Documentation
¶
Overview ¶
Package execution owns the held-root installation transaction used by the Architecture v2 authority boundary. It is internal so callers cannot bypass plan verification or redirect generated output through raw filesystem paths.
Index ¶
- Constants
- func ApplyRetiredOutputGC(workspace *confinedfs.Transaction, expected RetiredOutputGCInspection) error
- func InstallManagedOutput(plan generationartifact.VerifiedPlan, workspace *confinedfs.Transaction, ...) (architecturev2renderer.InstallResult, error)
- func RequireNoPendingOutputTransaction(workspace *confinedfs.Transaction, outputRoot string) error
- func ValidateWorkspaceRoot(root string) (string, error)
- type Error
- type RetiredOutputGCAction
- type RetiredOutputGCInspection
Constants ¶
const ( ErrInvalidPlan = architecturev2renderer.ErrInvalidPlan ErrInvalidPath = architecturev2renderer.ErrInvalidPath ErrOutputChanged = architecturev2renderer.ErrOutputChanged ErrUnsafeOutputRoot = architecturev2renderer.ErrUnsafeOutputRoot ErrOutputBusy = architecturev2renderer.ErrOutputBusy ErrOutputTransaction = architecturev2renderer.ErrOutputTransaction ErrTransactionRecovery = architecturev2renderer.ErrTransactionRecovery ErrTransactionCleanup = architecturev2renderer.ErrTransactionCleanup ErrTransactionRollback = architecturev2renderer.ErrTransactionRollback )
Variables ¶
This section is empty.
Functions ¶
func ApplyRetiredOutputGC ¶
func ApplyRetiredOutputGC(workspace *confinedfs.Transaction, expected RetiredOutputGCInspection) error
ApplyRetiredOutputGC executes at most the exact action returned by inspect. It re-inspects under the same held transaction and therefore cannot mutate a different tombstone after an operator copied an old action string.
func InstallManagedOutput ¶
func InstallManagedOutput(plan generationartifact.VerifiedPlan, workspace *confinedfs.Transaction, result architecturev2renderer.RenderResult, options architecturev2renderer.InstallOptions) (architecturev2renderer.InstallResult, error)
InstallManagedOutput performs the held-root stage/verify/swap transaction. Go's nested internal boundary permits calls only from the architecturev2 package tree; callers outside that authority cannot reach this raw mutation.
func RequireNoPendingOutputTransaction ¶
func RequireNoPendingOutputTransaction(workspace *confinedfs.Transaction, outputRoot string) error
RequireNoPendingOutputTransaction is the shared fail-closed admission check for Generate, Plan, Apply, and Verify. The caller must already own the exact output lock; this function never acquires or weakens that lease.
func ValidateWorkspaceRoot ¶
ValidateWorkspaceRoot canonicalizes the path-name assertion used only to match an already-held authorization root. Installation itself never reopens this pathname.
Types ¶
type Error ¶
type Error = architecturev2renderer.Error
type RetiredOutputGCAction ¶
type RetiredOutputGCAction string
RetiredOutputGCAction is the one bounded mutation which may be taken for a retired output-transaction tombstone. Its value is intentionally echoed by the caller before mutation so inspection cannot accidentally become cleanup.
const ( RetiredOutputGCRemoveStage RetiredOutputGCAction = "remove-retired-stage" RetiredOutputGCRemoveJournal RetiredOutputGCAction = "remove-retired-journal" )
type RetiredOutputGCInspection ¶
type RetiredOutputGCInspection struct {
TransactionID string `json:"transactionId"`
Action RetiredOutputGCAction `json:"action"`
}
RetiredOutputGCInspection is a non-secret, exact report for one retired transaction namespace. Active journals and generated output are never read.
func InspectRetiredOutputGC ¶
func InspectRetiredOutputGC(workspace *confinedfs.Transaction, transactionID string) (RetiredOutputGCInspection, error)
InspectRetiredOutputGC identifies exactly one permitted cleanup action for a deterministic retired transaction namespace. A journal is authority only when it is a complete immutable journal; malformed or partial evidence fails closed instead of being treated as deletion permission.
Source Files