Documentation
¶
Overview ¶
Package federationbinding owns account-free local admission of opaque, externally realized Federation-link bindings. It has no provider client, endpoint, credential, transport, or fabric lifecycle API.
Index ¶
- Constants
- func DecodeUnsignedProductionBinding(raw []byte) (resolvedplan.ExternalFederationLinkBinding, error)
- func Import(workspaceRoot string, raw []byte, ...) (resolvedplan.ExternalFederationLinkBinding, error)
- func ImportIntoInventory(workspaceRoot string, raw []byte, ...) (resolvedplan.InventoryFacts, error)
- func IssueHermeticProof(workspaceRoot string, request HermeticIssueRequest) ([]byte, error)
- func SignProductionImport(workspaceRoot string, binding resolvedplan.ExternalFederationLinkBinding, ...) ([]byte, error)
- type Admission
- type HermeticIssueRequest
- type ImportOptions
Constants ¶
const ( AdmissionAPIVersion = "stackkit.owner-federation-link-binding-admission/v1" PurposeProductionImport = "production-import" PurposeHermeticProof = "hermetic-live-proof" )
Variables ¶
This section is empty.
Functions ¶
func DecodeUnsignedProductionBinding ¶
func DecodeUnsignedProductionBinding(raw []byte) (resolvedplan.ExternalFederationLinkBinding, error)
DecodeUnsignedProductionBinding accepts only the closed, unsigned external binding body. Admission envelopes, signatures, credentials, endpoints, provider fields, duplicate JSON names, and trailing values fail closed.
func Import ¶
func Import(workspaceRoot string, raw []byte, requirement resolvedplan.FederationLinkRequirement, at time.Time, options ImportOptions) (resolvedplan.ExternalFederationLinkBinding, error)
Import verifies closed wire shape, purpose, exact compiler requirement, lifetime, binding hash, and current local Owner custody before returning a detached binding. No state or external system is mutated.
func ImportIntoInventory ¶
func ImportIntoInventory(workspaceRoot string, raw []byte, requirement resolvedplan.FederationLinkRequirement, inventory resolvedplan.InventoryFacts, at time.Time, options ImportOptions) (resolvedplan.InventoryFacts, error)
ImportIntoInventory performs the same fail-closed admission and injects only the closed binding body into a detached Inventory value.
func IssueHermeticProof ¶
func IssueHermeticProof(workspaceRoot string, request HermeticIssueRequest) ([]byte, error)
IssueHermeticProof creates a deterministic, short-lived opaque projection for a hermetic live-proof fixture. Its distinct purpose is rejected by production Import unless the caller explicitly opts into the proof lane.
func SignProductionImport ¶
func SignProductionImport(workspaceRoot string, binding resolvedplan.ExternalFederationLinkBinding, requirement resolvedplan.FederationLinkRequirement, at time.Time) ([]byte, error)
SignProductionImport validates an already externally supplied opaque binding, then records the local Owner's explicit adoption. It creates no binding, provider resource, fabric, endpoint, or credential.
Types ¶
type Admission ¶
type Admission struct {
APIVersion string `json:"apiVersion"`
Kind string `json:"kind"`
Purpose string `json:"purpose"`
Binding resolvedplan.ExternalFederationLinkBinding `json:"binding"`
Signature localevidence.OwnerFederationBindingAdmissionSignature `json:"ownerSignature"`
}
Admission is the owner-signed import envelope. Only Binding crosses into Inventory; the envelope remains local custody evidence.
type HermeticIssueRequest ¶
type HermeticIssueRequest struct {
Requirement resolvedplan.FederationLinkRequirement
StackKitsVersion string
CandidateDigest string
IssuedAt time.Time
Validity time.Duration
Nonce []byte
}
HermeticIssueRequest contains only immutable release/requirement identity and a caller-owned nonce. The nonce is hashed and never emitted.
type ImportOptions ¶
type ImportOptions struct {
AllowHermeticProof bool
}
ImportOptions makes hermetic admission an explicit test-lane decision. Production callers use the zero value and therefore reject proof bindings.
Source Files