,omitempty"`
PIDs *int64 `yaml:"pids,omitempty" json:"pids,omitempty"`
Network string `yaml:"network,omitempty" json:"network,omitempty"`
Seccomp string `yaml:"seccomp,omitempty" json:"seccomp,omitempty"`
Tmpfs *[]ExecutionTmpfs `yaml:"tmpfs,omitempty" json:"tmpfs,omitempty"`
Mounts *[]ExecutionMount `yaml:"mounts,omitempty" json:"mounts,omitempty"`
Inherit *[]string `yaml:"inherit,omitempty" json:"inherit,omitempty"`
Lookup string `yaml:"lookup,omitempty" json:"lookup,omitempty"`
}
ExecutionConfig opts a managed MCP workload into explicit execution controls. Pointer collections retain the difference between omission and an empty list.
func (*ExecutionConfig) UnmarshalJSON ¶
func (e *ExecutionConfig) UnmarshalJSON(data []byte) error
UnmarshalJSON applies the same closed-block contract to API input.
func (*ExecutionConfig) UnmarshalYAML ¶
func (e *ExecutionConfig) UnmarshalYAML(node *yaml.Node) error
UnmarshalYAML limits strict decoding to the new execution block.
type ExecutionContract ¶
type ExecutionContract struct {
Transport, NetworkName string
Port int
Mode string
UID, GID uint32
NoNewPrivileges, ReadOnly bool
DropCapabilities []string
MemoryBytes, CPUMillis, PIDs int64
Network, Seccomp string
Tmpfs []ExecutionTmpfs
Mounts []ExecutionMount
Inherit *[]string
Lookup string
Revision string
}
ExecutionContract is normalized desired configuration, not enforcement evidence. It contains private mount sources and must not be used as a reporting payload.
func ResolveExecution ¶
func ResolveExecution(server Server) (*ExecutionContract, error)
ResolveExecution validates and normalizes an opt-in execution declaration. Omission returns nil and retains compatibility behavior.
type ExecutionMount ¶
type ExecutionMount struct {
Source string `yaml:"source" json:"source"`
Target string `yaml:"target" json:"target"`
ReadOnly *bool `yaml:"read_only,omitempty" json:"read_only,omitempty"`
}
ExecutionMount declares data access. Source paths are configuration, not status.
type ExecutionTmpfs ¶
type ExecutionTmpfs struct {
Target string `yaml:"target" json:"target"`
SizeBytes int64 `yaml:"size_bytes" json:"size_bytes"`
}
ExecutionTmpfs declares bounded writable scratch, never executable code.
type Report ¶
type Report struct {
EndpointPort int `json:"endpoint_port,omitempty"`
Mode string `json:"mode"`
Revision string `json:"revision"`
Instance string `json:"instance"`
Outcome string `json:"outcome"`
Eligible bool `json:"eligible"`
ObservedAt time.Time `json:"observed_at"`
Runtime string `json:"runtime"`
RuntimeContext string `json:"runtime_context,omitempty"`
DaemonRootless string `json:"daemon_rootless"`
UserNamespace string `json:"user_namespace"`
Controls []Control `json:"controls"`
}
Report is a launch/admission snapshot, not a continuous protection claim.
func RequestedReport ¶
func RequestedReport(c *ExecutionContract) *Report
RequestedReport returns value-free desired settings with no runtime eligibility.
Source Files