architecturev2

package
v0.40.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 24, 2026 License: Apache-2.0 Imports: 46 Imported by: 0

Documentation

Overview

Package architecturev2 is the single integration boundary from StackSpec documents to the governed Architecture v2 ResolvedPlan compiler.

Index

Constants

View Source 
const (
	RetiredOutputGCRemoveStage   = execution.RetiredOutputGCRemoveStage
	RetiredOutputGCRemoveJournal = execution.RetiredOutputGCRemoveJournal
)

Variables

This section is empty.

Functions

func ApplyRetiredOutputGC 

func ApplyRetiredOutputGC(workspace *confinedfs.Transaction, expected RetiredOutputGCInspection) error

func DecodeYAMLObject 

func DecodeYAMLObject(data []byte, documentName string) (map[string]any, error)

DecodeYAMLObject exposes the resolver's single YAML/JSON normalization boundary to downstream projections that consume the already-admitted v2 document. It deliberately shares decodeYAMLObject rather than introducing another parser or partial StackSpec model.

func EmbeddedKitDefinition 

func EmbeddedKitDefinition(slug string) (resolvedplan.KitDefinition, error)

EmbeddedKitDefinition returns the decoded KitDefinition one kit declares in the embedded product authority.

Host admission needs the kit-declared floor before a plan is executed, and that floor must come from the same authority the plan is bound to rather than from a second copy maintained in Go.

func NewProductRuntimeRootIdentity 

func NewProductRuntimeRootIdentity(runtimeVersion string) (runtimeexecutor.ExecutorIdentity, error)

NewProductRuntimeRootIdentity returns the stable product-runtime identity used by evidence, authorization, Journal, and recovery. It identifies the provider-free dispatcher contract and binary runtime version; exact target, artifact, owner, and channel bindings remain sealed into every request.

func RequireNoPendingOutputTransaction 

func RequireNoPendingOutputTransaction(workspace *confinedfs.Transaction, outputRoot string) error

RequireNoPendingOutputTransaction applies the Architecture v2 durable transaction admission guard through an already-held workspace transaction. CLI execution modes call it only while owning the matching output lock.

Types

type AddOnCatalogEntry 

type AddOnCatalogEntry struct {
	ID            string                          `json:"id"`
	Version       string                          `json:"version"`
	Description   string                          `json:"description"`
	SupportedKits []stackspecmigration.KitProfile `json:"supportedKits"`
}

AddOnCatalogEntry is the read-only Architecture v2 add-on metadata exposed to CLI and API adapters. It is projected exclusively from the CUE-bound catalog snapshot owned by Service; it does not describe selection state, mutation support, plan readiness, or runtime availability.

type ApplicationDeliveryCapabilities 

type ApplicationDeliveryCapabilities struct {
	Deployment     bool `json:"deployment"`
	RouteTLS       bool `json:"routeTLS"`
	StatusEvidence bool `json:"statusEvidence"`
	BackupRestore  bool `json:"backupRestore"`
}

ApplicationDeliveryCapabilities states what one exact workload/adapter row currently implements. False remains an explicit unsupported capability; it must never be inferred from catalog presence or adapter maturity.

type ApplicationDeliveryCompatibilityEntry 

type ApplicationDeliveryCompatibilityEntry struct {
	WorkloadRef    string                          `json:"workloadRef"`
	AlternativeRef string                          `json:"alternativeRef"`
	AdapterRef     string                          `json:"adapterRef"`
	Maturity       string                          `json:"maturity"`
	Capabilities   ApplicationDeliveryCapabilities `json:"capabilities"`
}

ApplicationDeliveryCompatibilityEntry is the CUE-owned, read-only support row for one StackKits application and one delivery adapter.

type AppliedArtifactIdentity 

type AppliedArtifactIdentity struct {
	Ref    string `json:"ref"`
	Digest string `json:"digest"`
}

AppliedArtifactIdentity is the content identity of one artifact referenced by an applied workload. Paths and artifact content remain local custody.

type AppliedWorkloadIdentity 

type AppliedWorkloadIdentity struct {
	WorkloadRef     string                     `json:"workloadRef"`
	RequirementID   string                     `json:"requirementId"`
	InstanceRef     string                     `json:"instanceRef"`
	RuntimeOwnerRef string                     `json:"runtimeOwnerRef"`
	Placements      []AppliedWorkloadPlacement `json:"placements"`
	Artifacts       []AppliedArtifactIdentity  `json:"artifacts"`
}

AppliedWorkloadIdentity is the secret-free, hash-bound correlation surface for one workload runtime target. It routes a later Owner-approved request; it is not removal authorization or terminal absence evidence.

type AppliedWorkloadPlacement 

type AppliedWorkloadPlacement struct {
	SiteRef             string `json:"siteRef"`
	NodeRef             string `json:"nodeRef"`
	ExecutionChannelRef string `json:"executionChannelRef,omitempty"`
}

AppliedWorkloadPlacement preserves node and execution-channel pairing. A multi-node workload remains multiple explicit placements, never one guess.

type ApplyHealthObservationSummary 

type ApplyHealthObservationSummary struct {
	RequirementID     string `json:"requirementId"`
	TargetRef         string `json:"targetRef"`
	Status            string `json:"status"`
	ObservationRef    string `json:"observationRef"`
	ObservationDigest string `json:"observationDigest"`
}

ApplyHealthObservationSummary is the secret-free health evidence projection used by CLI/MCP observation surfaces.

type ApplyObservationSummary 

type ApplyObservationSummary struct {
	Runtime []ApplyRuntimeObservationSummary `json:"runtime"`
	Health  []ApplyHealthObservationSummary  `json:"health"`
}

type ApplyResultSummary 

type ApplyResultSummary struct {
	ResultHash           string                    `json:"resultHash"`
	PlanHash             string                    `json:"planHash"`
	AppliedRequestDigest string                    `json:"appliedRequestDigest,omitempty"`
	AppliedAt            time.Time                 `json:"appliedAt"`
	EvidenceBundleHash   string                    `json:"evidenceBundleHash"`
	RuntimeCount         int                       `json:"runtimeCount"`
	HealthCount          int                       `json:"healthCount"`
	AppliedWorkloads     []AppliedWorkloadIdentity `json:"appliedWorkloads"`
}

ApplyResultSummary is the secret-free public projection consumed by CLI verification output.

type ApplyRuntimeObservationSummary 

type ApplyRuntimeObservationSummary struct {
	RequirementID     string `json:"requirementId"`
	InstanceRef       string `json:"instanceRef"`
	Status            string `json:"status"`
	ObservationRef    string `json:"observationRef"`
	ObservationDigest string `json:"observationDigest"`
}

ApplyRuntimeObservationSummary is the secret-free, immutable runtime evidence projection used by CLI/MCP observation surfaces.

type AuthoringOverrides 

type AuthoringOverrides struct {
	// CatalogDefaults explicitly accepts CUE-owned defaults during initial
	// authoring. Persisted intent remains fully explicit.
	CatalogDefaults bool
	// APIVersion selects native module-local intent or the explicit legacy
	// adapter. Empty is retained for existing in-process v2alpha1 callers.
	APIVersion string
	Name       string
	DomainBase string
	// Platform selects the workload runtime adapter (e.g. coolify, komodo,
	// standalone-compose) for every workload chosen via UseCases. It is
	// validated against each selected alternative's runtime.allowedAdapterRefs
	// and requires at least one use case.
	Platform string
	// EnableCapabilities is appended to capabilities.enable (optional
	// capability IDs declared by the kit, e.g. lan-dns). The resolver
	// rejects capabilities the kit does not declare.
	EnableCapabilities []string
	// UseCases selects optional kit workloads by ID (e.g. photos, files,
	// vault). Each ID must be declared by the kit's workload policy; the
	// native UseCaseAlternatives selects the implementation. Only the explicit
	// v2alpha1 adapter reads the catalog computeTiers fit.
	UseCases []string
	// ComputeTier is v2alpha1 compatibility only. In that adapter, an empty
	// value retains the legacy CUE default. Native v2alpha2 rejects this field.
	ComputeTier string
	// ModuleProfiles and UseCaseAlternatives belong only to v2alpha2. They are
	// validated against the selected modules and alternatives in the CUE catalog.
	ModuleProfiles      map[string]ModuleProfileOverride
	UseCaseAlternatives map[string]string
	// HardwareProfile writes nodes[0].hardware.profile (standard|pi|gpu|storage).
	// pi is a constrained homelab device class, not Raspberry-only. Empty leaves
	// the CUE default. This is never auto-detected from inventory.
	HardwareProfile string
}

AuthoringOverrides is the deliberately narrow authoring surface for a kit's governed initial StackSpec. Adding another field here requires a matching Definition.authoring.requiredOverrides contract and an explicit materializer implementation; arbitrary paths are never accepted.

type CompilerContract 

type CompilerContract struct {
	CompilerVersion         string
	MinimumCLIVersion       string
	MinimumRuntimeVersion   string
	MinimumGeneratorVersion string
	RendererID              string
	RendererVersion         string
}

CompilerContract is the explicit integration-owned compiler identity and artifact contract. There are deliberately no implicit compiler defaults.

func ContractFixtureV1Contract 

func ContractFixtureV1Contract(buildVersion string) CompilerContract

ContractFixtureV1Contract returns the only compiler/renderer namespace that the isolated non-product authority accepts. This identity is intentionally disjoint from product plans even when both are built from the same SHA.

func StackKitsV2Contract 

func StackKitsV2Contract(buildVersion string) CompilerContract

StackKitsV2Contract is the governed Architecture v2 renderer contract. The minimum versions preserve the first supported v2 release line while buildVersion binds each resolution to the exact producing build.

func StackKitsV06Contract deprecated 

func StackKitsV06Contract(buildVersion string) CompilerContract

StackKitsV06Contract is retained as a source-compatible transition alias. New product integrations must use StackKitsV2Contract.

Deprecated: use StackKitsV2Contract.

type CurrentResolution 

type CurrentResolution struct {
	// contains filtered or unexported fields
}

CurrentResolution is an opaque proof that one exact plan came from a fresh Resolve invocation owned by one governed Architecture v2 generation coordinator. Service value copies share that pointer-owned coordinator; its zero value is invalid and callers cannot compose it from persisted bytes.

The public Result projection is kept separately from the immutable verified plan used for authorization. Mutating a Result returned by Result therefore cannot change the plan that may be authorized.

func (CurrentResolution) Result 

func (r CurrentResolution) Result() (Result, error)

Result returns a defensive projection of the current resolution for plan display or persistence. It is not an authorization token.

type ErrorCode 

type ErrorCode string

ErrorCode is a stable adapter-facing classification. CLI and API callers can map it without parsing compiler or CUE diagnostics. 

const (
	ErrInvalidStackSpec        ErrorCode = "invalid_stackspec"
	ErrInvalidInventory        ErrorCode = "invalid_inventory"
	ErrMigrationRequired       ErrorCode = "migration_required"
	ErrMigrationBlocked        ErrorCode = "migration_blocked"
	ErrAuthorityLoad           ErrorCode = "authority_load"
	ErrResolveFailed           ErrorCode = "resolve_failed"
	ErrGenerationAuthorization ErrorCode = "generation_authorization_failed"
	ErrApplyAuthorization      ErrorCode = "apply_authorization_failed"
	ErrRequestTooLarge         ErrorCode = "request_too_large"
	ErrUnsupportedMedia        ErrorCode = "unsupported_media_type"
	ErrResolveBusy             ErrorCode = "resolve_busy"
	ErrOperationalUnavailable  ErrorCode = "operational_surface_unavailable"
)

type GenerationAuthorization 

type GenerationAuthorization struct {
	// contains filtered or unexported fields
}

GenerationAuthorization is an opaque Architecture v2 execution session for one fresh resolution and the exact workspace handle opened during service authorization. Its zero value is invalid, copies share close state, and no package outside architecturev2 can mint a non-zero value.

func (GenerationAuthorization) Close 

func (a GenerationAuthorization) Close() error

Close waits for active Render/Install leases, revokes this exact resolution, and releases the original held workspace. It is idempotent across copies.

func (GenerationAuthorization) Install 

func (a GenerationAuthorization) Install(result architecturev2renderer.RenderResult, options architecturev2renderer.InstallOptions) (architecturev2renderer.InstallResult, error)

Install installs a Render-produced result through the same session. The result binding and exact workspace handle are revalidated before mutation.

func (GenerationAuthorization) InstallManagedOutput 

func (a GenerationAuthorization) InstallManagedOutput(result architecturev2renderer.RenderResult, options architecturev2renderer.InstallOptions) (architecturev2renderer.InstallResult, error)

InstallManagedOutput preserves the explicit old operation name while the capability itself, not the renderer package, owns the mutating entry point.

func (GenerationAuthorization) Render 

func (a GenerationAuthorization) Render(ctx context.Context, registry *architecturev2renderer.Registry) (architecturev2renderer.RenderResult, error)

Render runs the pure renderer kernel while holding the current-resolution lease. It is a method on the unforgeable Architecture v2 session rather than a free renderer function.

func (GenerationAuthorization) RenderAndInstall 

func (a GenerationAuthorization) RenderAndInstall(ctx context.Context, registry *architecturev2renderer.Registry, options architecturev2renderer.InstallOptions) (architecturev2renderer.InstallResult, error)

RenderAndInstall holds one authorization, current-resolution, and original workspace-handle lease across pure rendering and the entire held-root stage/verify/swap/rollback transaction.

type GenerationAuthorizationInput 

type GenerationAuthorizationInput struct {
	Current       CurrentResolution
	WorkspaceRoot string
	Versions      generationartifact.ComponentVersions
}

GenerationAuthorizationInput identifies the governed deployment workspace and exact component identities that must agree with a sealed current resolution. The service derives and reads the canonical ResolvedPlan path itself; callers cannot substitute another path or pass an in-memory plan as persistence evidence.

type HistoricalAppliedRuntimeCustody 

type HistoricalAppliedRuntimeCustody struct {
	// contains filtered or unexported fields
}

HistoricalAppliedRuntimeCustody is immutable historical request data. Its canonical representation is checked, but the caller must independently bind these bytes to an owner-signed checkpoint. It is never fresh Apply authority.

func ParseHistoricalAppliedRuntimeCustody 

func ParseHistoricalAppliedRuntimeCustody(data []byte) (HistoricalAppliedRuntimeCustody, error)

ParseHistoricalAppliedRuntimeCustody uses the same bounded canonical capsule validation as Apply recovery. Expiry is retained as historical data; parsing does not authorize execution or renew an expired request.

func (HistoricalAppliedRuntimeCustody) Binding 

func (custody HistoricalAppliedRuntimeCustody) Binding() generationartifact.PlanBinding

func (HistoricalAppliedRuntimeCustody) Canonical 

func (custody HistoricalAppliedRuntimeCustody) Canonical() []byte

func (HistoricalAppliedRuntimeCustody) ExecutedAt 

func (custody HistoricalAppliedRuntimeCustody) ExecutedAt() time.Time

func (HistoricalAppliedRuntimeCustody) ManifestHash 

func (custody HistoricalAppliedRuntimeCustody) ManifestHash() string

func (HistoricalAppliedRuntimeCustody) OutputRoot 

func (custody HistoricalAppliedRuntimeCustody) OutputRoot() string

func (HistoricalAppliedRuntimeCustody) Request 

func (custody HistoricalAppliedRuntimeCustody) Request() runtimeexecutor.ExecutionRequest

func (HistoricalAppliedRuntimeCustody) Requirements 

func (custody HistoricalAppliedRuntimeCustody) Requirements() generationartifact.ApplyRequirements

func (HistoricalAppliedRuntimeCustody) ValidUntil 

func (custody HistoricalAppliedRuntimeCustody) ValidUntil() time.Time

type InitialStackSpecAuthoring 

type InitialStackSpecAuthoring struct {
	ContractVersion   string
	Status            string
	RequiredOverrides []string
	StandaloneOwner   *StandaloneOwnerAuthoring
}

InitialStackSpecAuthoring exposes only the workflow metadata a CLI or UI needs before materialization. The initial spec itself stays encapsulated and can only leave this service after CUE revalidation.

type ModuleProfileCatalogEntry 

type ModuleProfileCatalogEntry struct {
	ModuleID            string                    `json:"module_id"`
	ComputeProfiles     map[string]map[string]any `json:"compute_profiles"`
	StorageProfiles     map[string]map[string]any `json:"storage_profiles,omitempty"`
	AcceleratorProfiles map[string]map[string]any `json:"accelerator_profiles,omitempty"`
}

ModuleProfileCatalogEntry is a read-only projection of module-owned CUE contracts. It makes no selection, recommendation or host-admission claim.

type ModuleProfileOverride 

type ModuleProfileOverride struct {
	ComputeProfile     string `json:"computeProfile"`
	StorageProfile     string `json:"storageProfile,omitempty"`
	AcceleratorProfile string `json:"acceleratorProfile,omitempty"`
}

ModuleProfileOverride is typed authoring intent, never an inventory-derived choice. Storage and accelerator are independent, optional catalog dimensions.

type ProductAppliedRuntimeCustody 

type ProductAppliedRuntimeCustody struct {
	// contains filtered or unexported fields
}

ProductAppliedRuntimeCustody is an immutable recovery capsule bound to a verified Apply. Path and canonical bytes are projections for later signed custody capture; neither projection grants a new mutation.

func (ProductAppliedRuntimeCustody) Canonical 

func (c ProductAppliedRuntimeCustody) Canonical() []byte

Canonical returns defensive copies of the exact canonical capsule bytes.

func (ProductAppliedRuntimeCustody) Path 

func (c ProductAppliedRuntimeCustody) Path() string

Path returns the exact journal-relative capsule path.

func (ProductAppliedRuntimeCustody) Request 

func (c ProductAppliedRuntimeCustody) Request() runtimeexecutor.ExecutionRequest

Request returns a defensive clone of the validated shared request.

type ProductApplyEvidenceCollectionRequest 

type ProductApplyEvidenceCollectionRequest = applyevidence.CollectionRequest

ProductApplyEvidenceCollectionRequest is the shared provider-free handoff to an integration-owned host/device collector. Private signing material, host inspection, transport, and credential custody remain inside the collector.

type ProductApplyEvidenceCollector 

type ProductApplyEvidenceCollector = applyevidence.Collector

ProductApplyEvidenceCollector retains the StackKits-facing name for the shared provider-neutral producer SPI. It is configured on the product service, never supplied by an Apply request. StackKits still authenticates every returned receipt against service-owned public trust.

type ProductApplyFileJournal 

type ProductApplyFileJournal struct {
	// contains filtered or unexported fields
}

ProductApplyFileJournal is a provider-free durable runtimeapply Journal for one held workspace. It owns persistence, atomic fencing, and crash resume; it does not own executor selection, transport, credentials, provider lifecycle, leases, generation, or compensation execution.

func NewProductApplyFileJournal 

func NewProductApplyFileJournal(workspaceRoot string) (*ProductApplyFileJournal, error)

NewProductApplyFileJournal opens an existing workspace without mutating it. Private control directories are created lazily by the first Journal or recovery operation, after Apply has crossed resolution and verification. The caller owns Close and may inject this Journal into NewProductEmbeddedServiceWithRuntimeOwners.

func (*ProductApplyFileJournal) Begin 

func (j *ProductApplyFileJournal) Begin(ctx context.Context, operation runtimeapply.Operation) (runtimeapply.Reservation, error)

func (*ProductApplyFileJournal) Close 

func (j *ProductApplyFileJournal) Close() error

Close releases the held workspace root. It is safe to call more than once.

func (*ProductApplyFileJournal) CommitStep 

func (j *ProductApplyFileJournal) CommitStep(ctx context.Context, commit runtimeapply.StepCommit) (runtimeapply.Snapshot, error)

func (*ProductApplyFileJournal) Finalize 

func (j *ProductApplyFileJournal) Finalize(ctx context.Context, finalization runtimeapply.Finalization) (runtimeapply.Snapshot, error)

func (*ProductApplyFileJournal) LoadAppliedRuntimeRequest 

func (j *ProductApplyFileJournal) LoadAppliedRuntimeRequest(ctx context.Context, requestDigest string) (runtimeexecutor.ExecutionRequest, error)

LoadAppliedRuntimeRequest returns the validated shared request retained by the apply capsule. The returned request is a defensive clone and is only a read projection; it does not authorize a new mutation.

func (*ProductApplyFileJournal) LoadApplyRecovery 

func (j *ProductApplyFileJournal) LoadApplyRecovery(ctx context.Context, requestDigest string) ([]byte, error)

func (*ProductApplyFileJournal) LoadVerifiedAppliedRuntimeCustody 

func (j *ProductApplyFileJournal) LoadVerifiedAppliedRuntimeCustody(
	ctx context.Context,
	plan generationartifact.VerifiedPlan,
	applied VerifiedApplyResult,
) (ProductAppliedRuntimeCustody, error)

LoadVerifiedAppliedRuntimeCustody loads the exact capsule bound to the verified plan and Apply result. The historical capsule expiry is deliberately not consulted here: expiry controls fresh Apply authorization, while this API only returns previously verified custody for recovery capture.

func (*ProductApplyFileJournal) SaveApplyRecovery 

func (j *ProductApplyFileJournal) SaveApplyRecovery(ctx context.Context, requestDigest string, canonical []byte) error

type ProductApplyInput 

type ProductApplyInput struct {
	Current        CurrentResolution
	Workspace      *confinedfs.Transaction
	OutputLock     *confinedfs.OutputLock
	Versions       generationartifact.ComponentVersions
	EvidenceBundle []byte
}

ProductApplyInput contains request-specific bytes and already-held filesystem capabilities. Executor identity, capabilities, and producer trust are deliberately absent: the product service owns them.

type ProductApplyReconcileInput 

type ProductApplyReconcileInput struct {
	Current       CurrentResolution
	Workspace     *confinedfs.Transaction
	OutputLock    *confinedfs.OutputLock
	Versions      generationartifact.ComponentVersions
	RequestDigest string
}

ProductApplyReconcileInput identifies one service-owned recovery operation and supplies only the currently held filesystem capabilities. The caller cannot provide request bytes, evidence, an executor, or recovery authority.

type ProductApplyReconcileOperation 

type ProductApplyReconcileOperation struct {
	Operation runtimeapply.Operation
	Snapshot  runtimeapply.Snapshot
}

ProductApplyReconcileOperation is one validated provider-free operation and its exact durable partial-failure state. The operation identifies every child runtime/Health authority; the snapshot contains only closed failure codes and verified results, never adapter payloads or provider handles.

type ProductApplyReconcileRequiredError 

type ProductApplyReconcileRequiredError struct {
	// contains filtered or unexported fields
}

ProductApplyReconcileRequiredError is the structured Product Apply outcome when at least one journaled channel or owner needs reconciliation.

func (*ProductApplyReconcileRequiredError) Error 

func (e *ProductApplyReconcileRequiredError) Error() string

func (*ProductApplyReconcileRequiredError) FailureClass 

func (e *ProductApplyReconcileRequiredError) FailureClass() string

FailureClass reports the recognized host or container-runtime condition behind this reconcile-required outcome, or an empty string when the cause carries no closed signature.

func (*ProductApplyReconcileRequiredError) Operations 

func (e *ProductApplyReconcileRequiredError) Operations() []ProductApplyReconcileOperation

Operations returns defensive copies sorted by operation identity.

func (*ProductApplyReconcileRequiredError) RequestDigest 

func (e *ProductApplyReconcileRequiredError) RequestDigest() string

RequestDigest returns the opaque, canonical recovery key for ReconcileProductApply. It contains no request bytes or provider authority.

func (*ProductApplyReconcileRequiredError) Retryable 

func (e *ProductApplyReconcileRequiredError) Retryable() bool

Retryable reports whether repeating Apply can succeed once the recognized condition is addressed. An unrecognized cause is never claimed retryable.

func (*ProductApplyReconcileRequiredError) Unwrap 

func (e *ProductApplyReconcileRequiredError) Unwrap() error

type ProductApplyRecoveryStore 

type ProductApplyRecoveryStore = runtimeapply.RecoveryStore

ProductApplyRecoveryStore retains the StackKits-facing name for the shared opaque recovery-custody SPI. StackKits validates before Save and after Load; the store owns only atomic persistence and exact-digest lookup.

type ProductApplyResultVerificationInput 

type ProductApplyResultVerificationInput struct {
	Plan     generationartifact.VerifiedPlan
	Manifest generationartifact.ArtifactManifest
	Receipt  generationartifact.GenerationReceipt
	Versions generationartifact.ComponentVersions
	Result   []byte
}

ProductApplyResultVerificationInput is the complete read-only authority for accepting a persisted Apply result. Runtime owner identity and producer trust remain service-owned.

type ProductApplyTrustAnchor 

type ProductApplyTrustAnchor struct {
	Producer         generationartifact.ApplyEvidenceProducer
	PublicKey        ed25519.PublicKey
	RequirementKinds []string
}

ProductApplyTrustAnchor is a construction-time producer trust root. It is accepted only by product service constructors; Apply requests cannot supply or replace it.

type ProductExecutionChannelAdmission 

type ProductExecutionChannelAdmission = runtimeexecutor.ExecutionChannelAdmission

ProductExecutionChannelAdmission binds one already admitted channel to an executor. A remote admission may return its authenticated transport executor without invoking local; an explicit local admission invokes local and may wrap its result. Direct execution is never the default.

type ProductExecutionChannelFactory 

type ProductExecutionChannelFactory = runtimeexecutor.ExecutionChannelFactory

ProductExecutionChannelFactory admits exact channel/Site/node scopes from service-owned state before any owner factory can run.

func NewProductLocalExecutionChannelFactory 

func NewProductLocalExecutionChannelFactory(binding ProductLocalExecutionChannelBinding) (ProductExecutionChannelFactory, error)

NewProductLocalExecutionChannelFactory admits only the exact binding. The caller must source it from device-/orchestrator-owned configuration; a RuntimeTarget can never declare itself local merely by naming a channel.

func NewProductLocalExecutionChannelSetFactory 

func NewProductLocalExecutionChannelSetFactory(bindings []ProductLocalExecutionChannelBinding) (ProductExecutionChannelFactory, error)

NewProductLocalExecutionChannelSetFactory admits a closed set of configuration-owned Site/node/channel tuples. The operations implementation behind each tuple retains transport and authentication custody.

func NewProductProcessExecutionChannelFactory 

func NewProductProcessExecutionChannelFactory(
	runtimeVersion string,
	bindings []ProductProcessExecutionChannelBinding,
) (ProductExecutionChannelFactory, error)

type ProductExecutionChannelLocalExecutor 

type ProductExecutionChannelLocalExecutor = runtimeexecutor.ExecutionChannelLocalExecutor

ProductExecutionChannelLocalExecutor lazily constructs the exact channel-local owner router. A remote channel never needs to call it or possess local operations implementations.

type ProductExecutionChannelRequest 

type ProductExecutionChannelRequest = runtimeexecutor.ExecutionChannelRequest

ProductExecutionChannelRequest retains the StackKits-facing name for the shared provider-free execution-channel contract. StackKits constructs the exact target closure; service integrations own local or remote routing.

type ProductLocalExecutionChannelBinding 

type ProductLocalExecutionChannelBinding struct {
	ChannelRef string
	SiteRef    string
	NodeRef    string
}

ProductLocalExecutionChannelBinding is an explicit declaration that this process owns one exact Site/node/channel tuple. It is intentionally singular: multi-node and hybrid execution require a channel authority that transports each request to the correct host rather than executing every target locally.

type ProductProcessExecutionChannelBinding 

type ProductProcessExecutionChannelBinding struct {
	ChannelRef       string
	SiteRef          string
	NodeRef          string
	Executable       string
	ExecutableSHA256 string
}

type ProductRuntimeOwnerDescriptor 

type ProductRuntimeOwnerDescriptor struct {
	ID       ProductRuntimeOwnerID
	Selector ProductRuntimeOwnerSelector
}

ProductRuntimeOwnerDescriptor exposes one immutable value projection of a static StackKits selector. It contains no target, channel, endpoint, credential, provider resource, lease, generation, or Operations authority.

func ProductStaticRuntimeOwnerCatalog 

func ProductStaticRuntimeOwnerCatalog() []ProductRuntimeOwnerDescriptor

ProductStaticRuntimeOwnerCatalog returns a fresh value-only projection of every static Product factory selector. Selected-PaaS workload selectors are deliberately excluded because their exact adapter identity is a required service-construction input.

type ProductRuntimeOwnerExecutionMode 

type ProductRuntimeOwnerExecutionMode string

ProductRuntimeOwnerExecutionMode declares whether a selector has a local factory in this process or is admitted only through an authenticated remote execution channel. Empty is the compatibility spelling of local. 

const (
	ProductRuntimeOwnerExecutionLocal      ProductRuntimeOwnerExecutionMode = "local"
	ProductRuntimeOwnerExecutionRemoteOnly ProductRuntimeOwnerExecutionMode = "remote-only"
)

type ProductRuntimeOwnerFactory 

type ProductRuntimeOwnerFactory interface {
	PrepareRuntimeOwner(ProductRuntimeOwnerRequest) (runtimeexecutor.Executor, error)
}

ProductRuntimeOwnerFactory prepares one typed executor. Preparation must be free of target mutation; actual operations occur only through Execute.

type ProductRuntimeOwnerID 

type ProductRuntimeOwnerID string

ProductRuntimeOwnerID is a stable service-construction identifier for one static CUE/catalog-owned Runtime Owner selector. Its value is the exact selector OwnerRef; callers never reconstruct the remaining selector fields. 

const (
	ProductRuntimeOwnerHomeAssistantHAOS     ProductRuntimeOwnerID = "stackkits-home-assistant-haos-runtime"
	ProductRuntimeOwnerHomeAssistantExisting ProductRuntimeOwnerID = "stackkits-home-assistant-existing-runtime"
	ProductRuntimeOwnerHomeAssistantImported ProductRuntimeOwnerID = "stackkits-home-assistant-imported-runtime"
)
const (
	ProductRuntimeOwnerSecurityBaseline        ProductRuntimeOwnerID = "security-baseline"
	ProductRuntimeOwnerCoreHostBootstrap       ProductRuntimeOwnerID = "stackkits-core-host-bootstrap"
	ProductRuntimeOwnerHomeBackupTarget        ProductRuntimeOwnerID = "stackkits-home-backup-target"
	ProductRuntimeOwnerBasementCompose         ProductRuntimeOwnerID = "socket-proxy"
	ProductRuntimeOwnerBasementIdentityTrust   ProductRuntimeOwnerID = "stackkits-basement-identity-trust-policy-manifest"
	ProductRuntimeOwnerCloudIdentityTrust      ProductRuntimeOwnerID = "stackkits-cloud-identity-trust-policy-manifest"
	ProductRuntimeOwnerCloudHostSecurity       ProductRuntimeOwnerID = "stackkits-cloud-host-security-runtime"
	ProductRuntimeOwnerCloudPublicEdge         ProductRuntimeOwnerID = "stackkits-cloud-public-edge-runtime"
	ProductRuntimeOwnerCloudOffsiteBackup      ProductRuntimeOwnerID = "stackkits-cloud-offsite-backup-runtime"
	ProductRuntimeOwnerPublicTLS               ProductRuntimeOwnerID = "stackkits-public-tls-contract"
	ProductRuntimeOwnerHomeDeviceAuthority     ProductRuntimeOwnerID = "stackkits-home-device-authority-policy-manifest"
	ProductRuntimeOwnerHomeAccess              ProductRuntimeOwnerID = "stackkits-home-access-policy-manifest"
	ProductRuntimeOwnerLocalAutonomy           ProductRuntimeOwnerID = "stackkits-local-autonomy-policy-manifest"
	ProductRuntimeOwnerMonitoringAgent         ProductRuntimeOwnerID = "stackkits-monitoring-agent-runtime"
	ProductRuntimeOwnerModernHomeIdentity      ProductRuntimeOwnerID = "stackkits-modern-home-identity-trust-policy-manifest"
	ProductRuntimeOwnerModernCloudIdentity     ProductRuntimeOwnerID = "stackkits-modern-cloud-identity-verifier-policy-manifest"
	ProductRuntimeOwnerModernFederationPolicy  ProductRuntimeOwnerID = "stackkits-modern-federation-policy-manifest"
	ProductRuntimeOwnerFederationLink          ProductRuntimeOwnerID = "stackkits-federation-link-runtime"
	ProductRuntimeOwnerFederationControlAgent  ProductRuntimeOwnerID = "stackkits-federation-control-agent-runtime"
	ProductRuntimeOwnerFederationBackup        ProductRuntimeOwnerID = "stackkits-federation-backup-runtime"
	ProductRuntimeOwnerFederationObservability ProductRuntimeOwnerID = "stackkits-federation-observability-runtime"
	ProductRuntimeOwnerBridgePublication       ProductRuntimeOwnerID = "stackkits-bridge-publication-runtime"
	ProductRuntimeOwnerBridgeOriginMTLS        ProductRuntimeOwnerID = "stackkits-bridge-origin-mtls-runtime"
	ProductRuntimeOwnerHomePrivateRemoteAccess ProductRuntimeOwnerID = "stackkits-home-private-remote-access-runtime"
	ProductRuntimeOwnerHABasementWarm          ProductRuntimeOwnerID = "stackkits-ha-basement-warm-runtime"
	ProductRuntimeOwnerHABasementQuorum        ProductRuntimeOwnerID = "stackkits-ha-basement-quorum-runtime"
	ProductRuntimeOwnerHACloudWarm             ProductRuntimeOwnerID = "stackkits-ha-cloud-warm-runtime"
	ProductRuntimeOwnerHACloudQuorum           ProductRuntimeOwnerID = "stackkits-ha-cloud-quorum-runtime"
	ProductRuntimeOwnerHAModernWarm            ProductRuntimeOwnerID = "stackkits-ha-modern-warm-runtime"
	ProductRuntimeOwnerHAModernQuorum          ProductRuntimeOwnerID = "stackkits-ha-modern-quorum-runtime"
)

type ProductRuntimeOwnerLocalAdmissionError 

type ProductRuntimeOwnerLocalAdmissionError struct {
	RequirementID string
}

ProductRuntimeOwnerLocalAdmissionError reports that a selector was deliberately registered for authenticated remote execution and therefore cannot be materialized by the local channel builder.

func (*ProductRuntimeOwnerLocalAdmissionError) Error 

func (e *ProductRuntimeOwnerLocalAdmissionError) Error() string

type ProductRuntimeOwnerRegistration 

type ProductRuntimeOwnerRegistration struct {
	Selector     ProductRuntimeOwnerSelector
	Factory      ProductRuntimeOwnerFactory
	Execution    ProductRuntimeOwnerExecutionMode
	Compensation runtimeapply.CompensationMode
}

ProductRuntimeOwnerRegistration binds one closed selector either to one local factory or to explicit remote-only channel admission.

func NewProductBasementComposeRegistration 

func NewProductBasementComposeRegistration(runtimeVersion string, operations runtimeexecutorlocal.BasementComposeOperations) (ProductRuntimeOwnerRegistration, error)

NewProductBasementComposeRegistration binds only the optional Basement socket-proxy Compose unit to an authenticated local runtime owner. It does not make Compose a Kit-wide runtime and cannot select or discover Docker.

func NewProductBasementCoreLiteRegistration 

func NewProductBasementCoreLiteRegistration(runtimeVersion string, operations runtimeexecutorlocal.BasementCoreOperations) (ProductRuntimeOwnerRegistration, error)

NewProductBasementCoreLiteRegistration binds the same local Core owner to the CUE-selected reduced service graph. Apply and Verify still share the executor and OS operations; only the immutable selector/profile differs.

func NewProductBasementCoreRegistration 

func NewProductBasementCoreRegistration(runtimeVersion string, operations runtimeexecutorlocal.BasementCoreOperations) (ProductRuntimeOwnerRegistration, error)

NewProductBasementCoreRegistration binds only the CUE-owned standard Basement Compose unit to the local runtime owner.

func NewProductBasementIdentityTrustRegistration 

func NewProductBasementIdentityTrustRegistration(runtimeVersion string, operations runtimeexecutorlocal.BasementIdentityTrustPolicyOperations) (ProductRuntimeOwnerRegistration, error)

func NewProductBridgeOriginMTLSRegistration 

func NewProductBridgeOriginMTLSRegistration(runtimeVersion string, operations runtimeexecutorlocal.BridgeOriginMTLSOperations) (ProductRuntimeOwnerRegistration, error)

NewProductBridgeOriginMTLSRegistration binds the exact node-local Modern origin policy to an authenticated Home operations implementation.

func NewProductBridgePublicationRegistration 

func NewProductBridgePublicationRegistration(runtimeVersion string, operations runtimeexecutorlocal.BridgePublicationOperations) (ProductRuntimeOwnerRegistration, error)

NewProductBridgePublicationRegistration binds the exact node-local Modern publication policy to a construction-owned Cloud edge implementation.

func NewProductCloudCoreRegistration 

func NewProductCloudCoreRegistration(runtimeVersion string, operations runtimeexecutorlocal.CloudCoreOperations) (ProductRuntimeOwnerRegistration, error)

func NewProductCloudHostSecurityRegistration 

func NewProductCloudHostSecurityRegistration(runtimeVersion string, operations runtimeexecutorlocal.CloudHostSecurityOperations) (ProductRuntimeOwnerRegistration, error)

NewProductCloudHostSecurityRegistration binds the exact node-local Cloud firewall/hardening owner to an authenticated host-channel implementation. Provider lifecycle and host transport remain outside the registration.

func NewProductCloudIdentityTrustRegistration 

func NewProductCloudIdentityTrustRegistration(runtimeVersion string, operations runtimeexecutorlocal.CloudIdentityTrustPolicyOperations) (ProductRuntimeOwnerRegistration, error)

func NewProductCloudOffsiteBackupRegistration 

func NewProductCloudOffsiteBackupRegistration(runtimeVersion string, operations runtimeexecutorlocal.CloudOffsiteBackupOperations) (ProductRuntimeOwnerRegistration, error)

NewProductCloudOffsiteBackupRegistration binds the exact node-local backup target verifier. Provider selection, target lifecycle, connection material, and credentials remain inside the authenticated Operations implementation.

func NewProductCloudPublicEdgeRegistration 

func NewProductCloudPublicEdgeRegistration(runtimeVersion string, operations runtimeexecutorlocal.CloudPublicEdgeOperations) (ProductRuntimeOwnerRegistration, error)

NewProductCloudPublicEdgeRegistration binds only the Cloud node-local edge policy owner. DNS, certificate issuance, secrets, provider resources, and generic proxy commands are not part of its Operations capability.

func NewProductCloudStandaloneCoreRegistration 

func NewProductCloudStandaloneCoreRegistration(runtimeVersion string, operations runtimeexecutorlocal.CloudCoreOperations) (ProductRuntimeOwnerRegistration, error)

func NewProductCloudreveSelectedPaaSRegistration 

func NewProductCloudreveSelectedPaaSRegistration(
	runtimeVersion string,
	runtimeAdapterRef string,
	runtimeAdapterModuleRef string,
	operations runtimeexecutorlocal.SelectedPaaSWorkloadOperations,
) (ProductRuntimeOwnerRegistration, error)

func NewProductCoreHostBootstrapRegistration 

func NewProductCoreHostBootstrapRegistration(runtimeVersion string, operations runtimeexecutorlocal.CoreHostBootstrapOperations) (ProductRuntimeOwnerRegistration, error)

NewProductCoreHostBootstrapRegistration binds the exact Core host-bootstrap selector to one construction-owned node-local operations capability. The factory derives Site, node, and execution-channel scope only from the already verified RuntimeTarget passed by ProductRuntimeOwnerRegistry.

func NewProductFederationControlAgentRegistration 

func NewProductFederationControlAgentRegistration(runtimeVersion string, operations runtimeexecutorlocal.FederationControlAgentOperations) (ProductRuntimeOwnerRegistration, error)

NewProductFederationControlAgentRegistration binds exactly one governed Modern Site/node to service-constructed outbound control operations. The Operations implementation retains transport, credential and custody details.

func NewProductFederationLinkRegistration 

func NewProductFederationLinkRegistration(runtimeVersion string, operations runtimeexecutorlocal.FederationLinkOperations) (ProductRuntimeOwnerRegistration, error)

NewProductFederationLinkRegistration binds one exact node-local Modern federation policy to a construction-owned link implementation. Provider, endpoint, credential, lease, and fabric lifecycle authority remain outside StackKits.

func NewProductGiteaSelectedPaaSRegistration 

func NewProductGiteaSelectedPaaSRegistration(runtimeVersion, runtimeAdapterRef, runtimeAdapterModuleRef string, operations runtimeexecutorlocal.SelectedPaaSWorkloadOperations) (ProductRuntimeOwnerRegistration, error)

NewProductGiteaSelectedPaaSRegistration binds the explicit private Git workload to the existing selected application executor and operations owner.

func NewProductHAAvailabilityRegistration 

func NewProductHAAvailabilityRegistration(runtimeVersion, moduleRef string, operations runtimeexecutorlocal.HAAvailabilityOperations) (ProductRuntimeOwnerRegistration, error)

NewProductHAAvailabilityRegistration binds one of the six concrete CUE catalog realizations to the single provider-free member-local owner.

func NewProductHomeAccessRegistration 

func NewProductHomeAccessRegistration(runtimeVersion string, operations runtimeexecutorlocal.HomeAccessPolicyOperations) (ProductRuntimeOwnerRegistration, error)

NewProductHomeAccessRegistration binds the exact node-local Home access selector to construction-owned enforcement operations. Discovery, endpoints, credentials, transports, and provider lifecycle remain outside this factory.

func NewProductHomeAssistantSelectedPaaSRegistration 

func NewProductHomeAssistantSelectedPaaSRegistration(
	runtimeVersion, runtimeAdapterRef, runtimeAdapterModuleRef string,
	operations runtimeexecutorlocal.SelectedPaaSWorkloadOperations,
) (ProductRuntimeOwnerRegistration, error)

NewProductHomeAssistantSelectedPaaSRegistration binds the self-hosted Home Assistant container workload to one explicitly selected application adapter implementation. External HAOS or imported instances are not container workloads and never match this selector.

func NewProductHomeBackupTargetRegistration 

func NewProductHomeBackupTargetRegistration(runtimeVersion string, operations runtimeexecutorlocal.HomeBackupTargetOperations) (ProductRuntimeOwnerRegistration, error)

NewProductHomeBackupTargetRegistration binds the exact Home backup-target selector to one construction-owned observation capability. Core owns directory creation; this owner can only verify the already prepared target.

func NewProductHomeDeviceAuthorityRegistration 

func NewProductHomeDeviceAuthorityRegistration(runtimeVersion string, operations runtimeexecutorlocal.HomeDeviceAuthorityPolicyOperations) (ProductRuntimeOwnerRegistration, error)

NewProductHomeDeviceAuthorityRegistration binds the exact node-local Home device-authority selector to construction-owned enforcement operations. Credentials, keys, endpoints, discovery, and provider lifecycle remain outside this factory and the generated policy artifact.

func NewProductHostAdmissionRegistration 

func NewProductHostAdmissionRegistration(runtimeVersion string) (ProductRuntimeOwnerRegistration, error)

func NewProductImmichSelectedPaaSRegistration 

func NewProductImmichSelectedPaaSRegistration(
	runtimeVersion string,
	runtimeAdapterRef string,
	runtimeAdapterModuleRef string,
	operations runtimeexecutorlocal.SelectedPaaSWorkloadOperations,
) (ProductRuntimeOwnerRegistration, error)

NewProductImmichSelectedPaaSRegistration binds the governed Immich workload to one explicitly selected PaaS adapter implementation. StackKits fixes the catalog selector and exact request authority; the supplied operations owner retains PaaS API, endpoint, credential, and lifecycle custody.

func NewProductInternalPKIRegistration 

func NewProductInternalPKIRegistration(
	runtimeVersion string,
	root runtimeexecutorlocal.InternalPKIRootOperations,
	leaf runtimeexecutorlocal.InternalPKILeafOperations,
	trust runtimeexecutorlocal.InternalPKITrustOperations,
	verify runtimeexecutorlocal.InternalPKIVerifyOperations,
) (ProductRuntimeOwnerRegistration, error)

NewProductInternalPKIRegistration binds the single authority-node policy to four separately constructed operations owners. Certificate/key material and authenticated transport remain outside StackKits.

func NewProductJellyfinSelectedPaaSRegistration 

func NewProductJellyfinSelectedPaaSRegistration(
	runtimeVersion, runtimeAdapterRef, runtimeAdapterModuleRef string,
	operations runtimeexecutorlocal.SelectedPaaSWorkloadOperations,
) (ProductRuntimeOwnerRegistration, error)

NewProductJellyfinSelectedPaaSRegistration binds the Media Library workload to one explicitly selected application adapter implementation.

func NewProductLocalAutonomyRegistration 

func NewProductLocalAutonomyRegistration(runtimeVersion string, operations runtimeexecutorlocal.LocalAutonomyPolicyOperations) (ProductRuntimeOwnerRegistration, error)

NewProductLocalAutonomyRegistration binds the exact Home control-authority node to construction-owned offline-autonomy enforcement operations.

func NewProductModernCloudIdentityRegistration 

func NewProductModernCloudIdentityRegistration(runtimeVersion string, operations runtimeexecutorlocal.ModernCloudIdentityVerifierPolicyOperations) (ProductRuntimeOwnerRegistration, error)

NewProductModernCloudIdentityRegistration binds only the node-local Cloud verifier target. It cannot construct or obtain a Home-authority executor.

func NewProductModernHomeIdentityRegistration 

func NewProductModernHomeIdentityRegistration(runtimeVersion string, operations runtimeexecutorlocal.ModernHomeIdentityTrustPolicyOperations) (ProductRuntimeOwnerRegistration, error)

NewProductModernHomeIdentityRegistration binds only the node-local Home authority target. Transport, endpoints, credentials and provider lifecycle remain outside StackKits and outside this factory.

func NewProductPaperlessSelectedPaaSRegistration 

func NewProductPaperlessSelectedPaaSRegistration(
	runtimeVersion, runtimeAdapterRef, runtimeAdapterModuleRef string,
	operations runtimeexecutorlocal.SelectedPaaSWorkloadOperations,
) (ProductRuntimeOwnerRegistration, error)

NewProductPaperlessSelectedPaaSRegistration binds the Documents workload to the existing standalone application adapter and lifecycle owner.

func NewProductPrivateAISelectedPaaSRegistration 

func NewProductPrivateAISelectedPaaSRegistration(
	runtimeVersion string,
	runtimeAdapterRef string,
	runtimeAdapterModuleRef string,
	operations runtimeexecutorlocal.SelectedPaaSWorkloadOperations,
) (ProductRuntimeOwnerRegistration, error)

func NewProductPublicTLSRegistration 

func NewProductPublicTLSRegistration(runtimeVersion string, operations runtimeexecutorlocal.PublicTLSOperations) (ProductRuntimeOwnerRegistration, error)

NewProductPublicTLSRegistration binds the node-local public TLS policy to an authenticated Cloud operations implementation. ACME credentials and certificate material remain construction-owned by that implementation.

func NewProductRemoteCloudreveSelectedPaaSRegistration 

func NewProductRemoteCloudreveSelectedPaaSRegistration(runtimeAdapterRef, runtimeAdapterModuleRef string) (ProductRuntimeOwnerRegistration, error)

NewProductRemoteCloudreveSelectedPaaSRegistration binds the Files vertical to one exact service-owned PaaS adapter without granting provider lifecycle.

func NewProductRemoteImmichSelectedPaaSRegistration 

func NewProductRemoteImmichSelectedPaaSRegistration(runtimeAdapterRef, runtimeAdapterModuleRef string) (ProductRuntimeOwnerRegistration, error)

NewProductRemoteImmichSelectedPaaSRegistration binds the governed Immich selector to one exact service-owned PaaS adapter identity without requiring that service to possess a local PaaS Operations implementation.

func NewProductRemoteRuntimeOwnerRegistration 

func NewProductRemoteRuntimeOwnerRegistration(selector ProductRuntimeOwnerSelector) (ProductRuntimeOwnerRegistration, error)

NewProductRemoteRuntimeOwnerRegistration explicitly admits one selector only through a service-owned remote channel. It carries no placeholder local Operations dependency and cannot be used by a local channel admission.

func NewProductRemoteStaticRuntimeOwnerRegistrations 

func NewProductRemoteStaticRuntimeOwnerRegistrations(ids ...ProductRuntimeOwnerID) ([]ProductRuntimeOwnerRegistration, error)

NewProductRemoteStaticRuntimeOwnerRegistrations resolves a service-owned allowlist of stable IDs into exact remote-only registrations. Input order is preserved for deterministic construction diagnostics; unknown or duplicate IDs fail before any registry or channel admission exists.

func NewProductRemoteVaultwardenSelectedPaaSRegistration 

func NewProductRemoteVaultwardenSelectedPaaSRegistration(runtimeAdapterRef, runtimeAdapterModuleRef string) (ProductRuntimeOwnerRegistration, error)

NewProductRemoteVaultwardenSelectedPaaSRegistration binds the Vault vertical to one exact service-owned PaaS adapter without granting credential or provider lifecycle authority.

func NewProductSecurityBaselineRegistration 

func NewProductSecurityBaselineRegistration(runtimeVersion string) (ProductRuntimeOwnerRegistration, error)

NewProductSecurityBaselineRegistration binds the shared, node-local security baseline to the bounded OS command adapter. The adapter accepts only the exact generated CUE policy and has no provider, network, lease, credential, or workspace authority.

func NewProductVaultwardenSelectedPaaSRegistration 

func NewProductVaultwardenSelectedPaaSRegistration(
	runtimeVersion string,
	runtimeAdapterRef string,
	runtimeAdapterModuleRef string,
	operations runtimeexecutorlocal.SelectedPaaSWorkloadOperations,
) (ProductRuntimeOwnerRegistration, error)

type ProductRuntimeOwnerRegistry 

type ProductRuntimeOwnerRegistry struct {
	// contains filtered or unexported fields
}

ProductRuntimeOwnerRegistry is immutable after construction. It owns no provider lifecycle, endpoint, credential, transport, lease, or generation authority.

func NewProductRuntimeOwnerRegistry 

func NewProductRuntimeOwnerRegistry(identity runtimeexecutor.ExecutorIdentity, registrations []ProductRuntimeOwnerRegistration, channels ProductExecutionChannelFactory) (*ProductRuntimeOwnerRegistry, error)

NewProductRuntimeOwnerRegistry constructs a service-owned exact registry.

func NewProductRuntimeOwnerRegistryWithJournal 

func NewProductRuntimeOwnerRegistryWithJournal(identity runtimeexecutor.ExecutorIdentity, registrations []ProductRuntimeOwnerRegistration, channels ProductExecutionChannelFactory, journal runtimeapply.Journal) (*ProductRuntimeOwnerRegistry, error)

NewProductRuntimeOwnerRegistryWithJournal fixes the integration-owned provider-neutral durable journal at construction. Apply callers cannot provide or replace it.

func NewProductRuntimeOwnerRegistryWithRecovery 

func NewProductRuntimeOwnerRegistryWithRecovery(identity runtimeexecutor.ExecutorIdentity, registrations []ProductRuntimeOwnerRegistration, channels ProductExecutionChannelFactory, journal runtimeapply.Journal, recovery ProductApplyRecoveryStore) (*ProductRuntimeOwnerRegistry, error)

NewProductRuntimeOwnerRegistryWithRecovery fixes both durable operation state and exact pre-mutation request custody at construction.

func (*ProductRuntimeOwnerRegistry) Execute 

func (r *ProductRuntimeOwnerRegistry) Execute(ctx context.Context, request runtimeexecutor.ExecutionRequest) (runtimeexecutor.ExecutionOutcome, error)

Execute realizes the already-sealed request only through the immutable service-owned registry. Complete factory/routing preflight finishes before the nested dispatcher can invoke a child.

func (*ProductRuntimeOwnerRegistry) Identity 

func (r *ProductRuntimeOwnerRegistry) Identity() runtimeexecutor.ExecutorIdentity

Identity returns the immutable product-owned root executor identity. It is fixed before authorization and cannot be selected by an Apply request.

type ProductRuntimeOwnerRequest 

type ProductRuntimeOwnerRequest struct {
	Target        runtimeexecutor.RuntimeTarget
	HealthTargets []runtimeexecutor.HealthTarget
}

ProductRuntimeOwnerRequest is the complete provider-free preparation input for one exact target. A factory is service-owned and fixed at registry construction; Apply callers cannot provide or replace it.

type ProductRuntimeOwnerSelector 

type ProductRuntimeOwnerSelector struct {
	OwnerKind               string
	OwnerRef                string
	ProviderRef             string
	ModuleRef               string
	UnitRef                 string
	RuntimeKind             string
	RuntimeDelivery         string
	RuntimeEngine           string
	WorkloadRef             string
	RuntimeAdapterRef       string
	RuntimeAdapterModuleRef string
}

ProductRuntimeOwnerSelector is the stable CUE/catalog identity a product integration is willing to realize. Dynamic contract hashes, target scope, workload payload, artifact refs, and access authority remain in the exact RuntimeTarget passed to the factory and bound by OwnerRouter.

type ResolveError 

type ResolveError struct {
	Code    ErrorCode                  `json:"code"`
	Message string                     `json:"message"`
	Report  *stackspecmigration.Report `json:"migrationReport,omitempty"`
	Cause   error                      `json:"-"`
}

ResolveError preserves the underlying diagnostic and, for v1 input, the mandatory structured migration report. Report is never populated for a v2 compiler failure.

func (*ResolveError) Error 

func (e *ResolveError) Error() string

func (*ResolveError) Unwrap 

func (e *ResolveError) Unwrap() error

Unwrap keeps errors.As support for stackspecmigration and resolvedplan callers while the stable Code remains the public adapter contract.

type ResolveInput 

type ResolveInput struct {
	StackSpec        []byte
	Inventory        []byte
	TargetKitProfile stackspecmigration.KitProfile
}

ResolveInput contains raw desired intent plus separately observed inventory. TargetKitProfile is used only to make a v1 migration report more precise; it never changes or selects a v2 kit.

type Result 

type Result struct {
	Plan          resolvedplan.ResolvedPlan
	CanonicalPlan []byte
	PlanHash      string
}

Result is the only successful architecture boundary. CanonicalPlan is stable JSON and PlanHash is the hash embedded in that exact normalized plan.

type RetiredOutputGCAction 

type RetiredOutputGCAction = execution.RetiredOutputGCAction

RetiredOutputGCAction names the only bounded retired-tombstone mutation.

type RetiredOutputGCInspection 

type RetiredOutputGCInspection = execution.RetiredOutputGCInspection

RetiredOutputGCInspection is the explicit, one-action cleanup report for a completed output-transaction tombstone.

func InspectRetiredOutputGC 

func InspectRetiredOutputGC(workspace *confinedfs.Transaction, transactionID string) (RetiredOutputGCInspection, error)

type Service 

type Service struct {
	// contains filtered or unexported fields
}

Service owns one immutable CUE authority snapshot and one deterministic compiler. It is safe for concurrent CLI/API resolution.

func NewEmbeddedContractFixtureService 

func NewEmbeddedContractFixtureService(contract CompilerContract) (*Service, error)

NewEmbeddedContractFixtureService is the checkout-independent counterpart used by committed contract fixtures and the renderer E2E gate. The embedded fixture catalog is isolated from the product catalog by construction.

func NewEmbeddedService 

func NewEmbeddedService(contract CompilerContract) (*Service, error)

NewEmbeddedService loads the generated, drift-tested authority bundled with the binary. Resolution is therefore independent of repository checkout and process working directory while CUE remains the validating schema authority.

func NewFilesystemContractFixtureService 

func NewFilesystemContractFixtureService(moduleRoot string, contract CompilerContract) (*Service, error)

NewFilesystemContractFixtureService loads the deliberately non-product contract-fixture catalog from moduleRoot. It accepts only the Basement definition and exists for deterministic contract generation and tests; it must never be used to infer product readiness.

func NewFilesystemService 

func NewFilesystemService(moduleRoot string, contract CompilerContract) (*Service, error)

NewFilesystemService loads all three kit Definitions and the governed catalog directly from moduleRoot.

func NewProductEmbeddedService 

func NewProductEmbeddedService(contract CompilerContract) (*Service, error)

NewProductEmbeddedService creates the product authority used by native CLI execution. Its public evidence anchors come only from the fixed OS-level StackKit trust store; request callers cannot supply or override them.

func NewProductEmbeddedServiceWithApplyEvidenceCollector 

func NewProductEmbeddedServiceWithApplyEvidenceCollector(contract CompilerContract, collector ProductApplyEvidenceCollector) (*Service, error)

NewProductEmbeddedServiceWithApplyEvidenceCollector creates a product authority whose provider-free collector is fixed at service construction. Apply callers cannot supply or replace the collector, its private signing material, or the public trust roots used to authenticate its result.

func NewProductEmbeddedServiceWithLocalApplyVerification 

func NewProductEmbeddedServiceWithLocalApplyVerification(
	contract CompilerContract,
	identity runtimeexecutor.ExecutorIdentity,
	anchors []ProductApplyTrustAnchor,
) (*Service, error)

NewProductEmbeddedServiceWithLocalApplyVerification constructs the read-only standalone verifier. It owns the exact runtime identity and local producer trust but no collector, journal, recovery store, execution channel, or runtime mutation capability.

func NewProductEmbeddedServiceWithRuntimeOwners 

func NewProductEmbeddedServiceWithRuntimeOwners(
	contract CompilerContract,
	identity runtimeexecutor.ExecutorIdentity,
	registrations []ProductRuntimeOwnerRegistration,
	channels ProductExecutionChannelFactory,
	journal runtimeapply.Journal,
	recovery ProductApplyRecoveryStore,
) (*Service, error)

NewProductEmbeddedServiceWithRuntimeOwners creates a product service whose complete provider-free runtime-owner set, execution-channel authority, root executor identity, durable Journal, and exact recovery custody are fixed together at construction. Apply callers cannot supply or replace any of them.

func NewProductEmbeddedServiceWithRuntimeOwnersAndApplyEvidenceCollector 

func NewProductEmbeddedServiceWithRuntimeOwnersAndApplyEvidenceCollector(
	contract CompilerContract,
	identity runtimeexecutor.ExecutorIdentity,
	registrations []ProductRuntimeOwnerRegistration,
	channels ProductExecutionChannelFactory,
	journal runtimeapply.Journal,
	recovery ProductApplyRecoveryStore,
	collector ProductApplyEvidenceCollector,
) (*Service, error)

NewProductEmbeddedServiceWithRuntimeOwnersAndApplyEvidenceCollector fixes the complete runtime-owner graph and the pre-Apply evidence producer at the same construction boundary. The collector owns inspection and signing privately; Apply callers cannot supply evidence, factories, channels, Journal, recovery custody, or trust roots.

func NewProductEmbeddedServiceWithRuntimeOwnersAndLocalApplyEvidence 

func NewProductEmbeddedServiceWithRuntimeOwnersAndLocalApplyEvidence(
	contract CompilerContract,
	identity runtimeexecutor.ExecutorIdentity,
	registrations []ProductRuntimeOwnerRegistration,
	channels ProductExecutionChannelFactory,
	journal runtimeapply.Journal,
	recovery ProductApplyRecoveryStore,
	collector ProductApplyEvidenceCollector,
	anchors []ProductApplyTrustAnchor,
) (*Service, error)

NewProductEmbeddedServiceWithRuntimeOwnersAndLocalApplyEvidence fixes a local collector and its public verification anchor at the same composition boundary. This is the standalone counterpart to the OS-level producer trust store: the private key never leaves local custody and request callers never receive a trust-root parameter.

func NewService 

func NewService(moduleRoot string, contract CompilerContract) (*Service, error)

NewService is the compatibility name for an explicit filesystem authority. New integrations should use NewEmbeddedService by default and select NewFilesystemService only for an intentional development/operator override.

func (*Service) AuthorizeGeneration 

func (s *Service) AuthorizeGeneration(input GenerationAuthorizationInput) (GenerationAuthorization, error)

AuthorizeGeneration binds generation to a fresh resolver result issued by this service authority's exact generation coordinator. The persisted plan must match that result byte for byte before compatibility and readiness run.

func (*Service) ExecuteProductApply 

func (s *Service) ExecuteProductApply(ctx context.Context, input ProductApplyInput) (result VerifiedApplyResult, returnErr error)

ExecuteProductApply is the sole product entry into the native-v2 executor registry. It never accepts an adapter, executor identity, or trust root from the command/request caller.

func (*Service) InitialStackSpecAuthoringContract 

func (s *Service) InitialStackSpecAuthoringContract(profile stackspecmigration.KitProfile) (InitialStackSpecAuthoring, error)

InitialStackSpecAuthoringContract returns the CUE-owned authoring status and required override paths for one canonical product kit.

func (*Service) ListApplicationDeliveryCompatibility 

func (s *Service) ListApplicationDeliveryCompatibility() ([]ApplicationDeliveryCompatibilityEntry, error)

ListApplicationDeliveryCompatibility returns the complete application delivery matrix from the immutable embedded CUE catalog. It reports product support, not selected plan state, runtime availability, or live evidence.

func (*Service) ListModuleProfileContracts 

func (s *Service) ListModuleProfileContracts() ([]ModuleProfileCatalogEntry, error)

func (*Service) ListSupportedAddOns 

func (s *Service) ListSupportedAddOns(profile stackspecmigration.KitProfile) ([]AddOnCatalogEntry, error)

ListSupportedAddOns returns the embedded catalog entries that declare support for profile. Results and each SupportedKits list are sorted so callers never depend on map, CUE, or bundle serialization order.

This is discovery metadata only. Presence in this list is not an authoring, mutation, plan-readiness, or deployment claim.

func (*Service) MaterializeInitialStackSpec 

func (s *Service) MaterializeInitialStackSpec(profile stackspecmigration.KitProfile, overrides AuthoringOverrides) (StackSpecValidation, error)

MaterializeInitialStackSpec selects one canonical product Definition, clones its authoring.initialSpec, applies only the approved init overrides, and revalidates the result through this service's CUE-bound authority.

func (*Service) PersistCanonicalPlan 

func (s *Service) PersistCanonicalPlan(path string, canonical []byte) (generationartifact.VerifiedPlan, error)

PersistCanonicalPlan applies the same embedded-authority verification before atomically replacing a regular non-symlink target with mode 0600.

func (*Service) ReadCanonicalPlan 

func (s *Service) ReadCanonicalPlan(path string) (generationartifact.VerifiedPlan, error)

ReadCanonicalPlan verifies a persisted plan through the same immutable CUE authority used for resolution and rejects symlinked/non-regular inputs.

func (*Service) ReconcileProductApply 

func (s *Service) ReconcileProductApply(ctx context.Context, input ProductApplyReconcileInput) (VerifiedApplyResult, error)

ReconcileProductApply resumes one exact custody-bound Product Apply after a process restart. It revalidates the current plan and every generated byte under the held output lock before the service-owned registry may continue.

func (*Service) Resolve 

func (s *Service) Resolve(input ResolveInput) (Result, error)

Resolve accepts canonical v2 only. v1 is classified through the shared migration reader and always returns MigrationRequired/MigrationBlocked with a report; there is no raw-spec or partial-projection compiler fallback.

func (*Service) ResolveCurrent 

func (s *Service) ResolveCurrent(input ResolveInput) (CurrentResolution, error)

ResolveCurrent resolves current StackSpec intent plus observed inventory and seals the exact canonical output for the later renderer-authorization gate. Ordinary Resolve results intentionally cannot be upgraded into this proof.

func (*Service) ResolveCurrentScoped 

func (s *Service) ResolveCurrentScoped(input ResolveInput, authorityScope string) (CurrentResolution, error)

ResolveCurrentScoped isolates freshness and replay state for callers whose Stack IDs are unique only inside an authenticated authority scope. The scope never enters the ResolvedPlan, request wire, evidence, or generated output.

func (*Service) ValidateFederationRemoteActionEnvelope 

func (s *Service) ValidateFederationRemoteActionEnvelope(raw []byte) error

ValidateFederationRemoteActionEnvelope uses this service's immutable CUE authority, including its closed remote-action shape.

func (*Service) ValidateStackSpec 

func (s *Service) ValidateStackSpec(raw []byte) (StackSpecValidation, error)

ValidateStackSpec validates canonical desired intent against its selected Kit Definition without substituting an empty Inventory.

func (*Service) VerifyCanonicalPlan 

func (s *Service) VerifyCanonicalPlan(canonical []byte) (generationartifact.VerifiedPlan, error)

VerifyCanonicalPlan revalidates a persisted plan through this service's already-bound embedded or explicit filesystem CUE authority. Callers never receive the authority pointer and cannot substitute a weaker validator.

func (*Service) VerifyProductApplyResult 

func (s *Service) VerifyProductApplyResult(input ProductApplyResultVerificationInput) (VerifiedApplyResult, error)

VerifyProductApplyResult revalidates one self-contained, content-addressed Apply result against the exact current plan, generation controls, local producer trust, and product-owned executor identity.

type StackSpecValidation 

type StackSpecValidation struct {
	KitProfile         stackspecmigration.KitProfile
	CanonicalStackSpec []byte
	SpecHash           string
}

StackSpecValidation is spec-only governed evidence. It deliberately makes no inventory-specific ResolvedPlan or execution-readiness claim.

type StandaloneOwnerAuthoring 

type StandaloneOwnerAuthoring struct {
	Source               string
	SiteRef              string
	NodeRef              string
	ExecutionChannelRef  string
	IdentityProvider     string
	CertificateAuthority string
	HumanAuthorityRef    string
	HumanIssuerRef       string
	TrustDomainRef       string
}

StandaloneOwnerAuthoring is the CUE-owned local owner/bootstrap projection for a kit that supports account-free standalone initialization.

type VerifiedApplyAuthorization 

type VerifiedApplyAuthorization struct {
	// contains filtered or unexported fields
}

VerifiedApplyAuthorization is the non-forgeable, one-shot result of the complete held-workspace Apply gate. Copies share consumption and close state. No package outside architecturev2 can turn it into executor input.

func (VerifiedApplyAuthorization) Close 

func (a VerifiedApplyAuthorization) Close() error

Close invalidates an unconsumed authorization or waits for the active package-owned consumer. It is idempotent across value copies.

type VerifiedApplyResult 

type VerifiedApplyResult struct {
	// contains filtered or unexported fields
}

VerifiedApplyResult is a defensive, hash-bound post-Apply projection. It is not a provider lifecycle receipt and contains no provider-native handles.

func (VerifiedApplyResult) Canonical 

func (r VerifiedApplyResult) Canonical() ([]byte, error)

Canonical returns the immutable, hash-bound result envelope. The result hash is intentionally the content address and is not embedded recursively.

func (VerifiedApplyResult) ExecutorIdentity 

func (r VerifiedApplyResult) ExecutorIdentity() generationartifact.ApplyExecutorIdentity

ExecutorIdentity returns the exact product-owned executor that produced the verified Apply result. Upgrade recovery uses this version to select the workspace release receipt that was actually applied, never the version of a newer CLI process inspecting the workspace.

func (VerifiedApplyResult) ObservationSummary 

func (r VerifiedApplyResult) ObservationSummary() ApplyObservationSummary

ObservationSummary returns defensive copies of the exact validated runtime and health outcome links. It never exposes request payloads or evidence bytes.

func (VerifiedApplyResult) ResultHash 

func (r VerifiedApplyResult) ResultHash() string

func (VerifiedApplyResult) Summary 

func (r VerifiedApplyResult) Summary() ApplyResultSummary

Summary returns a defensive public projection.

Source Files

View all Source files

Directories

Path Synopsis
cmd
bundlegen command
Command bundlegen builds the deterministic embedded Architecture v2 authority projection.
 Command bundlegen builds the deterministic embedded Architecture v2 authority projection.
internal
execution
Package execution owns the held-root installation transaction used by the Architecture v2 authority boundary.
 Package execution owns the held-root installation transaction used by the Architecture v2 authority boundary.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.