registry

type AgentInfo struct {
	Version      string
	Capabilities []string
}

type AgentProcess struct {
	StartedAt   time.Time
	HeartbeatAt time.Time
}

type ClockSkew struct {
	// Offset is the agent's clock minus the control plane's in the latest
	// skewed report: negative when the agent is behind.
	Offset time.Duration
	// ObservedAt is when that report was received.
	ObservedAt time.Time
	// Current says the latest report received was skewed; false once a
	// report within tolerance has followed it.
	Current bool
}

type Heartbeat struct {
	DroppedFlowRecords uint64
	SourceOverruns     uint64
	RenewalError       string
	// OwnedTable is the owned table's state as the agent read it; an
	// unspecified state leaves the recorded one as it was.
	OwnedTable innerwallv1.OwnedTableState
	// Uptime is how long the agent process had run when it sent the
	// heartbeat, on its own monotonic clock. With the receipt instant it
	// places the process start on the control plane's clock.
	Uptime time.Duration
}

type Label struct {
	Key   string
	Value string
}

type LabelsVersionError struct {
	Current string
}

type LateRenewal struct {
	RenewedAt time.Time
	ExpiredAt time.Time
}

type ListeningService struct {
	Protocol    innerwallv1.Protocol
	Port        uint32
	ProcessName string
	ProcessPath string
}

type PresentedCredential struct {
	Serial    string
	ExpiresAt time.Time
}

type RetiredError struct {
	ID        identity.WorkloadID
	RetiredAt time.Time
}

type Store interface {
	ListWorkloads(ctx context.Context) ([]Workload, error)
	LookupWorkload(ctx context.Context, id identity.WorkloadID) (*Workload, error)
	ListListeningServices(ctx context.Context, id identity.WorkloadID) ([]ListeningService, error)

	// SetWorkloadLabels replaces the workload's labels.
	SetWorkloadLabels(ctx context.Context, id identity.WorkloadID, labels []Label) error
	// SetWorkloadMode changes the enforcement mode.
	SetWorkloadMode(ctx context.Context, id identity.WorkloadID, mode innerwallv1.EnforcementMode) error

	// RecordFacts stores host facts and refreshes last-seen. It reports
	// whether the set of addresses derived from the facts changed, which is
	// a render trigger because peers resolve to those addresses.
	RecordFacts(ctx context.Context, id identity.WorkloadID, facts *innerwallv1.HostFacts, now time.Time) (addressesChanged bool, err error)
	// RecordListeningServices replaces the workload's listening services.
	RecordListeningServices(ctx context.Context, id identity.WorkloadID, services []ListeningService, now time.Time) error
	// RecordAgent stores what a Hello said: agent info and the version the
	// agent claims to have applied; and the credential the stream opened
	// on, which a nil presented leaves as it was.
	RecordAgent(ctx context.Context, id identity.WorkloadID, agent AgentInfo, appliedVersion uint64, presented *PresentedCredential, now time.Time) error
	// RecordHeartbeat refreshes last-seen and what the heartbeat carries:
	// the loss counters, the renewal status, the owned table's state, and
	// the agent process it came from.
	RecordHeartbeat(ctx context.Context, id identity.WorkloadID, hb Heartbeat, now time.Time) error
	// SetSyncState records the convergence state with an optional detail.
	SetSyncState(ctx context.Context, id identity.WorkloadID, state innerwallv1.SyncState, detail string, now time.Time) error
	// RecordApplied stores an acknowledged version and the resulting
	// state, and stamps now as the last acknowledgement.
	RecordApplied(ctx context.Context, id identity.WorkloadID, version uint64, state innerwallv1.SyncState, now time.Time) error
	// RecordApplyFailed stores a failed apply: the degraded state and the
	// agent's detail, and stamps now as the last apply failure. The
	// applied version is untouched.
	RecordApplyFailed(ctx context.Context, id identity.WorkloadID, detail string, now time.Time) error
	// RecordSnapshotSent stamps the instant the sync path sent the
	// workload a snapshot. The sync path is its only caller.
	RecordSnapshotSent(ctx context.Context, id identity.WorkloadID, at time.Time) error
}

type Workload struct {
	ID                 identity.WorkloadID
	Hostname           string
	Labels             []Label
	Mode               innerwallv1.EnforcementMode
	Facts              *innerwallv1.HostFacts
	Addresses          []netip.Addr
	Agent              AgentInfo
	EnrolledAt         time.Time
	LastSeenAt         *time.Time
	SyncState          innerwallv1.SyncState
	AppliedVersion     uint64
	SyncError          string
	DroppedFlowRecords uint64
	// SourceOverruns is the kernel-side overruns of the agent's flow
	// sources since it started, as its heartbeat reported them.
	SourceOverruns uint64
	// CredentialRenewalError is the reason the agent's last automatic
	// renewal failed, as its heartbeat reported it; empty when healthy.
	CredentialRenewalError string
	// CredentialSerial and CredentialExpiresAt are the credential the
	// control plane last issued the workload.
	CredentialSerial    string
	CredentialExpiresAt time.Time
	// PresentedCredential is the credential the workload's most recent
	// sync stream opened on; nil when no stream has opened since the
	// control plane began recording it. A stream ending leaves it, so it
	// is the credential in use only while SyncState says a stream is
	// open; after a renewal the live stream keeps the one renewal
	// replaced until its end. Written at stream open alone.
	PresentedCredential *PresentedCredential
	// LateRenewal is the latest renewal made with an already-expired
	// credential, within the renewal grace; nil when the workload has
	// never renewed late. Written by renewal alone (ADR-0016 as amended).
	LateRenewal *LateRenewal
	// LastSnapshotSentAt is when the sync path last sent this workload a
	// snapshot, whatever caused it; nil when none has been recorded. It
	// is a record of what the control plane did, written by the sync
	// path alone.
	LastSnapshotSentAt *time.Time
	// LastAckedAt is when the agent last acknowledged an applied
	// version; nil when none has been recorded. The version a Hello
	// claims is not an acknowledgement.
	LastAckedAt *time.Time
	// LastApplyFailedAt is when the agent last reported a failed apply;
	// nil when none has been recorded. A later successful apply leaves
	// it: SyncState says whether the workload is still degraded.
	LastApplyFailedAt *time.Time
	// ClockSkew is the latest flow report whose agent clock was beyond
	// the tolerance; nil when none has been received. Written by flow
	// ingest alone.
	ClockSkew *ClockSkew
	// OwnedTable is whether the agent's owned firewall table is in the
	// kernel, as its heartbeats last said: unspecified until a heartbeat
	// that knows has arrived. OwnedTableAbsentSince is when the control
	// plane first heard it was absent, nil unless it is.
	OwnedTable            innerwallv1.OwnedTableState
	OwnedTableAbsentSince *time.Time
	// LastFlowReportAt is when the control plane last received a flow
	// report from the agent; nil when none has been. Flow reports travel
	// on a connection of their own (ADR-0015), so this can move while the
	// sync stream is down. Written by flow ingest alone.
	LastFlowReportAt *time.Time
	// RetiredAt is when the operator retired the workload; nil while it
	// is active. Retirement is one way: the row is kept so history keeps
	// naming the identity, and nothing that acts on the present (a
	// render, a selector, ingest's peer resolution) sees it (ADR-0023).
	RetiredAt *time.Time
}