providercli

package
v0.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 29, 2026 License: MIT Imports: 22 Imported by: 0

Documentation

Overview

Package providercli implements opt-in direct CLI review providers.

Index

Constants

View Source 
const (
	FamilyKimi  = "kimi"
	FamilyZcode = "zcode"
	FamilyAgy   = "agy"
)

Variables

This section is empty.

Functions

func NamespaceFromConstructionError 

func NamespaceFromConstructionError(err error) (*namespaceLease, bool)

NamespaceFromConstructionError returns the retained cleanup owner. The owner must be retried with RetryConstructionCleanup before it is discarded.

func NewCredentialProjectingNamespaceFactory 

func NewCredentialProjectingNamespaceFactory(ports.ProviderNamespaceFactory, string, map[string]CredentialSourceFamily) (ports.ProviderNamespaceFactory, error)

NewCredentialProjectingNamespaceFactory fails closed where descriptor-based nofollow traversal is not implemented.

func NewCredentialProjectingNamespaceFactoryWithConfiguredSourceRoots 

func NewCredentialProjectingNamespaceFactoryWithConfiguredSourceRoots(ports.ProviderNamespaceFactory, string, map[string]CredentialSourceFamily, map[string]RuntimeSafetyPolicy, map[string]string, map[string]string) (ports.ProviderNamespaceFactory, error)

func NewCredentialProjectingNamespaceFactoryWithPolicies 

func NewCredentialProjectingNamespaceFactoryWithPolicies(ports.ProviderNamespaceFactory, string, map[string]CredentialSourceFamily, map[string]RuntimeSafetyPolicy) (ports.ProviderNamespaceFactory, error)

NewCredentialProjectingNamespaceFactoryWithPolicies fails closed where descriptor-based nofollow traversal is not implemented.

func NewCredentialProjectingNamespaceFactoryWithPoliciesAndNativeHomes 

func NewCredentialProjectingNamespaceFactoryWithPoliciesAndNativeHomes(ports.ProviderNamespaceFactory, string, map[string]CredentialSourceFamily, map[string]RuntimeSafetyPolicy, map[string]string) (ports.ProviderNamespaceFactory, error)

NewCredentialProjectingNamespaceFactoryWithPoliciesAndNativeHomes fails closed where descriptor-based nofollow traversal is not implemented.

func VersionAtLeast 

func VersionAtLeast(value string, wantMajor, wantMinor, wantPatch int) bool

VersionAtLeast compares validated semantic versions, including prerelease precedence.

Types

type AGYExecutionPolicy 

type AGYExecutionPolicy struct {
	// contains filtered or unexported fields
}

AGYExecutionPolicy is the exact, immutable description of one native AGY qualification execution. Mulgae receives no native-HOME mutation capability: the typed authority supplies only identity-checked launch context. The child provider retains its normal installed-user authentication behavior, so this policy deliberately does not claim that AGY itself cannot refresh auth state.

func NewAGYExecutionPolicy 

func NewAGYExecutionPolicy(definition RuntimeDefinition, snapshot ports.WorkspaceSnapshotIdentity, argv []string, nativeReference string) (AGYExecutionPolicy, error)

NewAGYExecutionPolicy binds the only native AGY prompt-file execution shape to the exact descriptor-backed snapshot.

func (AGYExecutionPolicy) Argv 

func (policy AGYExecutionPolicy) Argv() []string

func (AGYExecutionPolicy) ArgvSHA256 

func (policy AGYExecutionPolicy) ArgvSHA256() string

func (AGYExecutionPolicy) Identity 

func (policy AGYExecutionPolicy) Identity() string

func (AGYExecutionPolicy) NativeReference 

func (policy AGYExecutionPolicy) NativeReference() string

func (AGYExecutionPolicy) SnapshotIdentity 

func (policy AGYExecutionPolicy) SnapshotIdentity() ports.WorkspaceSnapshotIdentity

func (AGYExecutionPolicy) Validate 

func (policy AGYExecutionPolicy) Validate() error

type CredentialSourceFamily 

type CredentialSourceFamily string

CredentialSourceFamily is the closed set of provider credential layouts. 

const (
	CredentialSourceKimi  CredentialSourceFamily = "kimi"
	CredentialSourceZCode CredentialSourceFamily = "zcode"
	CredentialSourceAGY   CredentialSourceFamily = "agy"
)

type CurrentProbe 

type CurrentProbe struct {
	// contains filtered or unexported fields
}

CurrentProbe performs current version and capability qualification.

func NewCurrentProbe 

func NewCurrentProbe(runner ports.ProcessRunner, verifier SpawnVerifier) (*CurrentProbe, error)

func (*CurrentProbe) QualifyCurrent 

func (probe *CurrentProbe) QualifyCurrent(ctx context.Context, request CurrentProbeRequest) (CurrentProbeResult, error)

type CurrentProbeDirectExecutionAuthorityReceipt 

type CurrentProbeDirectExecutionAuthorityReceipt struct {
	// contains filtered or unexported fields
}

CurrentProbeDirectExecutionAuthorityReceipt is descriptor-bound execution authority for the complete current-probe role set. It is minted only after every role has succeeded and its post-execution fixture, transport, and lifecycle evidence has been revalidated.

func (CurrentProbeDirectExecutionAuthorityReceipt) AGYControlAuthorityID 

func (receipt CurrentProbeDirectExecutionAuthorityReceipt) AGYControlAuthorityID() (string, bool)

func (CurrentProbeDirectExecutionAuthorityReceipt) AuthorityID 

func (receipt CurrentProbeDirectExecutionAuthorityReceipt) AuthorityID() string

func (CurrentProbeDirectExecutionAuthorityReceipt) ExpiresAt 

func (receipt CurrentProbeDirectExecutionAuthorityReceipt) ExpiresAt() time.Time

func (CurrentProbeDirectExecutionAuthorityReceipt) Matches 

func (receipt CurrentProbeDirectExecutionAuthorityReceipt) Matches(candidate ports.ProviderRuntimeDefinition, observedVersion, namespaceGeneration string, roles []domain.Role) bool

Matches reports whether this receipt is valid for one exact runtime definition, observed version, namespace generation, and unique role set.

func (CurrentProbeDirectExecutionAuthorityReceipt) Valid 

func (receipt CurrentProbeDirectExecutionAuthorityReceipt) Valid() bool

type CurrentProbeReceipt 

type CurrentProbeReceipt struct {
	Kind                     string
	EvidenceID               string
	ExpiresAt                time.Time
	DirectExecutionAuthority *CurrentProbeDirectExecutionAuthorityReceipt
}

type CurrentProbeRequest 

type CurrentProbeRequest struct {
	Definition   RuntimeDefinition
	Namespace    QualificationNamespace
	Fixture      ProbeFixtureLease
	RoleFixtures []ProbeFixtureLease
	Invocation   SafeProbeInvocation
	Now          time.Time
	TTL          time.Duration
}

type CurrentProbeResult 

type CurrentProbeResult struct {
	VersionArgv []string
	Version     string
	Receipts    []CurrentProbeReceipt
}

type KimiLoginAuthenticator 

type KimiLoginAuthenticator struct {
	// contains filtered or unexported fields
}

KimiLoginAuthenticator runs Kimi's native browser/device login against the configured native data home. Qualification namespaces remain isolated and receive the refreshed credentials only when a new registry is constructed.

func NewKimiLoginAuthenticator 

func NewKimiLoginAuthenticator(runner ports.ProcessRunner, verifier SpawnVerifier, nativeHome, dataHome string) (*KimiLoginAuthenticator, error)

func (*KimiLoginAuthenticator) LoginProvider 

func (authenticator *KimiLoginAuthenticator) LoginProvider(ctx context.Context, definition ports.ProviderRuntimeDefinition) error

type NamespaceConstructionError 

type NamespaceConstructionError struct {
	// contains filtered or unexported fields
}

NamespaceConstructionError retains the descriptor-owning lease when a namespace could not be handed to its caller and its rollback was incomplete.

func (*NamespaceConstructionError) Error 

func (err *NamespaceConstructionError) Error() string

func (*NamespaceConstructionError) Unwrap 

func (err *NamespaceConstructionError) Unwrap() error

type NamespaceFactory 

type NamespaceFactory struct {
	// contains filtered or unexported fields
}

NamespaceFactory allocates private, per-instance process namespaces beneath one caller-selected private root. It never consults the host environment.

func NewNamespaceFactory 

func NewNamespaceFactory(root string) (*NamespaceFactory, error)

NewNamespaceFactory constructs a namespace authority rooted at root. Root is created with owner-only permissions when absent. An existing root may be readable, but must be a real directory that no non-owner can modify.

func (*NamespaceFactory) AcquireProviderNamespace 

func (factory *NamespaceFactory) AcquireProviderNamespace(ctx context.Context, instance string) (ports.ProviderNamespaceLease, error)

AcquireProviderNamespace creates one generation for exactly one provider instance. Registries retain the returned lease for their complete lifetime.

type NativeProbeInvocation 

type NativeProbeInvocation struct{}

NativeProbeInvocation builds the sole family-policy probe argv. Approved permission bypasses are emitted only by their owning family policy.

func (NativeProbeInvocation) CapabilityArgv 

func (NativeProbeInvocation) CapabilityArgv(definition RuntimeDefinition, fixture ProbeFixture) ([]string, error)

func (NativeProbeInvocation) Validate 

func (NativeProbeInvocation) Validate(definition RuntimeDefinition, fixture ProbeFixture, argv []string) error

func (NativeProbeInvocation) VersionArgv 

func (NativeProbeInvocation) VersionArgv(definition RuntimeDefinition) ([]string, error)

VersionArgv builds the sole family-closed argv admitted for a version probe.

type ProbeFixture 

type ProbeFixture interface {
	Reference() string
	Nonce() string
	Link() string
	Packet() []byte
	WorkspaceSnapshotIdentity() ports.WorkspaceSnapshotIdentity
	Validate() error
}

ProbeFixture is the immutable native-reference evidence and snapshot identity expected from one role-bound qualification fixture.

type ProbeFixtureLease 

type ProbeFixtureLease interface {
	ProbeFixture
	Workspace() ProbeWorkspace
	Packet() []byte
	PacketSHA256() string
	Role() domain.Role
	RevalidateForExecution() (ports.WorkspaceExecutionGuard, error)
	DrainTerminal(context.Context) (ports.QualificationWorkspaceTerminalReceipt, error)
}

ProbeFixtureLease binds immutable fixture data to one ephemeral qualification workspace. It exposes bytes captured for the provider, never ambient files.

type ProbeFixtureLeaseFactory 

type ProbeFixtureLeaseFactory struct {
	// contains filtered or unexported fields
}

ProbeFixtureLeaseFactory creates one independently materialized fixture per qualification acquisition.

func NewProbeFixtureLeaseFactory 

func NewProbeFixtureLeaseFactory(workspaces ports.QualificationWorkspaceLeaseFactory, nonces ProbeNonceGenerator) (*ProbeFixtureLeaseFactory, error)

NewProbeFixtureLeaseFactory constructs the dedicated fixture authority.

func (*ProbeFixtureLeaseFactory) Acquire 

func (factory *ProbeFixtureLeaseFactory) Acquire(ctx context.Context, role domain.Role) (ProbeFixtureLease, error)

Acquire materializes an exact, role-bound fixture set. The packet is the roadmap bytes and its identity is the SHA-256 identity of those exact bytes.

type ProbeNonceGenerator 

type ProbeNonceGenerator interface {
	NewProbeNonce() (string, error)
}

ProbeNonceGenerator supplies a fresh cryptographically secure nonce for each fixture acquisition. Implementations must never return a reused nonce.

type ProbeWorkspace 

type ProbeWorkspace interface {
	ports.WorkspaceExecutionAuthority
	DrainTerminal(context.Context) (ports.QualificationWorkspaceTerminalReceipt, error)
}

ProbeWorkspace is the only materialized-workspace authority exposed by a probe fixture. It deliberately does not expose a filesystem path.

type QualificationFixtureFactoryAdapter 

type QualificationFixtureFactoryAdapter struct {
	// contains filtered or unexported fields
}

QualificationFixtureFactoryAdapter narrows adapter fixture leases to the application-visible fixture port.

func NewQualificationFixtureFactoryAdapter 

func NewQualificationFixtureFactoryAdapter(factory *ProbeFixtureLeaseFactory) (*QualificationFixtureFactoryAdapter, error)

func (*QualificationFixtureFactoryAdapter) Acquire 

func (adapter *QualificationFixtureFactoryAdapter) Acquire(ctx context.Context, role domain.Role) (ports.ProviderQualificationFixtureLease, error)

type QualificationNamespace 

type QualificationNamespace = ports.ProviderQualificationNamespace

QualificationNamespace is the retained provider namespace authority. Workspace authority belongs exclusively to the ProbeFixtureLease used for each spawn.

type QualificationProbeAdapter 

type QualificationProbeAdapter struct {
	// contains filtered or unexported fields
}

QualificationProbeAdapter binds the adapter-owned safe invocation strategy and translates current probe evidence into the neutral ports contract.

func NewQualificationProbeAdapter 

func NewQualificationProbeAdapter(probe *CurrentProbe, invocation SafeProbeInvocation) (*QualificationProbeAdapter, error)

func (*QualificationProbeAdapter) QualifyProviderCurrent 

func (adapter *QualificationProbeAdapter) QualifyProviderCurrent(ctx context.Context, request ports.ProviderCurrentProbeRequest) (ports.ProviderCurrentProbeResult, error)

type QualificationRegistryFactory 

type QualificationRegistryFactory struct {
	// contains filtered or unexported fields
}

QualificationRegistryFactory translates neutral runtime definitions into a retained providercli production registry.

func NewQualificationRegistryFactory 

func NewQualificationRegistryFactory(runner ports.ProcessRunner, namespaces ports.ProviderNamespaceFactory, verifier SpawnVerifier, verifierFactory func(context.Context) (SpawnVerifier, error)) (*QualificationRegistryFactory, error)

func (*QualificationRegistryFactory) NewProviderQualificationRegistry 

func (factory *QualificationRegistryFactory) NewProviderQualificationRegistry(ctx context.Context, definitions []ports.ProviderRuntimeDefinition) (ports.ProviderQualificationRegistry, error)

func (*QualificationRegistryFactory) RegistryFromConstructionError 

func (*QualificationRegistryFactory) RegistryFromConstructionError(err error) (ports.ProviderQualificationRegistry, bool)

type Registry 

type Registry struct {
	// contains filtered or unexported fields
}

Registry is an immutable, concurrent-safe opt-in set of provider capability profiles.

func NewProductionRegistry 

func NewProductionRegistry(
	runner ports.ProcessRunner, factory ports.ProviderNamespaceFactory, verifier SpawnVerifier,
	profiles ...RuntimeDefinition,
) (*Registry, error)

NewProductionRegistry constructs a registry that cannot run without workspace authority and descriptor-bound spawn verification.

func NewProductionRegistryWithContext 

func NewProductionRegistryWithContext(
	ctx context.Context, runner ports.ProcessRunner, factory ports.ProviderNamespaceFactory, verifier SpawnVerifier,
	profiles ...RuntimeDefinition,
) (*Registry, error)

NewProductionRegistryWithContext constructs a production registry using the caller's bounded context for namespace acquisition and cleanup.

func NewRegistry 

func NewRegistry(runner ports.ProcessRunner, profiles ...RuntimeDefinition) (*Registry, error)

NewRegistry constructs a runnable registry from supported family runtime profiles. It never executes a provider while constructing the registry.

func NewRegistryWithContext 

func NewRegistryWithContext(ctx context.Context, runner ports.ProcessRunner, profiles ...RuntimeDefinition) (*Registry, error)

NewRegistryWithContext constructs a runnable registry using the caller's bounded construction context.

func NewRegistryWithNamespaceFactory 

func NewRegistryWithNamespaceFactory(
	runner ports.ProcessRunner, factory ports.ProviderNamespaceFactory, profiles ...RuntimeDefinition,
) (*Registry, error)

NewRegistryWithNamespaceFactory constructs a registry whose production namespace authority is supplied by the composition root.

func NewRegistryWithNamespaceFactoryContext 

func NewRegistryWithNamespaceFactoryContext(
	ctx context.Context, runner ports.ProcessRunner, factory ports.ProviderNamespaceFactory, profiles ...RuntimeDefinition,
) (*Registry, error)

NewRegistryWithNamespaceFactoryContext constructs a registry using the caller's bounded context for namespace acquisition and cleanup.

func RegistryFromConstructionError 

func RegistryFromConstructionError(err error) (*Registry, bool)

RegistryFromConstructionError returns the retryable cleanup owner retained by a failed registry construction.

func (*Registry) Close 

func (r *Registry) Close(ctx context.Context) (ports.ProviderRunTerminalReceipt, error)

Close terminally drains every namespace after all in-flight provider calls finish. A cancelled or partial drain remains retryable; successfully drained namespaces retain their actual receipts and are never drained again.

func (*Registry) Observe 

func (r *Registry) Observe(ctx context.Context, invocation ports.ProviderInvocation) (ports.ProviderExecutionObservation, error)

func (*Registry) QualificationNamespace 

func (r *Registry) QualificationNamespace(instance string) (QualificationNamespace, bool)

QualificationNamespace returns a narrowed view of the exact namespace lease retained for instance. It never exposes credential projection or drain authority.

type RegistryConstructionError 

type RegistryConstructionError struct {
	// contains filtered or unexported fields
}

RegistryConstructionError retains a registry whose namespace cleanup failed during construction. The retained registry must be closed with a fresh, bounded context before its terminal receipts can be used.

func (*RegistryConstructionError) Error 

func (err *RegistryConstructionError) Error() string

func (*RegistryConstructionError) Unwrap 

func (err *RegistryConstructionError) Unwrap() error

type RuntimeBuilder 

type RuntimeBuilder struct{}

RuntimeBuilder translates neutral application specs into providercli-owned production runtime definitions.

func (RuntimeBuilder) BuildProductionRuntime 

func (RuntimeBuilder) BuildProductionRuntime(spec ports.ProviderRuntimeSpec) (ports.ProviderRuntimeDefinition, error)

func (RuntimeBuilder) RuntimeSafetyPolicyIdentity 

func (RuntimeBuilder) RuntimeSafetyPolicyIdentity(family string) (string, error)

type RuntimeDefinition 

type RuntimeDefinition struct {
	// contains filtered or unexported fields
}

RuntimeDefinition is an immutable provider process profile.

func NewProductionKimiRuntimeDefinitionWithTransportAndSafetyPolicy 

func NewProductionKimiRuntimeDefinitionWithTransportAndSafetyPolicy(
	family, instance, version, executable, executableSHA256, launcher, launcherSHA256 string,
	concurrencyKey ports.ConcurrencyKey, profileID, profileGeneration, runtimeSafetyPolicyIdentity, kimiModel string,
	baseArgv []string, transport RuntimeTransport, environment []ports.EnvironmentVariable,
	workingDirectory string, timeout time.Duration, maxStdoutBytes, maxStderrBytes int64,
) (RuntimeDefinition, error)

NewProductionKimiRuntimeDefinitionWithTransportAndSafetyPolicy binds the operator-admitted Kimi model without placing Mulgae-only metadata in provider argv.

func NewProductionRuntimeDefinition 

func NewProductionRuntimeDefinition(
	family, instance, version, executable, executableSHA256 string,
	concurrencyKey ports.ConcurrencyKey,
	profileID string,
	baseArgv []string,
	environment []ports.EnvironmentVariable,
	workingDirectory string,
	timeout time.Duration,
	maxStdoutBytes, maxStderrBytes int64,
) (RuntimeDefinition, error)

NewProductionRuntimeDefinition constructs a profile that requires an invocation-bound workspace authority at execution time.

func NewProductionRuntimeDefinitionWithTransport 

func NewProductionRuntimeDefinitionWithTransport(
	family, instance, version, executable, executableSHA256, launcher, launcherSHA256 string,
	concurrencyKey ports.ConcurrencyKey, profileID, profileGeneration string, baseArgv []string,
	transport RuntimeTransport, environment []ports.EnvironmentVariable, workingDirectory string,
	timeout time.Duration, maxStdoutBytes, maxStderrBytes int64,
) (RuntimeDefinition, error)

NewProductionRuntimeDefinitionWithTransport constructs a production-only profile. It requires explicit packet transport, descriptor identities for both executable and launcher, and a profile generation.

func NewProductionRuntimeDefinitionWithTransportAndSafetyPolicy 

func NewProductionRuntimeDefinitionWithTransportAndSafetyPolicy(
	family, instance, version, executable, executableSHA256, launcher, launcherSHA256 string,
	concurrencyKey ports.ConcurrencyKey, profileID, profileGeneration, runtimeSafetyPolicyIdentity string,
	baseArgv []string, transport RuntimeTransport, environment []ports.EnvironmentVariable,
	workingDirectory string, timeout time.Duration, maxStdoutBytes, maxStderrBytes int64,
) (RuntimeDefinition, error)

NewProductionRuntimeDefinitionWithTransportAndSafetyPolicy constructs a production profile bound to one immutable runtime safety policy identity.

func NewProductionRuntimeDefinitionWithTransportAndSafetyPolicyAndPostOutputLifecycle 

func NewProductionRuntimeDefinitionWithTransportAndSafetyPolicyAndPostOutputLifecycle(
	family, instance, version, executable, executableSHA256, launcher, launcherSHA256 string,
	concurrencyKey ports.ConcurrencyKey, profileID, profileGeneration, runtimeSafetyPolicyIdentity string,
	baseArgv []string, transport RuntimeTransport, lifecycle ports.BoundedPostOutputLifecycle,
	environment []ports.EnvironmentVariable, workingDirectory string, timeout time.Duration,
	maxStdoutBytes, maxStderrBytes int64,
) (RuntimeDefinition, error)

NewProductionRuntimeDefinitionWithTransportAndSafetyPolicyAndPostOutputLifecycle constructs the AGY production profile with an explicit transport, immutable runtime safety policy identity, and bounded post-output lifecycle.

func NewRuntimeDefinition 

func NewRuntimeDefinition(
	family, instance, version, executable, executableSHA256 string,
	concurrencyKey ports.ConcurrencyKey,
	profileID string,
	baseArgv []string,
	environment []ports.EnvironmentVariable,
	workingDirectory string,
	timeout time.Duration,
	maxStdoutBytes, maxStderrBytes int64,
) (RuntimeDefinition, error)

NewRuntimeDefinition constructs a supported family runtime profile using the argv-literal print transport of the current provider families.

func NewRuntimeDefinitionWithTransport 

func NewRuntimeDefinitionWithTransport(
	family, instance, version, executable, executableSHA256 string,
	concurrencyKey ports.ConcurrencyKey,
	profileID string,
	baseArgv []string,
	transport RuntimeTransport,
	environment []ports.EnvironmentVariable,
	workingDirectory string,
	timeout time.Duration,
	maxStdoutBytes, maxStderrBytes int64,
) (RuntimeDefinition, error)

NewRuntimeDefinitionWithTransport constructs a supported family runtime profile with one explicit, immutable provider packet transport.

func NewRuntimeDefinitionWithTransportAndPostOutputLifecycle 

func NewRuntimeDefinitionWithTransportAndPostOutputLifecycle(
	family, instance, version, executable, executableSHA256 string,
	concurrencyKey ports.ConcurrencyKey, profileID string, baseArgv []string,
	transport RuntimeTransport, lifecycle ports.BoundedPostOutputLifecycle,
	environment []ports.EnvironmentVariable, workingDirectory string, timeout time.Duration,
	maxStdoutBytes, maxStderrBytes int64,
) (RuntimeDefinition, error)

NewRuntimeDefinitionWithTransportAndPostOutputLifecycle enables the bounded strict-JSON lifecycle for AGY only.

func (RuntimeDefinition) BaseArgv 

func (d RuntimeDefinition) BaseArgv() []string

func (RuntimeDefinition) ConcurrencyKey 

func (d RuntimeDefinition) ConcurrencyKey() ports.ConcurrencyKey

func (RuntimeDefinition) Environment 

func (d RuntimeDefinition) Environment() []ports.EnvironmentVariable

func (RuntimeDefinition) Executable 

func (d RuntimeDefinition) Executable() string

func (RuntimeDefinition) ExecutableSHA256 

func (d RuntimeDefinition) ExecutableSHA256() string

func (RuntimeDefinition) Family 

func (d RuntimeDefinition) Family() string

func (RuntimeDefinition) Instance 

func (d RuntimeDefinition) Instance() string

func (RuntimeDefinition) KimiModel 

func (d RuntimeDefinition) KimiModel() string

func (RuntimeDefinition) Launcher 

func (d RuntimeDefinition) Launcher() string

func (RuntimeDefinition) LauncherSHA256 

func (d RuntimeDefinition) LauncherSHA256() string

func (RuntimeDefinition) MaxStderrBytes 

func (d RuntimeDefinition) MaxStderrBytes() int64

func (RuntimeDefinition) MaxStdoutBytes 

func (d RuntimeDefinition) MaxStdoutBytes() int64

func (RuntimeDefinition) PostOutputLifecycle 

func (d RuntimeDefinition) PostOutputLifecycle() (ports.BoundedPostOutputLifecycle, bool)

func (RuntimeDefinition) ProfileGeneration 

func (d RuntimeDefinition) ProfileGeneration() string

func (RuntimeDefinition) ProfileID 

func (d RuntimeDefinition) ProfileID() string

func (RuntimeDefinition) RuntimeSafetyPolicyIdentity 

func (d RuntimeDefinition) RuntimeSafetyPolicyIdentity() string

func (RuntimeDefinition) Timeout 

func (d RuntimeDefinition) Timeout() time.Duration

func (RuntimeDefinition) Transport 

func (d RuntimeDefinition) Transport() RuntimeTransport

func (RuntimeDefinition) TransportArgvIndex 

func (d RuntimeDefinition) TransportArgvIndex() int

func (RuntimeDefinition) TransportChannel 

func (d RuntimeDefinition) TransportChannel() ports.ProviderPacketChannel

func (RuntimeDefinition) TransportReference 

func (d RuntimeDefinition) TransportReference() string

func (RuntimeDefinition) Version 

func (d RuntimeDefinition) Version() string

func (RuntimeDefinition) WorkingDirectory 

func (d RuntimeDefinition) WorkingDirectory() string

type RuntimeSafetyPolicy 

type RuntimeSafetyPolicy struct {
	// contains filtered or unexported fields
}

RuntimeSafetyPolicy records retained namespace configuration provenance. It is not execution or security authority and is excluded from AGY authority preimages.

func RuntimeSafetyPolicyForFamily 

func RuntimeSafetyPolicyForFamily(family CredentialSourceFamily) (RuntimeSafetyPolicy, error)

RuntimeSafetyPolicyForFamily returns a copy of the canonical retained policy.

func RuntimeSafetyPolicyForFamilyAndWorkspaceRoot deprecated 

func RuntimeSafetyPolicyForFamilyAndWorkspaceRoot(family CredentialSourceFamily, workspaceRoot string) (RuntimeSafetyPolicy, error)

RuntimeSafetyPolicyForFamilyAndWorkspaceRoot is retained for production composition callers while their workspace-bound construction is migrated. The workspace root is deliberately not authority for the retained policy.

Deprecated: use RuntimeSafetyPolicyForFamily. The workspace root is validated only to reject malformed legacy callers and never contributes authority.

func (RuntimeSafetyPolicy) Identity 

func (policy RuntimeSafetyPolicy) Identity() string

type RuntimeTransport 

type RuntimeTransport struct {
	// contains filtered or unexported fields
}

RuntimeTransport is an immutable provider packet transport profile.

func NewRuntimeTransport 

func NewRuntimeTransport(channel ports.ProviderPacketChannel, argvIndex int, reference string) (RuntimeTransport, error)

NewRuntimeTransport constructs one explicit packet transport profile.

func (RuntimeTransport) ArgvIndex 

func (t RuntimeTransport) ArgvIndex() int

func (RuntimeTransport) Channel 

func (t RuntimeTransport) Channel() ports.ProviderPacketChannel

func (RuntimeTransport) Reference 

func (t RuntimeTransport) Reference() string

type SafeProbeInvocation 

type SafeProbeInvocation interface {
	VersionArgv(RuntimeDefinition) ([]string, error)
	CapabilityArgv(RuntimeDefinition, ProbeFixture) ([]string, error)
	Validate(RuntimeDefinition, ProbeFixture, []string) error
}

SafeProbeInvocation supplies family-closed capability argv.

type SecureProbeNonceGenerator 

type SecureProbeNonceGenerator struct{}

SecureProbeNonceGenerator creates one unpredictable 256-bit fixture nonce.

func (SecureProbeNonceGenerator) NewProbeNonce 

func (SecureProbeNonceGenerator) NewProbeNonce() (string, error)

type SpawnVerifier 

type SpawnVerifier interface {
	VerifyProviderSpawn(context.Context, RuntimeDefinition) error
}

SpawnVerifier revalidates current executable and launcher descriptor identities immediately before a provider process is spawned.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.