export

package
v0.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 29, 2026 License: MIT Imports: 15 Imported by: 0

Documentation

Overview

Package export builds deterministic, redacted export packages from verified P2 projections.

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrMalformedProjection = errors.New("malformed verified export projection")
	ErrSecretDetected      = errors.New("secret detected in export projection")
)
View Source 
var (
	// ErrUnverifiedSource reports a source reader that cannot supply the exact P2
	// projection selected by the request.
	ErrUnverifiedSource = errors.New("export source is not a verified committed projection")
	// ErrSecureInstall reports an incomplete or mismatched secure-writer effect.
	ErrSecureInstall = errors.New("secure export installation failed")
)

Functions

func BuildRedactedBundle 

func BuildRedactedBundle(source VerifiedSourceProjection, options BuildOptions) (Bundle, ExportManifest, error)

BuildRedactedBundle builds only in-memory bytes, scanning the allowlisted payload before packaging. Its manifest template cannot be serialized until BindManifestToBundleReceipt receives an actually issued receipt.

func MarshalManifest 

func MarshalManifest(manifest ExportManifest) ([]byte, error)

MarshalManifest returns stable sidecar JSON for a manifest bound to an actual bundle receipt. The manifest is never embedded in its bundle.

Types

type BuildOptions 

type BuildOptions struct {
	ExportID  string
	CreatedAt time.Time
}

BuildOptions identifies deterministic package construction. The manifest is bound only after a secure writer issues the bundle receipt.

type Bundle 

type Bundle struct {
	Bytes   []byte
	Members []Member
}

Bundle contains caller-owned deterministic package bytes and member metadata.

type BundleIdentity 

type BundleIdentity struct {
	MemberCount int    `json:"member_count"`
	SizeBytes   int64  `json:"size_bytes"`
	SHA256      string `json:"sha256"`
}

type CommittedProjectionReader 

type CommittedProjectionReader interface {
	ReadCommittedProjection(context.Context, ExportSource) (VerifiedSourceProjection, error)
}

CommittedProjectionReader supplies only projections reconstructed from a verified P2 commit. Implementations must reject P0/P1, mutable, working-tree, and raw-provider sources rather than falling back to any of them.

type CurrentIdentity 

type CurrentIdentity struct {
	TargetSHA256         string `json:"target_sha256"`
	CurrentExcerptSHA256 string `json:"current_excerpt_sha256,omitempty"`
	Path                 string `json:"path,omitempty"`
	Side                 string `json:"side,omitempty"`
	LineStart            int    `json:"line_start,omitempty"`
	LineEnd              int    `json:"line_end,omitempty"`
	Verification         string `json:"verification,omitempty"`
}

type Evidence 

type Evidence struct {
	FindingID            string `json:"finding_id"`
	SourceSessionID      string `json:"source_session_id"`
	SourceRunID          string `json:"source_run_id"`
	SourceReviewID       string `json:"source_review_id"`
	SourceFindingID      string `json:"source_finding_id"`
	SourceTargetSHA256   string `json:"source_target_sha256"`
	SourceExcerptSHA256  string `json:"source_excerpt_sha256"`
	TargetSHA256         string `json:"target_sha256"`
	CurrentExcerptSHA256 string `json:"current_excerpt_sha256"`
	Path                 string `json:"path"`
	Side                 string `json:"side"`
	LineStart            int    `json:"line_start"`
	LineEnd              int    `json:"line_end"`
	Verification         string `json:"verification"`
}

Evidence holds only identity and reducer-owned verification fields.

type ExportInstallRequest 

type ExportInstallRequest struct {
	Root                     ports.AnchoredRoot
	BundlePath               ports.SafeRelativePath
	ManifestPath             ports.SafeRelativePath
	Bundle                   []byte
	SourceIDs                []string
	MaxBytes                 int64
	ManifestForBundleReceipt func(ports.SecureWriteReceipt) ([]byte, error)
}

ExportInstallRequest is the complete composite effect. Bundle is caller-owned immutable input. ManifestForBundleReceipt must be called with the actual bundle receipt, never a predicted digest.

type ExportInstallResult 

type ExportInstallResult struct {
	BundleReceipt   ports.SecureWriteReceipt
	ManifestReceipt ports.SecureWriteReceipt
	ManifestBytes   []byte
}

ExportInstallResult proves that both members of an export pair were durably installed or re-adopted after exact-byte verification and directory sync.

type ExportInstaller 

type ExportInstaller interface {
	Install(context.Context, ExportInstallRequest) (ExportInstallResult, error)
}

ExportInstaller owns the composite export effect. It must install both files with no-replace semantics, or durably record enough verified state to resume after process restart. On retry, an exact existing journal, bundle, or manifest must be revalidated at its anchored root and containing directory, synced, then revalidated with exact bytes before it is reported as installed. It invokes ManifestForBundleReceipt only after the bundle receipt has actually been issued. A failed or cancelled call may be retried with the same request without treating an installed bundle as a new conflicting export.

type ExportManifest 

type ExportManifest struct {
	SchemaVersion   string              `json:"schema_version"`
	ExportID        string              `json:"export_id"`
	CreatedAt       time.Time           `json:"created_at"`
	ImmutableSource ImmutableSource     `json:"immutable_source"`
	SourceIdentity  SourceIdentity      `json:"source_identity"`
	CurrentIdentity CurrentIdentity     `json:"current_identity"`
	SecureWriter    SecureWriterReceipt `json:"secure_writer"`
	Bundle          BundleIdentity      `json:"bundle"`
	Members         []Member            `json:"members"`
}

ExportManifest is the sidecar for a completed bundle. It is deliberately not a bundle member, preventing a bundle-hash self reference.

func BindManifestToBundleReceipt 

func BindManifestToBundleReceipt(template ExportManifest, receipt ports.SecureWriteReceipt) (ExportManifest, error)

BindManifestToBundleReceipt binds a manifest template to the actual accepted bundle write. It rejects a receipt that is not exact evidence for the bundle.

type ExportRequest 

type ExportRequest struct {
	Source       ExportSource
	Root         ports.AnchoredRoot
	BundlePath   ports.SafeRelativePath
	ManifestPath ports.SafeRelativePath
	ExportID     string
	CreatedAt    time.Time
}

ExportRequest gives the service a validated destination pair. Both files are immutable secure-writer outputs; the manifest is a sidecar and not a member of the bundle.

type ExportResult 

type ExportResult struct {
	Bundle          Bundle
	Manifest        ExportManifest
	ManifestBytes   []byte
	BundleReceipt   ports.SecureWriteReceipt
	ManifestReceipt ports.SecureWriteReceipt
}

ExportResult is returned only after both immutable files have accepted, matching secure-writer receipts. All byte slices are caller-owned copies.

type ExportSource 

type ExportSource struct {
	SessionID string
	RunID     string
	ReviewID  string
}

ExportSource identifies the committed review selected for export.

type Finding 

type Finding struct {
	ID             string `json:"id"`
	Fingerprint    string `json:"fingerprint"`
	Role           string `json:"role"`
	Severity       string `json:"severity"`
	Title          string `json:"title"`
	Description    string `json:"description"`
	Recommendation string `json:"recommendation"`
	Confidence     string `json:"confidence"`
	Lifecycle      string `json:"lifecycle"`
}

Finding is the normalized, safe finding representation included in an export.

type ImmutableArtifactRef 

type ImmutableArtifactRef struct {
	ArtifactPath string `json:"artifact_path"`
	SHA256       string `json:"sha256"`
}

type ImmutableSource 

type ImmutableSource struct {
	SessionID         string               `json:"session_id"`
	RunID             string               `json:"run_id"`
	ReviewID          string               `json:"review_id"`
	RunManifestRef    ImmutableArtifactRef `json:"run_manifest_ref"`
	ReviewArtifactRef ImmutableArtifactRef `json:"review_artifact_ref"`
}

type Member 

type Member struct {
	Path            string `json:"member_path"`
	SHA256          string `json:"sha256"`
	SizeBytes       int64  `json:"size_bytes"`
	MediaType       string `json:"media_type"`
	RedactionStatus string `json:"redaction_status"`
}

type RedactionManifest 

type RedactionManifest struct {
	Policy  string   `json:"policy"`
	Dropped []string `json:"dropped"`
}

type Review 

type Review struct {
	SchemaVersion  string `json:"schema_version"`
	ContentVerdict string `json:"content_verdict"`
	CoverageStatus string `json:"coverage_status"`
}

type Run 

type Run struct {
	SchemaVersion string `json:"schema_version"`
	State         string `json:"state"`
}

type SecretBlockEvidence 

type SecretBlockEvidence struct {
	ScanStatus                  string `json:"scan_status"`
	OnDetection                 string `json:"on_detection"`
	SecretPersisted             bool   `json:"secret_persisted"`
	BlockedContentHashPersisted bool   `json:"blocked_content_hash_persisted"`
}

type SecureWriterReceipt 

type SecureWriterReceipt struct {
	Contract            string              `json:"contract"`
	ScanBeforeWrite     bool                `json:"scan_before_write"`
	RedactionPolicy     string              `json:"redaction_policy"`
	RedactionStatus     string              `json:"redaction_status"`
	SecretBlockEvidence SecretBlockEvidence `json:"secret_block_evidence"`
	ReceiptSHA256       string              `json:"receipt_sha256"`
}

type Service 

type Service struct {
	// contains filtered or unexported fields
}

Service composes a verified committed projection reader with a recoverable composite export installer. It has no filesystem or single-file fallback.

func NewService 

func NewService(reader CommittedProjectionReader, installer ExportInstaller, maxBytes int64) (*Service, error)

NewService creates an export service with one positive cap for each emitted artifact. The installer is responsible for durable paired installation.

func (*Service) ExportRedactedRun 

func (service *Service) ExportRedactedRun(ctx context.Context, request ExportRequest) (ExportResult, error)

ExportRedactedRun reads exactly one P2 projection, creates deterministic redacted bytes, and delegates the two-file effect to a recoverable installer.

type SourceIdentity 

type SourceIdentity struct {
	SessionID           string `json:"session_id"`
	RunID               string `json:"run_id"`
	ReviewID            string `json:"review_id"`
	FindingID           string `json:"finding_id,omitempty"`
	SourceTargetSHA256  string `json:"source_target_sha256"`
	SourceExcerptSHA256 string `json:"source_excerpt_sha256,omitempty"`
}

type VerifiedSourceProjection 

type VerifiedSourceProjection struct {
	SessionID       string
	RunID           string
	ReviewID        string
	RunManifest     ImmutableArtifactRef
	ReviewArtifact  ImmutableArtifactRef
	SchemaVersions  []string
	Review          Review
	Run             Run
	Findings        []Finding
	Evidence        []Evidence
	Redaction       RedactionManifest
	SourceIdentity  SourceIdentity
	CurrentIdentity CurrentIdentity
}

VerifiedSourceProjection is the complete allowlisted input to an export. It intentionally has no raw provider output, target bytes, environment, or host path fields. Callers must construct it only after P2 semantic verification.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.