generationartifact

package
v0.41.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 24, 2026 License: Apache-2.0 Imports: 22 Imported by: 0

Documentation

Overview

Package generationartifact binds renderer outputs to one verified Architecture v2 ResolvedPlan. It is intentionally independent from the legacy StackSpec v1 generation path.

Index

Constants

View Source 
const (
	ApplyRequirementsAPIVersion    = "stackkit.apply-requirements/v1"
	ApplyEvidenceBundleAPIVersion  = "stackkit.apply-evidence/v1"
	ApplyEvidenceBundleKind        = "ApplyEvidenceBundle"
	ApplyEvidenceReceiptAPIVersion = "stackkit.apply-evidence-receipt/v1"
	ApplyEvidenceReceiptKind       = "ApplyEvidenceReceipt"

	// MaxApplyEvidenceValidity is intentionally short and versioned with the
	// receipt contract. Producers cannot mint arbitrarily long-lived Apply
	// evidence. A later CUE policy may narrow this window, never widen v1.
	MaxApplyEvidenceValidity = 15 * time.Minute
)
View Source 
const (
	ApplyExecutionClassExecutable      = "executable"
	ApplyExecutionClassContractHandoff = "contract-handoff"
	ApplyExecutionClassArtifactOnly    = "artifact-only"
	ApplyExecutionClassPlan            = "plan"
)
View Source 
const (
	ArtifactManifestAPIVersion  = "stackkit.generation-artifacts/v2"
	ArtifactManifestKind        = "GenerationArtifactManifest"
	GenerationReceiptAPIVersion = "stackkit.generation-receipt/v1"
	GenerationReceiptKind       = "GenerationReceipt"
	ArtifactManifestFileName    = "generation-manifest.json"
	GenerationReceiptFileName   = "generation-receipt.json"
)
View Source 
const (
	PlanInspectionAPIVersion       = "stackkit.plan-inspection/v1"
	PlanInspectionKind             = "PlanInspection"
	InfrastructureDiffNotAvailable = "not-available"
)

Variables

This section is empty.

Functions

func ApplyEvidenceProducerKeyID 

func ApplyEvidenceProducerKeyID(publicKey ed25519.PublicKey) string

ApplyEvidenceProducerKeyID returns the canonical provider-free identity for one trusted Ed25519 producer key.

func ApplyEvidenceReceiptSigningBytes 

func ApplyEvidenceReceiptSigningBytes(receipt ApplyEvidenceReceipt) ([]byte, error)

func ComputeApplyEvidenceBundleHash 

func ComputeApplyEvidenceBundleHash(bundle ApplyEvidenceBundle) (string, error)

func ComputeApplyEvidenceReceiptDigest 

func ComputeApplyEvidenceReceiptDigest(receipt ApplyEvidenceReceipt) (string, error)

func ComputeApplyRequirementsHash 

func ComputeApplyRequirementsHash(requirements ApplyRequirements) (string, error)

func ExecutorNotImplemented 

func ExecutorNotImplemented(renderer RendererIdentity) error

ExecutorNotImplemented prevents a verified v2 artifact set from falling through to an executor initialized from the legacy StackSpec v1 model.

func PersistManifest 

func PersistManifest(filePath string, plan VerifiedPlan, manifest ArtifactManifest) error

func PersistManifestHeld 

func PersistManifestHeld(plan VerifiedPlan, workspace *confinedfs.Transaction, prefix string, manifest ArtifactManifest) error

PersistManifestHeld writes canonical manifest bytes exclusively beneath the held private stage. It never accepts or opens an absolute pathname.

func PersistReceipt 

func PersistReceipt(filePath string, plan VerifiedPlan, manifest ArtifactManifest, receipt GenerationReceipt) error

func PersistReceiptHeld 

func PersistReceiptHeld(plan VerifiedPlan, workspace *confinedfs.Transaction, prefix string, manifest ArtifactManifest, receipt GenerationReceipt) error

PersistReceiptHeld writes canonical receipt bytes exclusively beneath the same held private stage. The receipt remains the final control write.

func RendererNotImplemented 

func RendererNotImplemented(renderer RendererIdentity) error

RendererNotImplemented reports the intentional boundary between a ready governed plan and a concrete v2 renderer. It must be returned before any legacy StackSpec v1 generator is entered.

func ValidateApplyEvidenceProducerAnchor 

func ValidateApplyEvidenceProducerAnchor(producer ApplyEvidenceProducer, publicKey ed25519.PublicKey) error

ValidateApplyEvidenceProducerAnchor validates one public producer identity before product code expands its plan-independent scope into exact receipt IDs. Private signing material is never part of this contract.

func ValidateApplyEvidenceProducerTrust 

func ValidateApplyEvidenceProducerTrust(trust ApplyEvidenceProducerTrust) error

ValidateApplyEvidenceProducerTrust validates the exact, plan-scoped trust entry consumed by evidence verification.

func ValidateApplyExecutorIdentity 

func ValidateApplyExecutorIdentity(identity ApplyExecutorIdentity) error

ValidateApplyExecutorIdentity validates the complete immutable identity used by an Apply authorizer and its evidence producers.

func VerifierNotImplemented 

func VerifierNotImplemented(renderer RendererIdentity) error

VerifierNotImplemented prevents a verified v2 plan from falling through to the legacy local-Docker or raw-SSH verifier while the plan-bound host conformance implementation is still under construction.

func VerifyExecution 

func VerifyExecution(input ExecutionGateInput) error

VerifyExecution is the only top-level generation/apply authorization gate. Its order is intentional and stable: current resolver identity, phase, component compatibility, signed readiness, manifest bytes, receipt, then exact binding to the canonical control files beneath the governed root.

func VerifyManifest 

func VerifyManifest(plan VerifiedPlan, root string, manifest ArtifactManifest) error

VerifyManifest checks contract identity, re-hashes every listed file, and proves that outputRoot contains no undeclared executor input.

func VerifyManifestHeld 

func VerifyManifestHeld(plan VerifiedPlan, workspace *confinedfs.Transaction, prefix string, manifest ArtifactManifest) error

VerifyManifestHeld validates and re-hashes every artifact through the held workspace transaction and proves the governed output tree is closed.

func VerifyReceipt 

func VerifyReceipt(plan VerifiedPlan, manifest ArtifactManifest, receipt GenerationReceipt) error

VerifyReceipt validates the plan and manifest identity. GeneratedAt is deliberately ignored and therefore cannot make a fresh or stale decision.

Types

type ApplyAccessBindingRequirement 

type ApplyAccessBindingRequirement struct {
	ID                     string   `json:"id"`
	RuntimeRequirementID   string   `json:"runtimeRequirementId"`
	StackID                string   `json:"stackId"`
	SiteRef                string   `json:"siteRef"`
	CapabilityRef          string   `json:"capabilityRef"`
	ContractOwnerRef       string   `json:"contractOwnerRef"`
	CapabilityContractHash string   `json:"capabilityContractHash"`
	TargetNodeRefs         []string `json:"targetNodeRefs"`
	RequirementsHash       string   `json:"requirementsHash"`
	BindingRef             string   `json:"bindingRef"`
	BindingHash            string   `json:"bindingHash"`
	AccessFabricRef        string   `json:"accessFabricRef"`
	StackKitsVersion       string   `json:"stackkitsVersion"`
	CandidateDigest        string   `json:"candidateDigest"`
	SpecHash               string   `json:"specHash"`
	IssuedAt               string   `json:"issuedAt"`
	ValidUntil             string   `json:"validUntil"`
}

ApplyAccessBindingRequirement is the exact provider-free projection of one externally realized Home access requirement. BindingHash is the upstream StackKits authority hash. The shared runtimeexecutor derives an additional projection hash when this requirement crosses the adapter boundary.

type ApplyArtifactRequirement 

type ApplyArtifactRequirement struct {
	ID                   string   `json:"id"`
	Kind                 string   `json:"kind"`
	Format               string   `json:"format"`
	Mode                 string   `json:"mode"`
	ExecutionClass       string   `json:"executionClass"`
	OwnerKind            string   `json:"ownerKind"`
	OwnerRef             string   `json:"ownerRef"`
	OwnerContractHash    string   `json:"ownerContractHash"`
	ProviderRef          string   `json:"providerRef,omitempty"`
	ProviderContractHash string   `json:"providerContractHash,omitempty"`
	ModuleRef            string   `json:"moduleRef,omitempty"`
	ModuleContractHash   string   `json:"moduleContractHash,omitempty"`
	UnitRef              string   `json:"unitRef,omitempty"`
	UnitContractHash     string   `json:"unitContractHash,omitempty"`
	InstanceRef          string   `json:"instanceRef,omitempty"`
	OutputRef            string   `json:"outputRef,omitempty"`
	SiteRefs             []string `json:"siteRefs"`
	NodeRefs             []string `json:"nodeRefs"`
}

ApplyArtifactRequirement retains the exact CUE-owned render-instance identity for one generated artifact. Concrete artifact IDs remain plan-specific; executor capability selection binds the stable owner and contract identity instead of parsing those IDs.

type ApplyBackupTargetBindingRequirement 

type ApplyBackupTargetBindingRequirement struct {
	ID                     string   `json:"id"`
	RuntimeRequirementID   string   `json:"runtimeRequirementId"`
	StackID                string   `json:"stackId"`
	SiteRef                string   `json:"siteRef"`
	CapabilityRef          string   `json:"capabilityRef"`
	ContractOwnerRef       string   `json:"contractOwnerRef"`
	CapabilityContractHash string   `json:"capabilityContractHash"`
	TargetNodeRefs         []string `json:"targetNodeRefs"`
	RequirementsHash       string   `json:"requirementsHash"`
	BindingRef             string   `json:"bindingRef"`
	BindingHash            string   `json:"bindingHash"`
	BackupTargetRef        string   `json:"backupTargetRef"`
	CustodyAttestationRef  string   `json:"custodyAttestationRef"`
	StackKitsVersion       string   `json:"stackkitsVersion"`
	CandidateDigest        string   `json:"candidateDigest"`
	SpecHash               string   `json:"specHash"`
	IssuedAt               string   `json:"issuedAt"`
	ValidUntil             string   `json:"validUntil"`
}

ApplyBackupTargetBindingRequirement is the exact provider-free projection of one externally realized Cloud backup-target requirement. It carries opaque target and custody refs, never provider or object-storage connection data.

type ApplyDaemonRequirement 

type ApplyDaemonRequirement struct {
	DaemonRef   string `json:"daemonRef"`
	InstanceRef string `json:"instanceRef"`
	Engine      string `json:"engine"`
	SocketPath  string `json:"socketPath"`
}

type ApplyEvidenceBundle 

type ApplyEvidenceBundle struct {
	APIVersion       string                 `json:"apiVersion"`
	Kind             string                 `json:"kind"`
	Binding          PlanBinding            `json:"binding"`
	ManifestHash     string                 `json:"manifestHash"`
	Executor         ApplyExecutorIdentity  `json:"executor"`
	RequirementsHash string                 `json:"requirementsHash"`
	Receipts         []ApplyEvidenceReceipt `json:"receipts"`
	BundleHash       string                 `json:"bundleHash"`
}

func (ApplyEvidenceBundle) MarshalCanonical 

func (bundle ApplyEvidenceBundle) MarshalCanonical() ([]byte, error)

type ApplyEvidenceExpectation 

type ApplyEvidenceExpectation struct {
	ReceiptID       string               `json:"receiptId"`
	RequirementKind string               `json:"requirementKind"`
	RequirementID   string               `json:"requirementId"`
	RequirementHash string               `json:"requirementHash"`
	Subject         ApplyEvidenceSubject `json:"subject"`
}

type ApplyEvidenceProducer 

type ApplyEvidenceProducer struct {
	ID      string `json:"id"`
	Version string `json:"version"`
	KeyID   string `json:"keyId"`
}

type ApplyEvidenceProducerTrust 

type ApplyEvidenceProducerTrust struct {
	Producer         ApplyEvidenceProducer
	PublicKey        ed25519.PublicKey
	RequirementKinds []string
	ReceiptIDs       []string
}

type ApplyEvidenceReceipt 

type ApplyEvidenceReceipt struct {
	APIVersion      string                `json:"apiVersion"`
	Kind            string                `json:"kind"`
	ID              string                `json:"id"`
	RequirementKind string                `json:"requirementKind"`
	RequirementID   string                `json:"requirementId"`
	RequirementHash string                `json:"requirementHash"`
	Binding         PlanBinding           `json:"binding"`
	ManifestHash    string                `json:"manifestHash"`
	Executor        ApplyExecutorIdentity `json:"executor"`
	Subject         ApplyEvidenceSubject  `json:"subject"`
	Result          string                `json:"result"`
	Producer        ApplyEvidenceProducer `json:"producer"`
	ObservationRef  string                `json:"observationRef"`
	ObservedAt      string                `json:"observedAt"`
	ValidUntil      string                `json:"validUntil"`
	Signature       string                `json:"signature"`
	ReceiptDigest   string                `json:"receiptDigest"`
}

type ApplyEvidenceRequest 

type ApplyEvidenceRequest struct {
	APIVersion       string                     `json:"apiVersion"`
	Binding          PlanBinding                `json:"binding"`
	RequirementsHash string                     `json:"requirementsHash"`
	Expectations     []ApplyEvidenceExpectation `json:"expectations"`
}

type ApplyEvidenceRequirement 

type ApplyEvidenceRequirement struct {
	ID             string   `json:"id"`
	OwnerKind      string   `json:"ownerKind"`
	OwnerRef       string   `json:"ownerRef"`
	Ref            string   `json:"ref,omitempty"`
	GateRef        string   `json:"gateRef,omitempty"`
	Phase          string   `json:"phase,omitempty"`
	Producer       string   `json:"producer,omitempty"`
	Scenario       string   `json:"scenario,omitempty"`
	HealthGateRefs []string `json:"healthGateRefs"`
	ArtifactRefs   []string `json:"artifactRefs"`
}

type ApplyEvidenceSubject 

type ApplyEvidenceSubject struct {
	OwnerKind    string `json:"ownerKind"`
	OwnerRef     string `json:"ownerRef"`
	ProviderRef  string `json:"providerRef,omitempty"`
	ModuleRef    string `json:"moduleRef,omitempty"`
	UnitRef      string `json:"unitRef,omitempty"`
	InstanceRef  string `json:"instanceRef,omitempty"`
	NodeRef      string `json:"nodeRef,omitempty"`
	GateRef      string `json:"gateRef,omitempty"`
	ContractHash string `json:"contractHash,omitempty"`
}

ApplyEvidenceSubject is an explicit, human-auditable projection of the requirement identity. RequirementHash still binds the complete requirement.

type ApplyEvidenceVerificationInput 

type ApplyEvidenceVerificationInput struct {
	Plan              VerifiedPlan
	Manifest          ArtifactManifest
	GenerationReceipt GenerationReceipt
	Executor          ApplyExecutorIdentity
	Bundle            []byte
	TrustedProducers  map[string]ApplyEvidenceProducerTrust
}

type ApplyExecutorIdentity 

type ApplyExecutorIdentity struct {
	ID      string `json:"id"`
	Version string `json:"version"`
	Digest  string `json:"digest"`
}

type ApplyHealthProbe 

type ApplyHealthProbe struct {
	Protocol         string `json:"protocol"`
	Port             int    `json:"port"`
	TimeoutSeconds   int    `json:"timeoutSeconds"`
	Method           string `json:"method,omitempty"`
	FollowRedirects  bool   `json:"followRedirects,omitempty"`
	Path             string `json:"path,omitempty"`
	ExpectedStatuses []int  `json:"expectedStatuses,omitempty"`
}

type ApplyHealthRequirement 

type ApplyHealthRequirement struct {
	ID                   string            `json:"id"`
	RuntimeRequirementID string            `json:"runtimeRequirementId,omitempty"`
	SourceRef            string            `json:"sourceRef"`
	ContractHash         string            `json:"contractHash"`
	Phase                string            `json:"phase"`
	Kind                 string            `json:"kind"`
	TargetKind           string            `json:"targetKind"`
	TargetRef            string            `json:"targetRef"`
	RouteRef             string            `json:"routeRef,omitempty"`
	BackendPoolRef       string            `json:"backendPoolRef,omitempty"`
	Probe                *ApplyHealthProbe `json:"probe,omitempty"`
	SiteRefs             []string          `json:"siteRefs"`
	NodeRefs             []string          `json:"nodeRefs"`
}

type ApplyHostRequirement 

type ApplyHostRequirement struct {
	NodeRef             string `json:"nodeRef"`
	SiteRef             string `json:"siteRef"`
	FailureDomain       string `json:"failureDomain"`
	External            bool   `json:"external"`
	BindingRef          string `json:"bindingRef,omitempty"`
	BindingHash         string `json:"bindingHash,omitempty"`
	ExecutionChannelRef string `json:"executionChannelRef,omitempty"`
}

type ApplyProviderOwnerRequirement 

type ApplyProviderOwnerRequirement struct {
	ID               string   `json:"id"`
	Ref              string   `json:"ref"`
	Version          string   `json:"version"`
	Kind             string   `json:"kind"`
	ContractHash     string   `json:"contractHash"`
	SiteRefs         []string `json:"siteRefs"`
	NodeRefs         []string `json:"nodeRefs"`
	EvidenceRefs     []string `json:"evidenceRefs"`
	HealthGateRefs   []string `json:"healthGateRefs"`
	EvidenceGateRefs []string `json:"evidenceGateRefs"`
}

type ApplyRequirements 

type ApplyRequirements struct {
	Binding              PlanBinding                           `json:"binding"`
	Workloads            []ApplyWorkloadRequirement            `json:"workloads"`
	Secrets              []ApplySecretRequirement              `json:"secrets"`
	RuntimeInstances     []ApplyRuntimeRequirement             `json:"runtimeInstances"`
	Artifacts            []ApplyArtifactRequirement            `json:"artifacts"`
	Hosts                []ApplyHostRequirement                `json:"hosts"`
	ProviderOwners       []ApplyProviderOwnerRequirement       `json:"providerOwners"`
	AccessBindings       []ApplyAccessBindingRequirement       `json:"accessBindings,omitempty"`
	BackupTargetBindings []ApplyBackupTargetBindingRequirement `json:"backupTargetBindings,omitempty"`
	EvidenceRequirements []ApplyEvidenceRequirement            `json:"evidenceRequirements"`
	HealthRequirements   []ApplyHealthRequirement              `json:"healthRequirements"`
}

ApplyRequirements is the immutable, plan-owned input and postcondition set for Architecture v2 execution. ApplyEvidenceRequest projects only its pre-mutation Host, Secret, and explicit apply-phase evidence facts; runtime, workload, provider-owner, and Health requirements are verified from the exact executor result. It contains opaque secret references, never secret material. Runtime targets are derived from resolved render instances, never from generated files or ambient host discovery.

func (ApplyRequirements) Clone 

func (requirements ApplyRequirements) Clone() ApplyRequirements

Clone returns independent inspection data without creating plan authority.

type ApplyRuntimeAdapterAgentRequirement 

type ApplyRuntimeAdapterAgentRequirement struct {
	ID                 string   `json:"id"`
	ModuleRef          string   `json:"moduleRef"`
	ModuleVersion      string   `json:"moduleVersion"`
	ModuleContractHash string   `json:"moduleContractHash"`
	ArtifactRefs       []string `json:"artifactRefs"`
}

type ApplyRuntimeAdapterRequirement 

type ApplyRuntimeAdapterRequirement struct {
	ID                   string                                `json:"id"`
	ProviderRef          string                                `json:"providerRef"`
	ProviderVersion      string                                `json:"providerVersion"`
	ProviderContractHash string                                `json:"providerContractHash"`
	ModuleRef            string                                `json:"moduleRef"`
	ModuleVersion        string                                `json:"moduleVersion"`
	ModuleContractHash   string                                `json:"moduleContractHash"`
	ArtifactRefs         []string                              `json:"artifactRefs"`
	Agents               []ApplyRuntimeAdapterAgentRequirement `json:"agents,omitempty"`
}

ApplyRuntimeAdapterRequirement binds the exact workload-scoped adapter selected by the ResolvedPlan. It carries only catalog authority and contract-handoff artifact identities; concrete endpoints, credentials, transport configuration, leases, and provider lifecycle remain external.

type ApplyRuntimeRequirement 

type ApplyRuntimeRequirement struct {
	ID                      string                          `json:"id"`
	OwnerKind               string                          `json:"ownerKind"`
	OwnerRef                string                          `json:"ownerRef"`
	OwnerVersion            string                          `json:"ownerVersion,omitempty"`
	OwnerContractHash       string                          `json:"ownerContractHash"`
	ProviderRef             string                          `json:"providerRef"`
	ProviderContractHash    string                          `json:"providerContractHash"`
	ModuleRef               string                          `json:"moduleRef,omitempty"`
	ModuleContractHash      string                          `json:"moduleContractHash,omitempty"`
	UnitRef                 string                          `json:"unitRef,omitempty"`
	UnitContractHash        string                          `json:"unitContractHash,omitempty"`
	InstanceRef             string                          `json:"instanceRef"`
	WorkloadRef             string                          `json:"workloadRef,omitempty"`
	RuntimeKind             string                          `json:"runtimeKind"`
	RuntimeDelivery         string                          `json:"runtimeDelivery"`
	RuntimeEngine           string                          `json:"runtimeEngine,omitempty"`
	ImageRef                string                          `json:"imageRef,omitempty"`
	ImageDigest             string                          `json:"imageDigest,omitempty"`
	SiteRefs                []string                        `json:"siteRefs"`
	NodeRefs                []string                        `json:"nodeRefs"`
	HealthGateRefs          []string                        `json:"healthGateRefs,omitempty"`
	EvidenceGateRefs        []string                        `json:"evidenceGateRefs,omitempty"`
	DaemonBindings          []ApplyDaemonRequirement        `json:"daemonBindings"`
	ArtifactRefs            []string                        `json:"artifactRefs"`
	RuntimeAdapter          *ApplyRuntimeAdapterRequirement `json:"runtimeAdapter,omitempty"`
	AccessBindingRefs       []string                        `json:"accessBindingRefs,omitempty"`
	BackupTargetBindingRefs []string                        `json:"backupTargetBindingRefs,omitempty"`
}

type ApplySecretRequirement 

type ApplySecretRequirement struct {
	ID             string   `json:"id"`
	SourceKind     string   `json:"sourceKind"`
	SourceRef      string   `json:"sourceRef"`
	SourceInputRef string   `json:"sourceInputRef"`
	OwnerKind      string   `json:"ownerKind"`
	OwnerRef       string   `json:"ownerRef"`
	ModuleRef      string   `json:"moduleRef,omitempty"`
	UnitRef        string   `json:"unitRef,omitempty"`
	InstanceRef    string   `json:"instanceRef,omitempty"`
	InputRef       string   `json:"inputRef"`
	SecretRef      string   `json:"secretRef"`
	SiteRefs       []string `json:"siteRefs"`
	NodeRefs       []string `json:"nodeRefs"`
}

type ApplyWorkloadRequirement 

type ApplyWorkloadRequirement struct {
	ID              string   `json:"id"`
	ContractHash    string   `json:"contractHash"`
	ProviderRef     string   `json:"providerRef"`
	ModuleRef       string   `json:"moduleRef"`
	RuntimeKind     string   `json:"runtimeKind"`
	RuntimeDelivery string   `json:"runtimeDelivery"`
	ServiceRef      string   `json:"serviceRef"`
	HealthRef       string   `json:"healthRef"`
	SiteRefs        []string `json:"siteRefs"`
	NodeRefs        []string `json:"nodeRefs"`
	InstanceRefs    []string `json:"instanceRefs"`
	EvidenceRefs    []string `json:"evidenceRefs"`
}

type ArtifactManifest 

type ArtifactManifest struct {
	APIVersion string             `json:"apiVersion"`
	Kind       string             `json:"kind"`
	Binding    PlanBinding        `json:"binding"`
	Artifacts  []RenderedArtifact `json:"artifacts"`
}

ArtifactManifest binds every actual renderer output to one verified plan. Artifacts use the resolvedplan canonical set order for persistence.

func BuildManifest 

func BuildManifest(plan VerifiedPlan, root string, relativePaths []string) (ArtifactManifest, error)

BuildManifest hashes actual files beneath root and returns a deterministic manifest. Missing files, escapes, aliases, and duplicate paths fail closed.

func BuildManifestHeld 

func BuildManifestHeld(plan VerifiedPlan, workspace *confinedfs.Transaction, prefix string, relativePaths []string) (ArtifactManifest, error)

BuildManifestHeld hashes actual files through one authorization-borrowed workspace transaction. prefix is a portable private staging directory (or "." for the workspace); manifest paths remain workspace-relative plan paths.

func ParseManifest 

func ParseManifest(data []byte) (ArtifactManifest, error)

ParseManifest strictly decodes and canonicalizes one persisted artifact manifest. Keeping this boundary independent of filesystem access lets historical owner-signed custody reuse the exact manifest contract.

func ReadManifest 

func ReadManifest(filePath string) (ArtifactManifest, error)

func ReadManifestHeld 

func ReadManifestHeld(plan VerifiedPlan, workspace *confinedfs.Transaction, prefix string) (ArtifactManifest, error)

ReadManifestHeld reads and canonicalizes the control manifest without reopening the workspace pathname.

func (ArtifactManifest) Hash 

func (m ArtifactManifest) Hash() (string, error)

func (ArtifactManifest) MarshalCanonical 

func (m ArtifactManifest) MarshalCanonical() ([]byte, error)

type ComponentVersions 

type ComponentVersions struct {
	CLI       string
	Generator string
	Runtime   string
}

ComponentVersions are the binaries participating in a generation/apply decision. All three are required so a caller cannot accidentally skip one of the ResolvedPlan compatibility minima.

type Error 

type Error struct {
	Code     ErrorCode
	Path     string
	Message  string
	Phase    ExecutionPhase
	Blockers []ReadinessBlocker
	Err      error
}

Error identifies a fail-closed plan or generated-artifact gate decision.

func (*Error) Error 

func (e *Error) Error() string

func (*Error) Unwrap 

func (e *Error) Unwrap() error

type ErrorCode 

type ErrorCode string

ErrorCode is stable for future CLI/apply adapters. Callers must classify errors with errors.As instead of parsing their text. 

const (
	ErrInvalidPlan         ErrorCode = "invalid_plan"
	ErrInvalidContract     ErrorCode = "invalid_contract"
	ErrNonCanonical        ErrorCode = "non_canonical"
	ErrHashMismatch        ErrorCode = "hash_mismatch"
	ErrBindingMismatch     ErrorCode = "binding_mismatch"
	ErrInvalidPath         ErrorCode = "invalid_path"
	ErrPathEscape          ErrorCode = "path_escape"
	ErrDuplicateArtifact   ErrorCode = "duplicate_artifact"
	ErrArtifactMissing     ErrorCode = "artifact_missing"
	ErrArtifactChanged     ErrorCode = "artifact_changed"
	ErrIncompatible        ErrorCode = "incompatible_component"
	ErrReadinessBlocked    ErrorCode = "execution_readiness_blocked"
	ErrRendererMissing     ErrorCode = "renderer_not_implemented"
	ErrExecutorMissing     ErrorCode = "executor_not_implemented"
	ErrExecutorFailed      ErrorCode = "executor_failed"
	ErrVerifierMissing     ErrorCode = "verifier_not_implemented"
	ErrEvidenceSetMismatch ErrorCode = "apply_evidence_set_mismatch"
	ErrDuplicateEvidence   ErrorCode = "duplicate_apply_evidence"
	ErrEvidenceFreshness   ErrorCode = "apply_evidence_freshness"
	ErrEvidenceUntrusted   ErrorCode = "apply_evidence_untrusted"
	ErrIO                  ErrorCode = "io"
)

type ExecutionGateInput 

type ExecutionGateInput struct {
	CurrentCanonical []byte
	Plan             VerifiedPlan
	Phase            ExecutionPhase
	Versions         ComponentVersions
	Root             string
	Manifest         ArtifactManifest
	Receipt          GenerationReceipt
}

ExecutionGateInput contains every input required for one non-composable execution authorization decision. CurrentCanonical must be the exact output of the current governed resolver invocation, not a previously persisted plan.

type ExecutionPhase 

type ExecutionPhase string

ExecutionPhase selects the governed readiness decision required by an execution command. Plan consumes generated artifacts and therefore uses the generation phase; apply additionally requires the apply phase. 

const (
	ExecutionPhaseGeneration ExecutionPhase = "generation"
	ExecutionPhaseApply      ExecutionPhase = "apply"
)

type GenerationReceipt 

type GenerationReceipt struct {
	APIVersion   string      `json:"apiVersion"`
	Kind         string      `json:"kind"`
	Binding      PlanBinding `json:"binding"`
	ManifestHash string      `json:"manifestHash"`
	GeneratedAt  string      `json:"generatedAt,omitempty"`
}

GenerationReceipt records acceptance of one manifest. GeneratedAt is informational only: receipt identity and validation depend exclusively on Binding and ManifestHash, never wall-clock time.

func NewReceipt 

func NewReceipt(plan VerifiedPlan, manifest ArtifactManifest, generatedAt string) (GenerationReceipt, error)

NewReceipt binds one statically valid manifest to the same verified plan.

func ReadReceipt 

func ReadReceipt(filePath string) (GenerationReceipt, error)

func ReadReceiptHeld 

func ReadReceiptHeld(plan VerifiedPlan, workspace *confinedfs.Transaction, prefix string) (GenerationReceipt, error)

ReadReceiptHeld reads and canonicalizes the control receipt without reopening the workspace pathname.

func (GenerationReceipt) Hash 

func (r GenerationReceipt) Hash() (string, error)

Hash returns the content identity used by persisted Apply results.

func (GenerationReceipt) MarshalCanonical 

func (r GenerationReceipt) MarshalCanonical() ([]byte, error)

type PlanBinding 

type PlanBinding struct {
	PlanHash        string                     `json:"planHash"`
	SpecHash        string                     `json:"specHash"`
	InventoryHash   string                     `json:"inventoryHash"`
	DefinitionHash  string                     `json:"definitionHash"`
	CompilerVersion string                     `json:"compilerVersion"`
	Renderer        RendererIdentity           `json:"renderer"`
	Authority       resolvedplan.PlanAuthority `json:"authority"`
}

PlanBinding contains every source and implementation identity required to prove that generated files belong to exactly one compiler result.

type PlanInspection 

type PlanInspection struct {
	APIVersion         string                  `json:"apiVersion"`
	Kind               string                  `json:"kind"`
	VerifiedPhase      ExecutionPhase          `json:"verifiedPhase"`
	Binding            PlanBinding             `json:"binding"`
	Renderer           RendererIdentity        `json:"renderer"`
	OutputRoot         string                  `json:"outputRoot"`
	Readiness          PlanInspectionReadiness `json:"readiness"`
	Manifest           PlanInspectionManifest  `json:"manifest"`
	InfrastructureDiff string                  `json:"infrastructureDiff"`
	ExecutorInvoked    bool                    `json:"executorInvoked"`
}

PlanInspection is a read-only projection of one generation-verified Architecture v2 plan and its exact generated artifact closure. It is not an infrastructure diff and never claims that an executor was invoked.

func InspectExecution 

func InspectExecution(input ExecutionGateInput) (PlanInspection, error)

InspectExecution first performs the complete generation execution gate and only then creates a defensive in-memory projection. Apply verification is a separate mutating authorization concern and is deliberately not accepted.

func (PlanInspection) MarshalCanonical 

func (inspection PlanInspection) MarshalCanonical() ([]byte, error)

MarshalCanonical returns stable bytes without adding timestamps, host facts, or any other environment-dependent value.

type PlanInspectionBlocker 

type PlanInspectionBlocker struct {
	Code string   `json:"code"`
	Refs []string `json:"refs"`
}

type PlanInspectionManifest 

type PlanInspectionManifest struct {
	Hash      string             `json:"hash"`
	Artifacts []RenderedArtifact `json:"artifacts"`
}

type PlanInspectionPhase 

type PlanInspectionPhase struct {
	Status   string                  `json:"status"`
	Blockers []PlanInspectionBlocker `json:"blockers"`
}

type PlanInspectionReadiness 

type PlanInspectionReadiness struct {
	Generation PlanInspectionPhase `json:"generation"`
	Apply      PlanInspectionPhase `json:"apply"`
}

type ReadinessBlocker 

type ReadinessBlocker struct {
	Code string
	Refs []string
}

ReadinessBlocker is the stable public projection of one ResolvedPlan execution blocker. Refs retain the governed provider/module/evidence IDs.

type RenderedArtifact 

type RenderedArtifact struct {
	ID     string `json:"id"`
	Path   string `json:"path"`
	Kind   string `json:"kind"`
	Format string `json:"format"`
	Mode   string `json:"mode"`
	SHA256 string `json:"sha256"`
}

RenderedArtifact binds a portable relative path to the exact bytes rendered at that path. Paths always use slash separators, including on Windows.

type RendererIdentity 

type RendererIdentity struct {
	ID      string `json:"id"`
	Version string `json:"version"`
}

RendererIdentity is copied from ResolvedPlan.generation.renderer. Changing either value invalidates every manifest and receipt made for the old plan.

type VerifiedApplyEvidenceBundle 

type VerifiedApplyEvidenceBundle struct {
	// contains filtered or unexported fields
}

VerifiedApplyEvidenceBundle is evidence only. It is deliberately not an executor capability and cannot be upgraded without the later held-lock Architecture v2 authorization boundary.

func VerifyApplyEvidenceBundle 

func VerifyApplyEvidenceBundle(input ApplyEvidenceVerificationInput) (VerifiedApplyEvidenceBundle, error)

func VerifyApplyEvidenceBundleAt 

func VerifyApplyEvidenceBundleAt(input ApplyEvidenceVerificationInput, at time.Time) (VerifiedApplyEvidenceBundle, error)

VerifyApplyEvidenceBundleAt verifies a bundle at one orchestration-owned trusted UTC instant. Product orchestration uses the same instant for collection and verification; the derived earliest expiry is rechecked at later one-shot consumption.

func (VerifiedApplyEvidenceBundle) BundleHash 

func (v VerifiedApplyEvidenceBundle) BundleHash() string

func (VerifiedApplyEvidenceBundle) EvaluatedAt 

func (v VerifiedApplyEvidenceBundle) EvaluatedAt() time.Time

func (VerifiedApplyEvidenceBundle) ExpiresAt 

func (v VerifiedApplyEvidenceBundle) ExpiresAt() time.Time

func (VerifiedApplyEvidenceBundle) RequirementsHash 

func (v VerifiedApplyEvidenceBundle) RequirementsHash() string

type VerifiedPlan 

type VerifiedPlan struct {
	// contains filtered or unexported fields
}

VerifiedPlan is produced only after canonical JSON, self-declared plan hash, and the concrete governed CUE #ResolvedPlan contract all pass. Its data is kept private so callers cannot mutate a verified map after that decision.

func PersistPlan 

func PersistPlan(path string, canonical []byte, validator *resolvedplan.CUEContractValidator) (VerifiedPlan, error)

PersistPlan verifies before writing and atomically installs the canonical bytes with mode 0600. Invalid or stale input can never replace the target.

func ReadPlan 

func ReadPlan(path string, validator *resolvedplan.CUEContractValidator) (VerifiedPlan, error)

ReadPlan reads and verifies a persisted canonical plan.

func VerifyPlan 

func VerifyPlan(data []byte, validator *resolvedplan.CUEContractValidator) (VerifiedPlan, error)

VerifyPlan verifies a byte-for-byte canonical Architecture v2 ResolvedPlan against the non-substitutable CUE authority. A self-consistent hash is only integrity evidence, never schema authority. Legacy StackSpec v1 documents are neither accepted nor projected.

func (VerifiedPlan) ApplyEvidenceRequest 

func (p VerifiedPlan) ApplyEvidenceRequest() (ApplyEvidenceRequest, error)

ApplyEvidenceRequest returns the single canonical producer-facing request for facts that must be true before the selected executor is invoked. Runtime, workload, provider-owner, and health requirements are deliberately absent: they are execution/postcondition authority and are verified from the exact executor result instead of being circular prerequisites for that execution.

The request contains opaque secret references only through their requirement hashes; no external producer has to reimplement StackKits requirement hashing.

func (VerifiedPlan) ApplyRequirements 

func (p VerifiedPlan) ApplyRequirements() ApplyRequirements

ApplyRequirements returns a defensive copy. A caller may inspect it to collect evidence, but cannot mutate the verified plan's authorization input.

func (VerifiedPlan) Binding 

func (p VerifiedPlan) Binding() PlanBinding

Binding returns the immutable identities extracted from the verified plan.

func (VerifiedPlan) Canonical 

func (p VerifiedPlan) Canonical() []byte

Canonical returns a defensive copy of the verified canonical plan.

func (VerifiedPlan) MetadataPaths 

func (p VerifiedPlan) MetadataPaths(workspaceRoot string) (planPath, manifestPath, receiptPath string)

MetadataPaths derives the plan/manifest/receipt locations from outputRoot. The latter two are control metadata and are never renderer artifacts.

func (VerifiedPlan) OutputRoot 

func (p VerifiedPlan) OutputRoot() string

OutputRoot is the portable path selected by ResolvedPlan.generation. It is relative to the deployment workspace; "." means the workspace itself.

func (VerifiedPlan) ProjectExternalBackupTargetBinding 

func (p VerifiedPlan) ProjectExternalBackupTargetBinding(binding resolvedplan.ExternalBackupTargetBinding) ([]ApplyBackupTargetBindingRequirement, error)

ProjectExternalBackupTargetBinding uses the normal Apply projection for a newly owner-issued binding before it has been persisted into Inventory. It does not change or authorize execution of the held Plan.

func (VerifiedPlan) RequireExpectedPlanHash 

func (p VerifiedPlan) RequireExpectedPlanHash(expected string) error

RequireExpectedPlanHash binds an external Apply admission decision to this exact verified ResolvedPlan. An empty expectation preserves owner-operated Standard Mode; governed orchestrators provide the hash returned by PLAN.

func (VerifiedPlan) RequireReady 

func (p VerifiedPlan) RequireReady(phase ExecutionPhase) error

RequireReady enforces the signed readiness decision embedded by the compiler. Blocker codes and refs are included deterministically for operator diagnostics while callers classify the typed ErrorCode.

func (VerifiedPlan) VerifyCompatibility 

func (p VerifiedPlan) VerifyCompatibility(actual ComponentVersions) error

VerifyCompatibility checks every plan minimum using the compiler's SemVer implementation. An empty or malformed current component version fails.

func (VerifiedPlan) VerifyCurrentResolution 

func (p VerifiedPlan) VerifyCurrentResolution(canonical []byte) error

VerifyCurrentResolution rejects even a valid old plan when it is not the exact canonical output of the current StackSpec, Inventory, authority, and compiler contract.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.