architecturev2renderer

package
v0.42.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 24, 2026 License: Apache-2.0 Imports: 27 Imported by: 0

Documentation

Overview

Package architecturev2renderer renders only governed Architecture v2 ResolvedPlans. It has no compatibility path into the StackSpec v1 model or generator.

Index

Constants

View Source 
const (

	// PterodactylGameDataTarget is where Wings and the bootstrap see the game
	// data volume; the executor additionally mounts it at its own host path.
	PterodactylGameDataTarget = "/stackkit/game-data"
	// PterodactylGameDataHostPathEnv names the host path the executor exports.
	PterodactylGameDataHostPathEnv = "STACKKIT_GAME_DATA_HOST_PATH"
	// PterodactylBedrockEggSHA256 pins the imported official Bedrock Egg
	// (pterodactyl/game-eggs 342628869f5e145b4e99691a6bedacfc06d3ec02).
	PterodactylBedrockEggSHA256 = "7723befb387894afeccc042f25560550a22785bc867e12a2d0254f0259f75e6b"
)
View Source 
const (
	PrivateAIImageRef    = privateAIImageRef
	PrivateAIImageDigest = privateAIImageDigest
	PrivateAIRelease     = privateAIRelease
	OllamaImageRef       = ollamaImageRef
	OllamaImageDigest    = ollamaImageDigest
	OllamaRelease        = ollamaRelease

	HomeAssistantImageRef    = homeAssistantImageRef
	HomeAssistantImageDigest = homeAssistantImageDigest
	HomeAssistantRelease     = homeAssistantRelease
	JellyfinImageRef         = jellyfinImageRef
	JellyfinImageDigest      = jellyfinImageDigest
	JellyfinRelease          = jellyfinRelease
	VaultwardenImageRef      = vaultwardenImageRef
	VaultwardenImageDigest   = vaultwardenImageDigest
	VaultwardenRelease       = vaultwardenRelease
)

These aliases expose the generated CUE image authority to lifecycle adapters. Only the catalog maintains values; setup and execution consume the same compiled projection as rendering.

View Source 
const (
	GiteaImageRef    = giteaImageRef
	GiteaImageDigest = giteaImageDigest
	GiteaRelease     = giteaRelease
)

Gitea image identity is derived from the same CUE catalog as deployment.

Variables

This section is empty.

Functions

func CloudComposeIdentityAddress 

func CloudComposeIdentityAddress(content []byte) (domain, prefix string, ok bool)

CloudComposeIdentityAddress returns the domain and optional subdomain prefix a Cloud core Compose artifact routes PocketID to.

func ExpectedBasementCoreComposeArtifact 

func ExpectedBasementCoreComposeArtifact() []byte

ExpectedBasementCoreComposeArtifact returns the immutable built-in Compose definition used by both generation and the local runtime-owner admission boundary. Callers receive a defensive copy.

func ExpectedCloudCoreComposeArtifact 

func ExpectedCloudCoreComposeArtifact() []byte

ExpectedCloudCoreComposeArtifact returns the immutable default-domain artifact used by executor contract tests.

func ExpectedCloudStandaloneCoreComposeArtifact 

func ExpectedCloudStandaloneCoreComposeArtifact() []byte

ExpectedCloudStandaloneCoreComposeArtifact returns the immutable default domain artifact used by renderer and executor contract tests.

func ExpectedSocketProxyComposeArtifact 

func ExpectedSocketProxyComposeArtifact(socketPath, networkInstanceRef string) ([]byte, error)

ExpectedSocketProxyComposeArtifact materializes the exact immutable socket-proxy Compose policy for an already governed daemon binding and runtime-network identity. It performs no discovery and grants no Docker endpoint authority; local executors use it only for byte-exact admission.

func HAAvailabilityOutputRef 

func HAAvailabilityOutputRef(moduleID string) string

HAAvailabilityOutputRef returns the governed output path for one concrete kit/mode HA runtime module.

func HomeAssistantInstanceOutputRef 

func HomeAssistantInstanceOutputRef(module string) string

func RenderBasementCoreComposeForDomain 

func RenderBasementCoreComposeForDomain(domain string) []byte

func RenderBasementCoreLiteComposeForDomain 

func RenderBasementCoreLiteComposeForDomain(domain string) []byte

func RenderCloudCoreComposeForAddress 

func RenderCloudCoreComposeForAddress(domain, prefix string) []byte

func RenderCloudCoreComposeForDomain 

func RenderCloudCoreComposeForDomain(domain string) []byte

func RenderCloudStandaloneCoreComposeForAddress 

func RenderCloudStandaloneCoreComposeForAddress(domain, prefix string) []byte

RenderCloudStandaloneCoreComposeForAddress renders the standalone graph with the same prefix substitution rules as the existing Cloud renderer.

func RenderCloudStandaloneCoreComposeForDomain 

func RenderCloudStandaloneCoreComposeForDomain(domain string) []byte

RenderCloudStandaloneCoreComposeForDomain renders the standalone Cloud graph for a resolved domain without selecting or embedding a PaaS adapter.

func StandaloneComposeConfigRelPath 

func StandaloneComposeConfigRelPath(containerPath string) string

StandaloneComposeConfigRelPath is the portable owner-workspace path used by the standalone Compose adapter for one container-visible configuration file. The naming rule belongs to the delivery contract so custody and execution cannot derive different paths for the same generated file.

func ValidateBasementCoreComposeArtifact 

func ValidateBasementCoreComposeArtifact(content []byte) bool

func ValidateBasementCoreLiteComposeArtifact 

func ValidateBasementCoreLiteComposeArtifact(content []byte) bool

ValidateBasementCoreLiteComposeArtifact validates the Lite artifact against the same immutable renderer family while preserving Lite's reduced service graph and output contract.

func ValidateCloudCoreComposeArtifact 

func ValidateCloudCoreComposeArtifact(content []byte) bool

func ValidateCloudStandaloneCoreComposeArtifact 

func ValidateCloudStandaloneCoreComposeArtifact(content []byte) bool

ValidateCloudStandaloneCoreComposeArtifact validates both the standalone graph and its resolved domain/prefix substitution.

func ValidateManagedOutput 

func ValidateManagedOutput(plan generationartifact.VerifiedPlan, result RenderResult) (string, error)

ValidateManagedOutput is the pure handoff contract from rendering to the Architecture v2 execution boundary. It proves that result belongs to plan, contains the complete governed artifact set, and returns the portable managed output root. It never opens or mutates a filesystem path.

Types

type ApplicationDeliveryBundleDescriptor 

type ApplicationDeliveryBundleDescriptor struct {
	WorkloadRef    string
	ModuleRef      string
	Release        string
	EntryComponent string
	SiteRef        string
	NodeRef        string
	InstanceRef    string
	SecretRefs     map[string]string
	Components     []ApplicationDeliveryComponentDescriptor
	ConfigFiles    []ApplicationDeliveryConfigFileDescriptor
	Route          ApplicationDeliveryRouteDescriptor
	// DaemonSocketPath is set only for an ADR-0043 lifecycle-owner workload.
	DaemonSocketPath string
}

ApplicationDeliveryBundleDescriptor is the validated provider-neutral workload graph used by the StackKits-owned standalone adapter.

func ParseApplicationDeliveryWorkloadBundle 

func ParseApplicationDeliveryWorkloadBundle(data []byte) (ApplicationDeliveryBundleDescriptor, error)

ParseApplicationDeliveryWorkloadBundle validates the common v2 envelope and returns no secret material. Product executors perform their stricter product/version graph validation before invoking an operations owner.

type ApplicationDeliveryComponentDescriptor 

type ApplicationDeliveryComponentDescriptor struct {
	ID                string
	Role              string
	Lifecycle         string
	HealthFailure     string
	ImageRef          string
	ImageDigest       string
	DependsOn         []string
	NetworkRefs       []string
	Egress            bool
	OwnerEnvironment  map[string]string
	Command           []string
	Entrypoint        []string
	Environment       map[string]string
	SecretEnvironment map[string]string
	Volumes           []ApplicationDeliveryVolumeDescriptor
	HealthKind        string
	HealthPath        string
	HealthPort        int
	HealthCommand     []string
	Resources         *ApplicationDeliveryResourcesDescriptor
	// RouteHostLoopback resolves the workload route host to loopback inside
	// this component (ADR-0043, Pterodactyl Panel only).
	RouteHostLoopback bool
	// DockerLifecycleOwner receives the approved Docker socket (ADR-0043,
	// Pterodactyl Wings only).
	DockerLifecycleOwner bool
}

ApplicationDeliveryComponentDescriptor is the complete non-secret container contract consumed by the standalone Compose adapter.

type ApplicationDeliveryConfigFileDescriptor 

type ApplicationDeliveryConfigFileDescriptor struct {
	Path string
	Body string
}

type ApplicationDeliveryResourcesDescriptor 

type ApplicationDeliveryResourcesDescriptor struct {
	MemoryLimit       string
	MemoryReservation string
	CPUs              float64
}

ApplicationDeliveryResourcesDescriptor is the declared per-container ceiling carried through to the adapter. Nil means the component declared none.

type ApplicationDeliveryRouteDescriptor 

type ApplicationDeliveryRouteDescriptor struct {
	CoreModuleRef         string
	ID                    string
	ServiceRef            string
	ModuleRef             string
	Exposure              string
	Protocol              string
	UpstreamProtocol      string
	HealthGateRef         string
	BackendPoolRef        string
	Host                  string
	Path                  string
	Port                  int
	TargetPort            int
	TLSRequired           bool
	TLSMode               string
	TLSMinVersion         string
	TLSProfileRef         string
	TLSIssuerRef          string
	TLSOwnerCapabilityRef string
	IngressAuth           string
}

ApplicationDeliveryRouteDescriptor is the non-secret route identity every Coolify, Komodo, or standalone adapter must observe after Apply.

type ApplicationDeliveryVolumeDescriptor 

type ApplicationDeliveryVolumeDescriptor struct {
	HostPath string
	ID       string
	Target   string
	Class    string
	Backup   bool
	ReadOnly bool
	// SelfPath also mounts the named volume at its own host path.
	SelfPath bool
	// SharedFromComponent/SharedFromVolume name the owning component volume.
	SharedFromComponent string
	SharedFromVolume    string
}

type Artifact 

type Artifact struct {
	ID         string `json:"id"`
	Path       string `json:"path"`
	Kind       string `json:"kind"`
	Format     string `json:"format"`
	Mode       string `json:"mode"`
	ModuleID   string `json:"moduleId,omitempty"`
	UnitID     string `json:"unitId,omitempty"`
	InstanceID string `json:"instanceId,omitempty"`
	OutputRef  string `json:"outputRef,omitempty"`
	Bytes      []byte `json:"bytes"`
}

Artifact is one governed generated file. Path is relative to the deployment workspace and always uses portable slash separators.

type BasementCoreServiceContract 

type BasementCoreServiceContract struct {
	Ref         string
	ImageRef    string
	ImageDigest string
	// HealthRequired is false only for image-health components that declare no
	// executable Compose healthcheck. Every command/HTTP health contract must
	// be observed as healthy before readiness can pass.
	HealthRequired bool
}

BasementCoreServiceContract is the secret-free, pinned service identity enforced again by the local runtime owner before Docker can be reached.

func BasementCoreLiteServiceContracts 

func BasementCoreLiteServiceContracts() []BasementCoreServiceContract

BasementCoreLiteServiceContracts returns the exact service graph emitted by the Lite renderer. It is projected from the shared component authority so local Apply and Verify cannot grow a second service list.

func BasementCoreServiceContracts 

func BasementCoreServiceContracts() []BasementCoreServiceContract

BasementCoreServiceContracts returns the closed service set in stable ID order. The CUE-owned renderer remains the source of this projection.

func CloudCoreServiceContracts 

func CloudCoreServiceContracts() []BasementCoreServiceContract

func CloudStandaloneCoreServiceContracts 

func CloudStandaloneCoreServiceContracts() []BasementCoreServiceContract

CloudStandaloneCoreServiceContracts returns the pinned services in stable ID order. The hub keeps the existing nginx image and digest as the standalone runtime entry component.

type BasementIdentityTrustEnforcementPolicy 

type BasementIdentityTrustEnforcementPolicy struct {
	StackID   string                          `json:"stackId"`
	KitSlug   string                          `json:"kitSlug"`
	SiteRef   string                          `json:"siteRef"`
	Verifiers []BasementIdentityTrustVerifier `json:"verifiers"`
}

BasementIdentityTrustEnforcementPolicy is the finite secret-free verifier projection consumed by the Basement trust enforcer. It carries references and policy only; key bytes, credentials, endpoints, enrollment, issuance, provider lifecycle, and signing authority are intentionally absent.

func ValidateBasementIdentityTrustPolicyArtifact 

func ValidateBasementIdentityTrustPolicyArtifact(raw []byte) (BasementIdentityTrustEnforcementPolicy, error)

type BasementIdentityTrustVerifier 

type BasementIdentityTrustVerifier struct {
	ID                            string   `json:"id"`
	Principal                     string   `json:"principal"`
	CredentialIssuerRef           string   `json:"issuerRef"`
	Issuer                        string   `json:"issuer"`
	Audiences                     []string `json:"audiences"`
	VerificationKeySetRef         string   `json:"verificationKeySetRef"`
	ProofOfPossessionRequired     bool     `json:"proofOfPossessionRequired"`
	RevocationMaxStalenessSeconds int      `json:"revocationMaxStalenessSeconds"`
	CredentialTTLSeconds          int      `json:"lifetimeSeconds"`
	SessionTTLSeconds             int      `json:"sessionTTLSeconds"`
}

type BasementIdentityVerificationInput 

type BasementIdentityVerificationInput struct {
	SiteRef   string                          `json:"siteRef"`
	Verifiers []BasementIdentityTrustVerifier `json:"verifiers"`
}

type BridgeOriginMTLSPolicy 

type BridgeOriginMTLSPolicy struct {
	StackID      string
	SiteRef      string
	NodeRef      string
	Publications []BridgeOriginMTLSPublicationPolicy
}

BridgeOriginMTLSPolicy is the exact material-free policy for one Home origin node. Credential and transport implementations remain outside StackKits.

func ValidateBridgeOriginMTLSExecutorArtifact 

func ValidateBridgeOriginMTLSExecutorArtifact(raw []byte, siteRef, nodeRef string) (BridgeOriginMTLSPolicy, error)

ValidateBridgeOriginMTLSExecutorArtifact verifies the exact executable contract and selects only the caller-bound Home node projection.

type BridgeOriginMTLSPublicationPolicy 

type BridgeOriginMTLSPublicationPolicy struct {
	ServiceRef                    string
	IdentityRef                   string
	EdgeSiteRef                   string
	ModuleRef                     string
	UnitRef                       string
	OriginInstanceRef             string
	UpstreamProtocol              string
	TargetPort                    int
	ServerName                    string
	MinimumTLSVersion             string
	CredentialIssuerRef           string
	Issuer                        string
	Audience                      string
	VerificationKeySetRef         string
	CredentialTTLSeconds          int
	RevocationMaxStalenessSeconds int
	EdgeVerifierRef               string
	VerifierDistributionRef       string
	VerifierMaxStalenessSeconds   int
}

type BridgePublicationHealthProbe 

type BridgePublicationHealthProbe struct {
	Kind             string
	Protocol         string
	Port             int
	TimeoutSeconds   int
	Method           string
	FollowRedirects  bool
	Path             string
	ExpectedStatuses []int
}

type BridgePublicationOriginTarget 

type BridgePublicationOriginTarget struct {
	NodeRef     string
	InstanceRef string
}

type BridgePublicationPolicy 

type BridgePublicationPolicy struct {
	StackID      string
	SiteRef      string
	NodeRef      string
	Publications []BridgePublicationRule
}

BridgePublicationPolicy is the exact material-free policy for one Cloud edge node. DNS, certificates, credentials and transport remain external.

func ValidateBridgePublicationExecutorArtifact 

func ValidateBridgePublicationExecutorArtifact(raw []byte, siteRef, nodeRef string) (BridgePublicationPolicy, error)

ValidateBridgePublicationExecutorArtifact verifies the executable contract and returns only the caller-bound Cloud edge projection.

type BridgePublicationRule 

type BridgePublicationRule struct {
	ServiceRef             string
	SourceSiteRef          string
	EdgeSiteRef            string
	Host                   string
	Protocol               string
	Port                   int
	Path                   string
	TLSMinVersion          string
	AuthPolicyRef          string
	OriginIdentityRef      string
	RateLimitRequests      int
	RateLimitWindowSeconds int
	ModuleRef              string
	UnitRef                string
	OriginNodeRefs         []string
	OriginInstanceRefs     []string
	OriginTargets          []BridgePublicationOriginTarget
	UpstreamProtocol       string
	TargetPort             int
	HealthGateRef          string
	HealthProbe            *BridgePublicationHealthProbe
	DataBindingRef         string
	Authentication         string
	Privilege              string
	EnrolledDeviceRequired bool
	OwnerStepUpRequired    bool
	AllowedMethods         []string
}

type CloudAdminMeshProjection 

type CloudAdminMeshProjection struct {
	CapabilityRef string                 `json:"capabilityRef"`
	SiteRefs      []string               `json:"siteRefs"`
	NodeRefs      []string               `json:"nodeRefs"`
	Network       CloudNetworkPosture    `json:"network"`
	Routes        []CloudPublicEdgeRoute `json:"routes"`
}

type CloudHostSecurityFirewallBaseline 

type CloudHostSecurityFirewallBaseline struct {
	BaseRuleset                string `json:"baseRuleset"`
	PublicEdgeDelegationChain  string `json:"publicEdgeDelegationChain"`
	DefaultIngress             string `json:"defaultIngress"`
	DeclaredServiceIngressOnly bool   `json:"declaredServiceIngressOnly"`
}

type CloudHostSecurityHardeningBaseline 

type CloudHostSecurityHardeningBaseline struct {
	Profile                  string `json:"profile"`
	SSHKeyOnly               bool   `json:"sshKeyOnly"`
	SSHRootLogin             string `json:"sshRootLogin"`
	BruteForceProtection     string `json:"bruteForceProtection"`
	AutomaticSecurityUpdates string `json:"automaticSecurityUpdates"`
}

type CloudHostSecurityPolicy 

type CloudHostSecurityPolicy struct {
	StackID         string                             `json:"stackId"`
	KitSlug         string                             `json:"kitSlug"`
	SiteRef         string                             `json:"siteRef"`
	NodeRef         string                             `json:"nodeRef"`
	Roles           []string                           `json:"roles"`
	NetworkMode     string                             `json:"networkMode"`
	TransportSubnet string                             `json:"transportSubnet"`
	IPv6            bool                               `json:"ipv6"`
	TLSMinVersion   string                             `json:"tlsMinVersion"`
	Firewall        CloudHostSecurityFirewallBaseline  `json:"firewall"`
	Hardening       CloudHostSecurityHardeningBaseline `json:"hardening"`
}

CloudHostSecurityPolicy is the complete operation-shaped runtime custody document. It deliberately excludes plan topology, hardware, DNS, storage, data, failure, endpoint, credential and provider lifecycle authority.

func ValidateCloudHostSecurityExecutorArtifact 

func ValidateCloudHostSecurityExecutorArtifact(raw []byte, siteRef, nodeRef string) (CloudHostSecurityPolicy, error)

ValidateCloudHostSecurityExecutorArtifact accepts only the operation-shaped policy for the explicitly selected target. It never discovers or chooses a host and cannot recover discarded compiler authority from the artifact.

type CloudIdentityAuthorityInput 

type CloudIdentityAuthorityInput struct {
	SiteRef   string                       `json:"siteRef"`
	Issuers   []CloudIdentityTrustIssuer   `json:"issuers"`
	Verifiers []CloudIdentityTrustVerifier `json:"verifiers"`
}

type CloudIdentityTrustEnforcementPolicy 

type CloudIdentityTrustEnforcementPolicy struct {
	StackID   string                       `json:"stackId"`
	KitSlug   string                       `json:"kitSlug"`
	SiteRef   string                       `json:"siteRef"`
	Issuers   []CloudIdentityTrustIssuer   `json:"issuers"`
	Verifiers []CloudIdentityTrustVerifier `json:"verifiers"`
}

CloudIdentityTrustEnforcementPolicy is the closed secret-free policy for the Cloud trust enforcer. Issuers contains only StackKit-owned human/workload issuers; the external device issuer remains a verifier reference and can never become Cloud issuance or enrollment authority.

func ValidateCloudIdentityTrustPolicyArtifact 

func ValidateCloudIdentityTrustPolicyArtifact(raw []byte) (CloudIdentityTrustEnforcementPolicy, error)

type CloudIdentityTrustIssuer 

type CloudIdentityTrustIssuer struct {
	ID                            string   `json:"id"`
	AuthorityRef                  string   `json:"authorityRef"`
	Principal                     string   `json:"principal"`
	Issuer                        string   `json:"issuer"`
	Audiences                     []string `json:"audiences"`
	VerificationKeySetRef         string   `json:"verificationKeySetRef"`
	ProofOfPossessionRequired     bool     `json:"proofOfPossessionRequired"`
	RevocationMaxStalenessSeconds int      `json:"revocationMaxStalenessSeconds"`
	CredentialTTLSeconds          int      `json:"lifetimeSeconds"`
	SessionTTLSeconds             int      `json:"sessionTTLSeconds"`
}

type CloudIdentityTrustVerifier 

type CloudIdentityTrustVerifier struct {
	ID                            string   `json:"id"`
	Principal                     string   `json:"principal"`
	CredentialIssuerRef           string   `json:"issuerRef"`
	Issuer                        string   `json:"issuer"`
	Audiences                     []string `json:"audiences"`
	VerificationKeySetRef         string   `json:"verificationKeySetRef"`
	ProofOfPossessionRequired     bool     `json:"proofOfPossessionRequired"`
	RevocationMaxStalenessSeconds int      `json:"revocationMaxStalenessSeconds"`
}

type CloudNetworkPosture 

type CloudNetworkPosture struct {
	Mode      string `json:"mode"`
	Transport struct {
		Subnet string `json:"subnet"`
		IPv6   bool   `json:"ipv6"`
	} `json:"transport"`
	TLSMinVersion string `json:"tlsMinVersion"`
}

type CloudOffsiteBackupPolicy 

type CloudOffsiteBackupPolicy struct {
	StackID                string
	KitSlug                string
	SiteRef                string
	NodeRef                string
	CapabilityRef          string
	ContractOwnerRef       string
	CapabilityContractHash string
	RequirementsHash       string
	BindingRef             string
	BindingHash            string
	BackupTargetRef        string
	CustodyAttestationRef  string
	StackKitsVersion       string
	CandidateDigest        string
	SpecHash               string
	IssuedAt               string
	ValidUntil             string
}

CloudOffsiteBackupPolicy is the exact provider-free target/custody policy selected for one caller-bound Cloud node.

func ValidateCloudOffsiteBackupExecutorArtifact 

func ValidateCloudOffsiteBackupExecutorArtifact(raw []byte, siteRef, nodeRef string) (CloudOffsiteBackupPolicy, error)

ValidateCloudOffsiteBackupExecutorArtifact verifies the complete artifact and selects one explicit Cloud node without resolving provider or target connection data.

type CloudPublicEdgeAccess 

type CloudPublicEdgeAccess struct {
	Exposure               string   `json:"exposure"`
	PolicyExposure         string   `json:"policyExposure"`
	Authentication         string   `json:"authentication"`
	Privilege              string   `json:"privilege"`
	EnrolledDeviceRequired bool     `json:"enrolledDeviceRequired"`
	OwnerStepUpRequired    bool     `json:"ownerStepUpRequired"`
	LANStepDown            bool     `json:"lanStepDown"`
	AllowedSiteRefs        []string `json:"allowedSiteRefs,omitempty"`
	AllowedMethods         []string `json:"allowedMethods,omitempty"`
	DefaultClosed          bool     `json:"defaultClosed"`
	PolicyRef              string   `json:"policyRef"`
}

type CloudPublicEdgeBackendMember 

type CloudPublicEdgeBackendMember struct {
	SiteRef     string `json:"siteRef"`
	NodeRef     string `json:"nodeRef"`
	InstanceRef string `json:"instanceRef"`
}

type CloudPublicEdgeBackendPool 

type CloudPublicEdgeBackendPool struct {
	UpstreamProtocol string                         `json:"upstreamProtocol"`
	TargetPort       int                            `json:"targetPort"`
	Members          []CloudPublicEdgeBackendMember `json:"members"`
}

type CloudPublicEdgeCapabilityAuthority 

type CloudPublicEdgeCapabilityAuthority struct {
	CapabilityRef string `json:"capabilityRef"`
	Role          string `json:"role"`
}

type CloudPublicEdgeHealthProbe 

type CloudPublicEdgeHealthProbe struct {
	Kind             string `json:"kind"`
	Protocol         string `json:"protocol"`
	Port             int    `json:"port"`
	TimeoutSeconds   int    `json:"timeoutSeconds"`
	Method           string `json:"method,omitempty"`
	FollowRedirects  *bool  `json:"followRedirects,omitempty"`
	Path             string `json:"path,omitempty"`
	ExpectedStatuses []int  `json:"expectedStatuses,omitempty"`
}

type CloudPublicEdgePolicy 

type CloudPublicEdgePolicy struct {
	StackID         string
	KitSlug         string
	SiteRef         string
	NodeRef         string
	NetworkMode     string
	TransportSubnet string
	IPv6            bool
	TLSMinVersion   string
	Routes          []CloudPublicEdgeRoute
}

CloudPublicEdgePolicy is the exact provider-free route policy carried by a validated public-edge artifact. Runtime addresses, credentials, certificate material, DNS mutation and server lifecycle are deliberately absent.

func ValidateCloudPublicEdgeExecutorArtifact 

func ValidateCloudPublicEdgeExecutorArtifact(raw []byte, siteRef, nodeRef string) (CloudPublicEdgePolicy, error)

ValidateCloudPublicEdgeExecutorArtifact verifies the complete artifact and selects one caller-bound Cloud edge node without discovering a target.

type CloudPublicEdgeProjection 

type CloudPublicEdgeProjection struct {
	CapabilityRef string                 `json:"capabilityRef"`
	Network       CloudNetworkPosture    `json:"network"`
	Routes        []CloudPublicEdgeRoute `json:"routes"`
}

type CloudPublicEdgeRoute 

type CloudPublicEdgeRoute struct {
	IngressAuth           string                               `json:"ingressAuth"`
	ID                    string                               `json:"id"`
	ServiceRef            string                               `json:"serviceRef"`
	ModuleRef             string                               `json:"moduleRef"`
	OriginSiteRef         string                               `json:"originSiteRef"`
	OriginSiteRefs        []string                             `json:"originSiteRefs"`
	OriginNodeRefs        []string                             `json:"originNodeRefs"`
	OriginSelector        string                               `json:"originSelector"`
	OriginSelection       *rawServiceEndpointOriginSelectionV2 `json:"originSelection,omitempty"`
	BackendPoolRef        string                               `json:"backendPoolRef"`
	BackendPool           CloudPublicEdgeBackendPool           `json:"backendPool"`
	Exposure              string                               `json:"exposure"`
	Protocol              string                               `json:"protocol"`
	UpstreamProtocol      string                               `json:"upstreamProtocol"`
	Port                  int                                  `json:"port"`
	TargetPort            int                                  `json:"targetPort"`
	Host                  string                               `json:"host"`
	Path                  string                               `json:"path"`
	Access                CloudPublicEdgeAccess                `json:"access"`
	TLS                   CloudPublicEdgeTLS                   `json:"tls"`
	HealthGateRef         string                               `json:"healthGateRef"`
	HealthProbe           CloudPublicEdgeHealthProbe           `json:"healthProbe"`
	CapabilityAuthorities []CloudPublicEdgeCapabilityAuthority `json:"capabilityAuthorities"`
}

type CloudPublicEdgeTLS 

type CloudPublicEdgeTLS struct {
	Required           bool   `json:"required"`
	Mode               string `json:"mode"`
	MinVersion         string `json:"minVersion,omitempty"`
	ProfileRef         string `json:"profileRef,omitempty"`
	IssuerRef          string `json:"issuerRef,omitempty"`
	OwnerCapabilityRef string `json:"ownerCapabilityRef,omitempty"`
}

type CloudreveWorkloadBundleDescriptor 

type CloudreveWorkloadBundleDescriptor struct {
	WorkloadRef string
	ModuleRef   string
	Release     string
	SiteRef     string
	NodeRef     string
	InstanceRef string
	Components  []SelectedPaaSWorkloadComponentDescriptor
	Route       ApplicationDeliveryRouteDescriptor
}

CloudreveWorkloadBundleDescriptor is the closed, credential-free runtime artifact accepted by the selected-PaaS executor.

func ParseCloudreveWorkloadBundle 

func ParseCloudreveWorkloadBundle(data []byte) (CloudreveWorkloadBundleDescriptor, error)

type Error 

type Error struct {
	Code    ErrorCode
	Path    string
	Message string
	Err     error
	// Committed is true only when the managed output swap and post-swap
	// verification completed before a later transaction-cleanup failure. A
	// caller must not interpret such an error as a rolled-back installation.
	Committed bool
}

Error identifies one fail-closed renderer or managed-output decision.

func (*Error) Error 

func (e *Error) Error() string

func (*Error) Unwrap 

func (e *Error) Unwrap() error

type ErrorCode 

type ErrorCode string

ErrorCode is stable across renderer and managed-output adapters. Callers should classify errors with errors.As instead of parsing messages. 

const (
	ErrAuthorization       ErrorCode = "authorization_required"
	ErrInvalidPlan         ErrorCode = "invalid_render_plan"
	ErrInvalidPath         ErrorCode = "invalid_render_path"
	ErrDuplicate           ErrorCode = "duplicate_render_contract"
	ErrUnknownRenderer     ErrorCode = "unknown_renderer"
	ErrRendererFailure     ErrorCode = "renderer_failure"
	ErrUndeclaredOutput    ErrorCode = "undeclared_render_output"
	ErrMissingOutput       ErrorCode = "missing_render_output"
	ErrOutputChanged       ErrorCode = "render_output_changed"
	ErrUnsafeOutputRoot    ErrorCode = "unsafe_output_root"
	ErrOutputBusy          ErrorCode = "output_transaction_busy"
	ErrOutputTransaction   ErrorCode = "output_transaction_failed"
	ErrTransactionRecovery ErrorCode = "output_transaction_recovery_required"
	ErrTransactionCleanup  ErrorCode = "output_transaction_cleanup_failed"
	ErrTransactionRollback ErrorCode = "output_transaction_rollback_failed"
)

type ExternalApplicationInstance 

type ExternalApplicationInstance struct {
	Platform            string `json:"platform"`
	InstallationMethod  string `json:"installationMethod"`
	InstanceOrigin      string `json:"instanceOrigin"`
	ManagementScope     string `json:"managementScope"`
	ConfigurationPolicy string `json:"configurationPolicy"`
	DataCustody         string `json:"dataCustody"`
	BaselinePolicy      string `json:"baselinePolicy"`
	BaselineVersion     string `json:"baselineVersion,omitempty"`
}

ExternalApplicationInstance is the CUE-owned contract. An unknown method stays unknown until the external owner observes it; product identity is not proof of an installation method or permission to mutate an instance.

type FederationControlAgentAction 

type FederationControlAgentAction = federationControlAction

FederationControlAgentAction is the deliberately closed, credential-free remote-action projection governed by the Modern CUE contract.

type FederationControlAgentPartition 

type FederationControlAgentPartition = modernFederationPartition

FederationControlAgentPartition is the exact failure policy carried by an outbound-control-agent artifact.

type FederationControlAgentPolicy 

type FederationControlAgentPolicy struct {
	StackID      string
	SiteRef      string
	NodeRef      string
	SiteKind     string
	ContractHash string
	Actions      []FederationControlAgentAction
	Partition    FederationControlAgentPartition
}

FederationControlAgentPolicy contains the exact, material-free policy for one Modern Site/node. Transport endpoints, credentials, tunnel mechanics and custody are intentionally absent.

func ValidateFederationControlAgentExecutorArtifact 

func ValidateFederationControlAgentExecutorArtifact(raw []byte, siteRef, nodeRef string) (FederationControlAgentPolicy, error)

ValidateFederationControlAgentExecutorArtifact verifies a complete node-local control-agent artifact. It does not discover a peer or transport: the caller is bound to exactly one compiler-selected Site/node.

type FederationLinkBindingPolicy 

type FederationLinkBindingPolicy struct {
	BindingRef            string
	FabricRef             string
	CustodyAttestationRef string
	RequirementsHash      string
	BindingHash           string
	BridgeContractHash    string
	IssuedAt              string
	ValidUntil            string
}

type FederationLinkOverlayPolicy 

type FederationLinkOverlayPolicy struct {
	ContractRef             string
	Implementation          string
	Initiation              string
	OutboundEstablished     bool
	TrafficMode             string
	AdvertisePrivateSubnets bool
	AdvertiseDefaultRoute   bool
	AllowBroadRoutes        bool
	PeerSiteRefs            []string
}

type FederationLinkPartitionPolicy 

type FederationLinkPartitionPolicy struct {
	OnCloudLoss                     string
	OnLinkLoss                      string
	CloudEdge                       string
	LocalIdentityAuthorityAvailable bool
	MaxStaleVerificationSeconds     int
	DenyNewCrossSiteSessions        bool
}

type FederationLinkPolicy 

type FederationLinkPolicy struct {
	StackID       string
	SiteRef       string
	NodeRef       string
	SiteKind      string
	HomeSiteRefs  []string
	CloudSiteRefs []string
	Overlay       FederationLinkOverlayPolicy
	Partition     FederationLinkPartitionPolicy
	Binding       FederationLinkBindingPolicy
}

FederationLinkPolicy is the material-free, caller-bound projection for one authenticated Home or Cloud node. The opaque binding proves external fabric custody without exposing endpoints, credentials, keys, provider resources, transport implementation, or general LAN routes.

func ValidateFederationLinkExecutorArtifact 

func ValidateFederationLinkExecutorArtifact(raw []byte, siteRef, nodeRef string, evaluatedAt time.Time) (FederationLinkPolicy, error)

ValidateFederationLinkExecutorArtifact verifies the executable contract, exact compiler/custody hashes, caller-bound Site/node and binding freshness at one trusted UTC instant immediately before runtime mutation.

type GiteaWorkloadBundleDescriptor 

type GiteaWorkloadBundleDescriptor struct {
	WorkloadRef      string
	ModuleRef        string
	Release          string
	SiteRef          string
	NodeRef          string
	InstanceRef      string
	OwnerPasswordRef string
	Components       []SelectedPaaSWorkloadComponentDescriptor
	Route            ApplicationDeliveryRouteDescriptor
}

GiteaWorkloadBundleDescriptor is the closed, credential-free runtime artifact accepted by the selected-PaaS executor. OwnerPasswordRef is opaque.

func ParseGiteaWorkloadBundle 

func ParseGiteaWorkloadBundle(data []byte) (GiteaWorkloadBundleDescriptor, error)

ParseGiteaWorkloadBundle validates the closed generated artifact before any selected-PaaS owner may consume it.

type HAAvailabilityExecutorArtifact 

type HAAvailabilityExecutorArtifact struct {
	StackID      string
	KitSlug      string
	ModuleID     string
	Policy       HAAvailabilityPolicy
	FailureModel HAFailureModel
	Members      []HAAvailabilityMember
}

HAAvailabilityExecutorArtifact is the material-free policy handed to the service-owned HA operations adapter for one exact member.

func ValidateHAAvailabilityExecutorArtifact 

func ValidateHAAvailabilityExecutorArtifact(raw []byte, moduleID, siteRef, nodeRef string) (HAAvailabilityExecutorArtifact, error)

ValidateHAAvailabilityExecutorArtifact validates one generated policy before the local owner hands it to any operations implementation.

type HAAvailabilityMember 

type HAAvailabilityMember struct {
	NodeRef       string `json:"nodeRef"`
	SiteRef       string `json:"siteRef"`
	FailureDomain string `json:"failureDomain"`
}

HAAvailabilityMember binds one control-plane node to its Site and failure domain without carrying provider, credential, endpoint, or transport data.

type HAAvailabilityPolicy 

type HAAvailabilityPolicy struct {
	Mode                string `json:"mode"`
	PolicyRef           string `json:"policyRef"`
	RealizationRef      string `json:"realizationRef"`
	ModuleRef           string `json:"moduleRef"`
	Selector            string `json:"selector"`
	RPOSeconds          int    `json:"rpoSeconds"`
	RTOSeconds          int    `json:"rtoSeconds"`
	FailureDomainSpread int    `json:"failureDomainSpread"`
	Fencing             string `json:"fencing"`
}

HAAvailabilityPolicy is the exact compiler-owned availability decision exposed to the provider-free local runtime owner.

type HAFailureModel 

type HAFailureModel struct {
	Basis             string `json:"basis"`
	MemberSiteScope   string `json:"memberSiteScope"`
	PartitionBehavior string `json:"partitionBehavior"`
}

HAFailureModel closes the member scope and partition behavior which the runtime owner must prove during readback.

type HomeAccessEnforcementPolicy 

type HomeAccessEnforcementPolicy struct {
	StackID string                       `json:"stackId"`
	SiteRef string                       `json:"siteRef"`
	NodeRef string                       `json:"nodeRef"`
	Routes  []HomeAccessEnforcementRoute `json:"routes"`
}

HomeAccessEnforcementPolicy is the closed, secret-free projection an authenticated Home access enforcer may consume. It deliberately excludes raw network configuration, addresses, credentials, discovery, sockets, and provider lifecycle authority.

func ValidateHomeAccessPolicyArtifact 

func ValidateHomeAccessPolicyArtifact(raw []byte) (HomeAccessEnforcementPolicy, error)

ValidateHomeAccessPolicyArtifact validates the exact generated policy bytes before they cross into a runtime adapter and returns a defensive projection. bound/bound with scope generation-only means compiler-bound generation from the CUE-owned localReachability projection: the policy is fail-closed and derived, not hand-authored. It is not live target proof; the SK-S1 producer run (anonymous 302, LAN 80/443 only, phone passkey) is still required to close the v0.25.0 exit gate.

type HomeAccessEnforcementRoute 

type HomeAccessEnforcementRoute struct {
	ID                     string   `json:"id"`
	ServiceRef             string   `json:"serviceRef"`
	ModuleRef              string   `json:"moduleRef"`
	OriginSiteRef          string   `json:"originSiteRef"`
	OriginNodeRefs         []string `json:"originNodeRefs"`
	Protocol               string   `json:"protocol"`
	UpstreamProtocol       string   `json:"upstreamProtocol"`
	Port                   int      `json:"port"`
	TargetPort             int      `json:"targetPort"`
	Host                   string   `json:"host,omitempty"`
	Path                   string   `json:"path,omitempty"`
	PolicyRef              string   `json:"policyRef"`
	PolicyExposure         string   `json:"policyExposure"`
	Authentication         string   `json:"authentication"`
	Privilege              string   `json:"privilege"`
	EnrolledDeviceRequired bool     `json:"enrolledDeviceRequired"`
	OwnerStepUpRequired    bool     `json:"ownerStepUpRequired"`
	LANStepDown            bool     `json:"lanStepDown"`
	AllowedSiteRefs        []string `json:"allowedSiteRefs"`
	AllowedMethods         []string `json:"allowedMethods,omitempty"`
	TLSRequired            bool     `json:"tlsRequired"`
	TLSMode                string   `json:"tlsMode"`
	TLSMinVersion          string   `json:"tlsMinVersion,omitempty"`
}

HomeAccessEnforcementRoute preserves only the compiler-owned local route and access decision that the Home enforcer must apply and read back.

type HomeAssistantInstanceArtifact 

type HomeAssistantInstanceArtifact struct {
	APIVersion string                      `json:"apiVersion"`
	ModuleRef  string                      `json:"moduleRef"`
	SiteRef    string                      `json:"siteRef"`
	NodeRef    string                      `json:"nodeRef"`
	Instance   ExternalApplicationInstance `json:"instance"`
}

func ValidateHomeAssistantInstanceArtifact 

func ValidateHomeAssistantInstanceArtifact(data []byte, module, site, node string) (HomeAssistantInstanceArtifact, error)

ValidateHomeAssistantInstanceArtifact rejects policy or target substitution before an API owner can observe or mutate its separately bound instance.

type HomeAssistantWorkloadBundleDescriptor 

type HomeAssistantWorkloadBundleDescriptor struct {
	WorkloadRef string
	ModuleRef   string
	Release     string
	SiteRef     string
	NodeRef     string
	InstanceRef string
	Components  []SelectedPaaSWorkloadComponentDescriptor
	Route       ApplicationDeliveryRouteDescriptor
}

func ParseHomeAssistantWorkloadBundle 

func ParseHomeAssistantWorkloadBundle(data []byte) (HomeAssistantWorkloadBundleDescriptor, error)

type HomeDeviceAuthorityEnforcementPolicy 

type HomeDeviceAuthorityEnforcementPolicy struct {
	StackID   string                      `json:"stackId"`
	KitSlug   string                      `json:"kitSlug"`
	Authority HomeDeviceAuthorityIdentity `json:"authority"`
	Issuer    HomeDeviceCredentialIssuer  `json:"issuer"`
}

HomeDeviceAuthorityEnforcementPolicy is the complete operation-shaped runtime custody document. Human/workload authorities, verifier placement, distribution, key bytes, endpoints, credentials, provider identity and lifecycle authority are structurally absent.

func ValidateHomeDeviceAuthorityPolicyArtifact 

func ValidateHomeDeviceAuthorityPolicyArtifact(raw []byte) (HomeDeviceAuthorityEnforcementPolicy, error)

ValidateHomeDeviceAuthorityPolicyArtifact validates the exact operation-shaped policy consumed by the local Home authority owner.

type HomeDeviceAuthorityIdentity 

type HomeDeviceAuthorityIdentity struct {
	ID             string `json:"id"`
	TrustDomainRef string `json:"trustDomainRef"`
	SiteRef        string `json:"siteRef"`
}

type HomeDeviceAuthorityInput 

type HomeDeviceAuthorityInput struct {
	Authority HomeDeviceAuthorityIdentity `json:"authority"`
	Issuer    HomeDeviceCredentialIssuer  `json:"issuer"`
}

type HomeDeviceCredentialIssuer 

type HomeDeviceCredentialIssuer struct {
	ID                            string               `json:"id"`
	AuthorityRef                  string               `json:"authorityRef"`
	Issuer                        string               `json:"issuer"`
	Audiences                     []string             `json:"audiences"`
	VerificationKeySetRef         string               `json:"verificationKeySetRef"`
	CredentialTTLSeconds          int                  `json:"lifetimeSeconds"`
	SessionTTLSeconds             int                  `json:"sessionTTLSeconds"`
	ProofOfPossessionRequired     bool                 `json:"proofOfPossessionRequired"`
	RevocationSupported           bool                 `json:"revocationSupported"`
	RevocationMaxStalenessSeconds int                  `json:"revocationMaxStalenessSeconds"`
	Enrollment                    HomeDeviceEnrollment `json:"enrollment"`
}

type HomeDeviceEnrollment 

type HomeDeviceEnrollment struct {
	Mode     string `json:"mode"`
	Exposure string `json:"exposure"`
}

type ImmichWorkloadBundleDescriptor 

type ImmichWorkloadBundleDescriptor struct {
	WorkloadRef string
	ModuleRef   string
	Release     string
	SiteRef     string
	NodeRef     string
	InstanceRef string
	SecretRef   string
	Components  []SelectedPaaSWorkloadComponentDescriptor
	Route       ApplicationDeliveryRouteDescriptor
}

ImmichWorkloadBundleDescriptor is the safe, credential-free projection of one validated Immich workload artifact. SecretRef is an opaque reference; this package never resolves or accepts secret material.

func ParseImmichWorkloadBundle 

func ParseImmichWorkloadBundle(data []byte) (ImmichWorkloadBundleDescriptor, error)

ParseImmichWorkloadBundle validates the closed generated artifact before a runtime adapter can consume it. No provider, endpoint, credential, daemon, socket, lease, generation, or lifecycle authority exists in this schema.

type InstallOptions 

type InstallOptions struct {
	WorkspaceRoot string
	GeneratedAt   string
}

InstallOptions controls an Architecture v2 managed-output transaction. WorkspaceRoot must already exist and may not be a symlink. GeneratedAt is optional receipt metadata and must use RFC3339 when provided.

type InstallResult 

type InstallResult struct {
	Committed  bool
	OutputRoot string
	Manifest   generationartifact.ArtifactManifest
	Receipt    generationartifact.GenerationReceipt
}

InstallResult exposes the exact manifest and receipt installed with the managed output root. Committed remains true when installation succeeded but best-effort transaction cleanup subsequently failed.

type InternalPKIExecutorArtifact 

type InternalPKIExecutorArtifact struct {
	StackID            string
	Authority          InternalPKIRuntimeAuthority
	TrustTargets       []InternalPKIRuntimeTrustTarget
	LeafIdentities     []InternalPKIRuntimeLeafIdentity
	ValiditySeconds    int
	RenewBeforeSeconds int
}

func ValidateInternalPKIExecutorArtifact 

func ValidateInternalPKIExecutorArtifact(raw []byte, siteRef, nodeRef string) (InternalPKIExecutorArtifact, error)

ValidateInternalPKIExecutorArtifact validates the immutable generated policy and binds it to the one authenticated authority target. It returns logical material requirements only; certificate and private-key bytes are excluded.

type InternalPKIRuntimeAuthority 

type InternalPKIRuntimeAuthority struct {
	ID             string   `json:"id"`
	SiteRef        string   `json:"siteRef"`
	NodeRef        string   `json:"nodeRef"`
	TrustDomainRef string   `json:"trustDomainRef"`
	SubjectRef     string   `json:"subjectRef"`
	KeyAlgorithm   string   `json:"keyAlgorithm"`
	KeyUsage       []string `json:"keyUsage"`
}

type InternalPKIRuntimeLeafIdentity 

type InternalPKIRuntimeLeafIdentity struct {
	ID         string   `json:"id"`
	RouteRef   string   `json:"routeRef"`
	ServiceRef string   `json:"serviceRef"`
	ModuleRef  string   `json:"moduleRef"`
	SiteRef    string   `json:"siteRef"`
	NodeRef    string   `json:"nodeRef"`
	SubjectRef string   `json:"subjectRef"`
	DNSSANs    []string `json:"dnsSANs"`
	IPSANs     []string `json:"ipSANs"`
}

type InternalPKIRuntimeTrustTarget 

type InternalPKIRuntimeTrustTarget struct {
	SiteRef string `json:"siteRef"`
	NodeRef string `json:"nodeRef"`
}

type JellyfinWorkloadBundleDescriptor 

type JellyfinWorkloadBundleDescriptor struct {
	WorkloadRef string
	ModuleRef   string
	Release     string
	SiteRef     string
	NodeRef     string
	InstanceRef string
	Components  []SelectedPaaSWorkloadComponentDescriptor
	Route       ApplicationDeliveryRouteDescriptor
}

func ParseJellyfinWorkloadBundle 

func ParseJellyfinWorkloadBundle(data []byte) (JellyfinWorkloadBundleDescriptor, error)

type LocalAutonomyEnforcementDataBinding 

type LocalAutonomyEnforcementDataBinding struct {
	BindingRef         string   `json:"bindingRef"`
	PrimarySiteRef     string   `json:"primarySiteRef"`
	ReplicaSiteRefs    []string `json:"replicaSiteRefs"`
	CloudPlacement     string   `json:"cloudPlacement"`
	CloudCopyPolicyRef string   `json:"cloudCopyPolicyRef,omitempty"`
}

type LocalAutonomyEnforcementPolicy 

type LocalAutonomyEnforcementPolicy struct {
	StackID                         string                                `json:"stackId"`
	KitSlug                         string                                `json:"kitSlug"`
	SiteRef                         string                                `json:"siteRef"`
	NodeRef                         string                                `json:"nodeRef"`
	CloudSiteRefs                   []string                              `json:"cloudSiteRefs"`
	ControlMode                     string                                `json:"controlMode"`
	ControlMembers                  []string                              `json:"controlMembers"`
	EdgeVerifierSiteRefs            []string                              `json:"edgeVerifierSiteRefs"`
	DataDefaultAuthority            string                                `json:"dataDefaultAuthority"`
	DataBindings                    []LocalAutonomyEnforcementDataBinding `json:"dataBindings"`
	OnCloudLoss                     string                                `json:"onCloudLoss"`
	OnLinkLoss                      string                                `json:"onLinkLoss"`
	CloudEdge                       string                                `json:"cloudEdge"`
	LocalIdentityAuthorityAvailable bool                                  `json:"localIdentityAuthorityAvailable"`
	MaxStaleVerificationSeconds     int                                   `json:"maxStaleVerificationSeconds"`
	DenyNewCrossSiteSessions        bool                                  `json:"denyNewCrossSiteSessions"`
}

LocalAutonomyEnforcementPolicy is the exact operation-shaped custody of one Home control node. It cannot name provider resources, endpoints, credentials, arbitrary LAN reachability, enrollment ceremony, or data classes.

func ValidateLocalAutonomyPolicyArtifact 

func ValidateLocalAutonomyPolicyArtifact(raw []byte) (LocalAutonomyEnforcementPolicy, error)

type LocalAutonomyFailureDecision 

type LocalAutonomyFailureDecision struct {
	OnCloudLoss                 string `json:"onCloudLoss"`
	OnLinkLoss                  string `json:"onLinkLoss"`
	CloudEdge                   string `json:"cloudEdge"`
	MaxStaleVerificationSeconds int    `json:"maxStaleVerificationSeconds"`
	DenyNewCrossSiteSessions    bool   `json:"denyNewCrossSiteSessions"`
}

type ModernFederationFlow 

type ModernFederationFlow = modernFederationFlow

ModernFederationFlow is one exact, identity-bound cross-Site allow rule. It contains no endpoint, credential, provider resource, or transport handle.

type ModernFederationPartitionPolicy 

type ModernFederationPartitionPolicy = modernFederationPartition

ModernFederationPartitionPolicy is the exact fail-closed failure policy admitted for local enforcement.

type ModernFederationPolicyEnforcementPolicy 

type ModernFederationPolicyEnforcementPolicy struct {
	StackID       string
	KitSlug       string
	SiteRefs      []string
	HomeSiteRefs  []string
	CloudSiteRefs []string
	DefaultDeny   bool
	AllowedFlows  []ModernFederationFlow
	Partition     ModernFederationPartitionPolicy
}

ModernFederationPolicyEnforcementPolicy is the closed, credential-free projection a local policy executor may consume. The external link binding is deliberately absent and remains an independent Apply admission.

func ValidateModernFederationPolicyArtifact 

func ValidateModernFederationPolicyArtifact(raw []byte) (ModernFederationPolicyEnforcementPolicy, error)

ValidateModernFederationPolicyArtifact verifies the immutable renderer envelope and re-runs the complete governed Modern policy validation before exposing the narrow local-enforcement projection.

type ModernIdentityTrustDistribution 

type ModernIdentityTrustDistribution struct {
	ID                  string   `json:"id"`
	Principal           string   `json:"principal"`
	CredentialIssuerRef string   `json:"issuerRef"`
	Issuer              string   `json:"issuer"`
	FromSiteRefs        []string `json:"fromSiteRefs,omitempty"`
	ToSiteRefs          []string `json:"toSiteRefs,omitempty"`
	Materials           []string `json:"materials"`
	MaxStalenessSeconds int      `json:"maxStalenessSeconds"`
}

type ModernIdentityTrustEnforcementPolicy 

type ModernIdentityTrustEnforcementPolicy struct {
	StackID         string                            `json:"stackId"`
	KitSlug         string                            `json:"kitSlug"`
	HomeSiteRefs    []string                          `json:"homeSiteRefs"`
	CloudSiteRefs   []string                          `json:"cloudSiteRefs"`
	MaxStaleSeconds int                               `json:"maxStaleSeconds"`
	Issuers         []ModernIdentityTrustIssuer       `json:"issuers,omitempty"`
	Verifiers       []ModernIdentityTrustVerifier     `json:"verifiers"`
	Distributions   []ModernIdentityTrustDistribution `json:"distributions"`
}

func ValidateModernCloudIdentityVerifierPolicyArtifact 

func ValidateModernCloudIdentityVerifierPolicyArtifact(raw []byte) (ModernIdentityTrustEnforcementPolicy, error)

func ValidateModernHomeIdentityTrustPolicyArtifact 

func ValidateModernHomeIdentityTrustPolicyArtifact(raw []byte) (ModernIdentityTrustEnforcementPolicy, error)

func ValidateModernIdentityTrustPolicyArtifacts 

func ValidateModernIdentityTrustPolicyArtifacts(homeRaw, cloudRaw []byte) (ModernIdentityTrustEnforcementPolicy, error)

type ModernIdentityTrustIssuer 

type ModernIdentityTrustIssuer struct {
	ID                            string   `json:"id"`
	AuthorityRef                  string   `json:"authorityRef"`
	Principal                     string   `json:"principal"`
	Issuer                        string   `json:"issuer"`
	Audiences                     []string `json:"audiences"`
	VerificationKeySetRef         string   `json:"verificationKeySetRef"`
	ProofOfPossessionRequired     bool     `json:"proofOfPossessionRequired"`
	RevocationMaxStalenessSeconds int      `json:"revocationMaxStalenessSeconds"`
	CredentialTTLSeconds          int      `json:"lifetimeSeconds"`
	SessionTTLSeconds             int      `json:"sessionTTLSeconds"`
	EnrollmentMode                string   `json:"enrollmentMode"`
	EnrollmentExposure            string   `json:"enrollmentExposure"`
}

type ModernIdentityTrustVerifier 

type ModernIdentityTrustVerifier struct {
	ID                            string   `json:"id"`
	Principal                     string   `json:"principal"`
	CredentialIssuerRef           string   `json:"issuerRef"`
	Issuer                        string   `json:"issuer"`
	Audiences                     []string `json:"audiences"`
	VerificationKeySetRef         string   `json:"verificationKeySetRef"`
	SiteRefs                      []string `json:"siteRefs,omitempty"`
	SiteKind                      string   `json:"siteKind,omitempty"`
	ProofOfPossessionRequired     bool     `json:"proofOfPossessionRequired"`
	RevocationMaxStalenessSeconds int      `json:"revocationMaxStalenessSeconds"`
}

type PaperlessWorkloadBundleDescriptor 

type PaperlessWorkloadBundleDescriptor struct {
	WorkloadRef string
	ModuleRef   string
	Release     string
	SiteRef     string
	NodeRef     string
	InstanceRef string
	Components  []SelectedPaaSWorkloadComponentDescriptor
	Route       ApplicationDeliveryRouteDescriptor
}

PaperlessWorkloadBundleDescriptor is the closed, credential-free runtime artifact accepted by the selected application adapter.

func ParsePaperlessWorkloadBundle 

func ParsePaperlessWorkloadBundle(data []byte) (PaperlessWorkloadBundleDescriptor, error)

ParsePaperlessWorkloadBundle validates the closed artifact before a runtime owner may consume it. Secret values remain opaque references.

type PrivateAIWorkloadBundleDescriptor 

type PrivateAIWorkloadBundleDescriptor struct {
	WorkloadRef      string
	ModuleRef        string
	Release          string
	SiteRef          string
	NodeRef          string
	InstanceRef      string
	OwnerPasswordRef string
	Components       []SelectedPaaSWorkloadComponentDescriptor
	Route            ApplicationDeliveryRouteDescriptor
}

PrivateAIWorkloadBundleDescriptor is the closed, credential-free runtime artifact accepted by the selected-PaaS executor. OwnerPasswordRef is opaque.

func ParsePrivateAIWorkloadBundle 

func ParsePrivateAIWorkloadBundle(data []byte) (PrivateAIWorkloadBundleDescriptor, error)

ParsePrivateAIWorkloadBundle validates the closed generated artifact before any selected-PaaS owner may consume it.

type PterodactylWorkloadBundleDescriptor added in v0.41.0 

type PterodactylWorkloadBundleDescriptor struct {
	WorkloadRef string
	ModuleRef   string
	Release     string
	SiteRef     string
	NodeRef     string
	InstanceRef string
	Route       ApplicationDeliveryRouteDescriptor
}

PterodactylWorkloadBundleDescriptor is the closed runtime artifact accepted by the standalone application adapter for the Game workload (ADR-0043).

func ParsePterodactylWorkloadBundle added in v0.41.0 

func ParsePterodactylWorkloadBundle(data []byte) (PterodactylWorkloadBundleDescriptor, error)

ParsePterodactylWorkloadBundle validates the closed artifact before a runtime owner may consume it.

type PublicTLSExecutorArtifact 

type PublicTLSExecutorArtifact struct {
	StackID string
	SiteRef string
	NodeRef string
	Profile PublicTLSRuntimeProfile
	Issuer  PublicTLSRuntimeIssuer
	Routes  []PublicTLSRuntimeRoute
}

PublicTLSExecutorArtifact is the closed, credential-free policy consumed by an authenticated Cloud TLS operations owner. Material slot names are logical handles only; material bytes and ACME credentials never enter this value.

func ValidatePublicTLSExecutorArtifact 

func ValidatePublicTLSExecutorArtifact(raw []byte, siteRef, nodeRef string) (PublicTLSExecutorArtifact, error)

ValidatePublicTLSExecutorArtifact validates the immutable artifact shell, recomputes the closed plan projection, and binds it to one exact Cloud Site/node instance. It returns no credential or material content.

type PublicTLSRuntimeIssuer 

type PublicTLSRuntimeIssuer struct {
	ID                   string
	Kind                 string
	Challenge            string
	ValiditySeconds      int
	MaterialSlots        []PublicTLSRuntimeMaterialSlot
	RenewBeforeSeconds   int
	RenewalHealthGateRef string
}

type PublicTLSRuntimeMaterialSlot 

type PublicTLSRuntimeMaterialSlot struct {
	ID          string
	Purpose     string
	Sensitivity string
}

type PublicTLSRuntimeProfile 

type PublicTLSRuntimeProfile struct {
	ID             string
	Mode           string
	TrustDomain    string
	MinimumVersion string
}

type PublicTLSRuntimeRoute 

type PublicTLSRuntimeRoute struct {
	ID         string
	Host       string
	Port       int
	Path       string
	Protocol   string
	TLSMode    string
	MinVersion string
	ProfileRef string
	IssuerRef  string
}

type Registry 

type Registry struct {
	// contains filtered or unexported fields
}

Registry maps exact renderer contracts to implementations. There is no renderer-only, prefix, semantic-version, latest-version, or template/hash fallback lookup.

func NewProductRegistry 

func NewProductRegistry() (*Registry, error)

NewProductRegistry returns the exact built-in renderer set for product Architecture v2 plans. Registration has no version, prefix, or latest fallback: every future template change needs a new governed contract.

func NewRegistry 

func NewRegistry() *Registry

NewRegistry returns an empty exact-ID registry.

func (*Registry) HasExact 

func (r *Registry) HasExact(contract RendererContract) bool

HasExact reports whether the complete immutable renderer identity is registered. It exposes no implementation and performs no fallback lookup.

func (*Registry) Register 

func (r *Registry) Register(contract RendererContract, renderer UnitRenderer) error

Register installs one implementation under an exact, hash-bound renderer contract. A new template version or contract hash requires a new explicit registration even when rendererRef is unchanged.

type RenderResult 

type RenderResult struct {
	// contains filtered or unexported fields
}

RenderResult is bound to the exact authorized plan that produced it. Its fields are private so production installation cannot be fed an arbitrary artifact collection.

func RenderVerifiedPlan 

func RenderVerifiedPlan(ctx context.Context, plan generationartifact.VerifiedPlan, registry *Registry) (RenderResult, error)

RenderVerifiedPlan is the plan-pure renderer kernel. It performs no filesystem mutation and accepts only the immutable result of the governed CUE contract verifier. The Architecture v2 service owns the authorization session that may call this kernel and any later installation transaction.

func (RenderResult) Artifacts 

func (r RenderResult) Artifacts() []Artifact

Artifacts returns a deep defensive copy in deterministic order.

func (RenderResult) MarshalCanonical 

func (r RenderResult) MarshalCanonical() ([]byte, error)

MarshalCanonical emits deterministic result bytes. Artifact order is fixed by Render, struct field order is fixed here, and byte slices use JSON's stable base64 representation.

type RenderUnit 

type RenderUnit struct {
	// contains filtered or unexported fields
}

RenderUnit is the immutable logical-unit plus exact-instance projection handed to a renderer. JSON and list accessors return defensive copies.

func (RenderUnit) ContainerImageDigest 

func (u RenderUnit) ContainerImageDigest() (string, bool)

func (RenderUnit) ContainerImageRef 

func (u RenderUnit) ContainerImageRef() (string, bool)

func (RenderUnit) ContractHash 

func (u RenderUnit) ContractHash() string

func (RenderUnit) DaemonEngine 

func (u RenderUnit) DaemonEngine() (string, bool)

DaemonEngine and DaemonSocketPath expose the exact node-scoped daemon binding only for one-per-daemon instances. Other placement shapes return false rather than inheriting or guessing host runtime metadata.

func (RenderUnit) DaemonInstanceRef 

func (u RenderUnit) DaemonInstanceRef() (string, bool)

func (RenderUnit) DaemonRef 

func (u RenderUnit) DaemonRef() (string, bool)

func (RenderUnit) DaemonSocketPath 

func (u RenderUnit) DaemonSocketPath() (string, bool)

func (RenderUnit) DeclaredOutputs 

func (u RenderUnit) DeclaredOutputs() []string

func (RenderUnit) ID 

func (u RenderUnit) ID() string

func (RenderUnit) InputBindingsJSON 

func (u RenderUnit) InputBindingsJSON() []byte

func (RenderUnit) InstanceID 

func (u RenderUnit) InstanceID() string

func (RenderUnit) InstanceScope 

func (u RenderUnit) InstanceScope() string

func (RenderUnit) Kind 

func (u RenderUnit) Kind() string

func (RenderUnit) LogicalNodeRefs 

func (u RenderUnit) LogicalNodeRefs() []string

func (RenderUnit) LogicalSiteRefs 

func (u RenderUnit) LogicalSiteRefs() []string

LogicalSiteRefs and LogicalNodeRefs expose the governed eligible set for a module-scoped renderer. They are never an instruction to choose a node; node-local work always uses the exact optional instance accessors below.

func (RenderUnit) ModuleID 

func (u RenderUnit) ModuleID() string

func (RenderUnit) NetworkDomainBase 

func (u RenderUnit) NetworkDomainBase() (string, bool)

func (RenderUnit) NetworkSubdomainPrefix 

func (u RenderUnit) NetworkSubdomainPrefix() (string, bool)

func (RenderUnit) NodeRef 

func (u RenderUnit) NodeRef() (string, bool)

func (RenderUnit) PlacementJSON 

func (u RenderUnit) PlacementJSON() []byte

func (RenderUnit) PlanInputRefs 

func (u RenderUnit) PlanInputRefs() []string

func (RenderUnit) PlanInputsJSON 

func (u RenderUnit) PlanInputsJSON() []byte

func (RenderUnit) PrivilegedInterfaceApprovalsJSON 

func (u RenderUnit) PrivilegedInterfaceApprovalsJSON() []byte

PrivilegedInterfaceApprovalsJSON returns only central direct-interface approvals bound to this module/unit. It does not expose approvals owned by other modules and never manufactures authority from the socket binding.

func (RenderUnit) ProvidedInterfacesJSON 

func (u RenderUnit) ProvidedInterfacesJSON() []byte

func (RenderUnit) PublicInputRefs 

func (u RenderUnit) PublicInputRefs() []string

func (RenderUnit) RendererRef 

func (u RenderUnit) RendererRef() string

func (RenderUnit) RequiredInterfacesJSON 

func (u RenderUnit) RequiredInterfacesJSON() []byte

func (RenderUnit) RuntimeComponentsJSON 

func (u RenderUnit) RuntimeComponentsJSON() []byte

func (RenderUnit) RuntimeDelivery 

func (u RenderUnit) RuntimeDelivery() string

func (RenderUnit) RuntimeEngine 

func (u RenderUnit) RuntimeEngine() (string, bool)

func (RenderUnit) RuntimeEntryComponentRef 

func (u RenderUnit) RuntimeEntryComponentRef() (string, bool)

func (RenderUnit) RuntimeKind 

func (u RenderUnit) RuntimeKind() string

func (RenderUnit) RuntimeListenersJSON 

func (u RenderUnit) RuntimeListenersJSON() []byte

RuntimeListenersJSON returns the exact catalog-owned physical listener declarations for this render unit. Renderers cannot infer host bindings from routes, service target ports, health checks, or provider state.

func (RenderUnit) RuntimeNetworkBindingsJSON 

func (u RenderUnit) RuntimeNetworkBindingsJSON() []byte

RuntimeNetworkBindingsJSON returns only the exact, reciprocal network memberships bound to this render instance. It never exposes the global runtime-network graph and therefore cannot be used to derive membership from a logical networkRef.

func (RenderUnit) RuntimeSettingsJSON 

func (u RenderUnit) RuntimeSettingsJSON() []byte

func (RenderUnit) SecretInputRefs 

func (u RenderUnit) SecretInputRefs() []string

func (RenderUnit) SecretRefsJSON 

func (u RenderUnit) SecretRefsJSON() []byte

func (RenderUnit) ServiceEndpointsJSON 

func (u RenderUnit) ServiceEndpointsJSON() []byte

ServiceEndpointsJSON returns the exact catalog-owned backend contracts for this logical render unit. Renderers may consume them but cannot infer, discover, or widen endpoint identity, protocol, port, exposure, or locality.

func (RenderUnit) SiteRef 

func (u RenderUnit) SiteRef() (string, bool)

func (RenderUnit) TemplateRef 

func (u RenderUnit) TemplateRef() string

func (RenderUnit) ValuesJSON 

func (u RenderUnit) ValuesJSON() []byte

func (RenderUnit) Version 

func (u RenderUnit) Version() string

type RendererContract 

type RendererContract struct {
	Kind         string
	RendererRef  string
	TemplateRef  string
	Version      string
	ContractHash string
}

RendererContract is the complete immutable implementation identity carried by one render unit. Every field participates in registry lookup.

func BasementComposeRuntimeExecutorBundleRendererContract 

func BasementComposeRuntimeExecutorBundleRendererContract() RendererContract

BasementComposeRuntimeExecutorBundleRendererContract returns the exact generation-only Basement Compose handoff identity.

func BasementCoreComposeRendererContract 

func BasementCoreComposeRendererContract() RendererContract

func BasementCoreLiteComposeRendererContract 

func BasementCoreLiteComposeRendererContract() RendererContract

func BasementCoreLiteOpenTofuRendererContract 

func BasementCoreLiteOpenTofuRendererContract() RendererContract

func BasementCoreLiteTerramateRendererContract 

func BasementCoreLiteTerramateRendererContract() RendererContract

func BasementCoreOpenTofuRendererContract 

func BasementCoreOpenTofuRendererContract() RendererContract

func BasementCoreTerramateRendererContract 

func BasementCoreTerramateRendererContract() RendererContract

BasementCoreTerramateRendererContract returns the immutable renderer identity for the Terramate orchestration layer over the existing OpenTofu Basement module.

func BasementIdentityTrustPolicyRendererContract 

func BasementIdentityTrustPolicyRendererContract() RendererContract

func BridgeOriginMTLSExecutorBundleRendererContract 

func BridgeOriginMTLSExecutorBundleRendererContract() RendererContract

func BridgePublicationExecutorBundleRendererContract 

func BridgePublicationExecutorBundleRendererContract() RendererContract

func CloudCoreComposeRendererContract 

func CloudCoreComposeRendererContract() RendererContract

func CloudHostSecurityExecutorBundleRendererContract 

func CloudHostSecurityExecutorBundleRendererContract() RendererContract

CloudHostSecurityExecutorBundleRendererContract returns the exact typed, provider-free Cloud host-security handoff identity.

func CloudIdentityTrustPolicyRendererContract 

func CloudIdentityTrustPolicyRendererContract() RendererContract

func CloudOffsiteBackupExecutorBundleRendererContract 

func CloudOffsiteBackupExecutorBundleRendererContract() RendererContract

CloudOffsiteBackupExecutorBundleRendererContract returns the exact executable Cloud offsite-backup target binding identity.

func CloudPrivateAdminMeshExecutorBundleRendererContract 

func CloudPrivateAdminMeshExecutorBundleRendererContract() RendererContract

CloudPrivateAdminMeshExecutorBundleRendererContract returns the exact generation-only private admin-mesh handoff identity.

func CloudPublicEdgeExecutorBundleRendererContract 

func CloudPublicEdgeExecutorBundleRendererContract() RendererContract

CloudPublicEdgeExecutorBundleRendererContract returns the exact executable Cloud public-edge handoff identity.

func CloudStandaloneCoreComposeRendererContract 

func CloudStandaloneCoreComposeRendererContract() RendererContract

CloudStandaloneCoreComposeRendererContract returns the distinct renderer identity for the no-PaaS Cloud core. The existing Cloud contract remains unchanged for explicit PaaS-bearing selections.

func CloudreveWorkloadBundleRendererContract 

func CloudreveWorkloadBundleRendererContract() RendererContract

func CoolifyRuntimeAdapterRendererContract 

func CoolifyRuntimeAdapterRendererContract() RendererContract

CoolifyRuntimeAdapterRendererContract returns the exact implementation identity of the provider-free Coolify workload-adapter handoff.

func CoreHostBootstrapRendererContract 

func CoreHostBootstrapRendererContract() RendererContract

CoreHostBootstrapRendererContract returns the exact implementation identity for the provider-free, node-local Core host preparation policy.

func CoreRuntimeExecutorBundleRendererContract 

func CoreRuntimeExecutorBundleRendererContract() RendererContract

CoreRuntimeExecutorBundleRendererContract returns the exact immutable renderer identity for the shared generation-only executor handoff.

func FederationBackupExecutorBundleRendererContract 

func FederationBackupExecutorBundleRendererContract() RendererContract

func FederationControlAgentExecutorBundleRendererContract 

func FederationControlAgentExecutorBundleRendererContract() RendererContract

func FederationLinkExecutorBundleRendererContract 

func FederationLinkExecutorBundleRendererContract() RendererContract

func FederationObservabilityExecutorBundleRendererContract 

func FederationObservabilityExecutorBundleRendererContract() RendererContract

func GiteaWorkloadBundleRendererContract 

func GiteaWorkloadBundleRendererContract() RendererContract

func HAAvailabilityExecutorContractRendererContract 

func HAAvailabilityExecutorContractRendererContract() RendererContract

HAAvailabilityExecutorContractRendererContract is shared only at renderer identity level. The generated plan remains bound to one exact catalog module, policy and control-plane member.

func HomeAccessPolicyRendererContract 

func HomeAccessPolicyRendererContract() RendererContract

func HomeAssistantInstanceRendererContract 

func HomeAssistantInstanceRendererContract() RendererContract

func HomeAssistantWorkloadBundleRendererContract 

func HomeAssistantWorkloadBundleRendererContract() RendererContract

func HomeBackupTargetRendererContract 

func HomeBackupTargetRendererContract() RendererContract

HomeBackupTargetRendererContract returns the exact implementation identity for the node-local Home backup-target observation policy.

func HomeDeviceAuthorityPolicyRendererContract 

func HomeDeviceAuthorityPolicyRendererContract() RendererContract

func HomeEncryptedOffsiteBackupExecutorBundleRendererContract 

func HomeEncryptedOffsiteBackupExecutorBundleRendererContract() RendererContract

func HomeLANDNSPolicyRendererContract 

func HomeLANDNSPolicyRendererContract() RendererContract

HomeLANDNSPolicyRendererContract returns the exact built-in identity for the generation-only LAN DNS policy. Its immutable shell declares the resolver contract and explicitly marks runtime enforcement unverified with the executor pending.

func HomeLANDiscoveryPolicyRendererContract 

func HomeLANDiscoveryPolicyRendererContract() RendererContract

HomeLANDiscoveryPolicyRendererContract returns the exact built-in identity for the generation-only discovery policy. Its immutable shell explicitly denies implicit advertisements and makes no DNS, address, interface, or runtime-enforcement claim.

func HomePrivateRemoteAccessExecutorBundleRendererContract 

func HomePrivateRemoteAccessExecutorBundleRendererContract() RendererContract

func HomePublicPublishEgressExecutorBundleRendererContract 

func HomePublicPublishEgressExecutorBundleRendererContract() RendererContract

func ImmichLiteWorkloadBundleRendererContract 

func ImmichLiteWorkloadBundleRendererContract() RendererContract

func ImmichWorkloadBundleRendererContract 

func ImmichWorkloadBundleRendererContract() RendererContract

func InternalPKIExecutorContractRendererContract 

func InternalPKIExecutorContractRendererContract() RendererContract

func JellyfinWorkloadBundleRendererContract 

func JellyfinWorkloadBundleRendererContract() RendererContract

func KomodoCoreRendererContract 

func KomodoCoreRendererContract() RendererContract

KomodoCoreRendererContract returns the exact Core API handoff identity.

func KomodoPeripheryRendererContract 

func KomodoPeripheryRendererContract() RendererContract

KomodoPeripheryRendererContract returns the exact node-agent handoff identity.

func LocalAutonomyPolicyRendererContract 

func LocalAutonomyPolicyRendererContract() RendererContract

func LocalKopiaRuntimeRendererContract 

func LocalKopiaRuntimeRendererContract() RendererContract

LocalKopiaRuntimeRendererContract identifies the secret-free projection consumed by the owner-authorized local Kopia command path.

func LocalRuntimeExecutorBundleRendererContract 

func LocalRuntimeExecutorBundleRendererContract() RendererContract

LocalRuntimeExecutorBundleRendererContract returns the exact immutable renderer identity for the Home-local generation-only executor handoff.

func ModernCloudIdentityVerifierPolicyRendererContract 

func ModernCloudIdentityVerifierPolicyRendererContract() RendererContract

func ModernFederationPolicyRendererContract 

func ModernFederationPolicyRendererContract() RendererContract

ModernFederationPolicyRendererContract returns the exact built-in identity for the generation-only policy manifest. The hash covers the immutable JSON shell and its explicit statement that transport/runtime enforcement is not part of this renderer.

func ModernHomeIdentityTrustPolicyRendererContract 

func ModernHomeIdentityTrustPolicyRendererContract() RendererContract

func ModernHomeRuntimeExecutorBundleRendererContract 

func ModernHomeRuntimeExecutorBundleRendererContract() RendererContract

ModernHomeRuntimeExecutorBundleRendererContract returns the retired Modern Home umbrella identity for isolated migration diagnostics only. Product v2 plans cannot select or render it; concrete workload modules own execution.

func MonitoringAgentIntentRendererContract 

func MonitoringAgentIntentRendererContract() RendererContract

MonitoringAgentIntentRendererContract returns the exact built-in identity for the provider-free collector intent. The immutable template declares that runtime lifecycle is bound through an external owner while credentials and provider ownership remain outside StackKits.

func PaperlessWorkloadBundleRendererContract 

func PaperlessWorkloadBundleRendererContract() RendererContract

func PrivateAIWorkloadBundleRendererContract 

func PrivateAIWorkloadBundleRendererContract() RendererContract

func PterodactylWorkloadBundleRendererContract added in v0.41.0 

func PterodactylWorkloadBundleRendererContract() RendererContract

func PublicTLSExecutorContractRendererContract 

func PublicTLSExecutorContractRendererContract() RendererContract

PublicTLSExecutorContractRendererContract returns the exact immutable operation-shaped handoff identity for the catalog-owned public TLS contract.

func SecurityBaselineRendererContract 

func SecurityBaselineRendererContract() (RendererContract, error)

SecurityBaselineRendererContract returns the exact built-in implementation identity for the canonical Architecture v2 host policy. The hash binds the catalog contract to the rendered script bytes, not merely to a renderer function name.

func SocketProxyRendererContract 

func SocketProxyRendererContract() RendererContract

SocketProxyRendererContract returns the exact built-in product renderer identity. The hash covers the complete immutable Compose policy, including the pinned image, deny-list, mount target, security posture, and the two authority-owned instance placeholders.

func StandaloneComposeRuntimeAdapterRendererContract 

func StandaloneComposeRuntimeAdapterRendererContract() RendererContract

StandaloneComposeRuntimeAdapterRendererContract returns the immutable implementation identity of the StackKits-owned no-PaaS adapter.

func VaultwardenWorkloadBundleRendererContract 

func VaultwardenWorkloadBundleRendererContract() RendererContract

type SelectedPaaSWorkloadComponentDescriptor 

type SelectedPaaSWorkloadComponentDescriptor struct {
	ID            string
	Lifecycle     string
	HealthFailure string
	ImageRef      string
	ImageDigest   string
}

SelectedPaaSWorkloadComponentDescriptor is the immutable component identity every external selected-PaaS adapter must observe after applying a bundle.

type UnitOutput 

type UnitOutput struct {
	Ref   string
	Bytes []byte
}

UnitOutput carries bytes for exactly one declared render-unit output ref.

type UnitRenderer 

type UnitRenderer interface {
	RenderUnit(context.Context, RenderUnit) ([]UnitOutput, error)
}

UnitRenderer renders exactly one explicit execution instance of one governed logical render unit. Implementations get only normalized, immutable plan inputs and return logical outputs by declared ref; they never receive legacy StackSpec models or derive artifact paths or node placement.

type UnitRendererFunc 

type UnitRendererFunc func(context.Context, RenderUnit) ([]UnitOutput, error)

UnitRendererFunc adapts a function to UnitRenderer.

func (UnitRendererFunc) RenderUnit 

func (f UnitRendererFunc) RenderUnit(ctx context.Context, unit RenderUnit) ([]UnitOutput, error)

type VaultwardenWorkloadBundleDescriptor 

type VaultwardenWorkloadBundleDescriptor struct {
	WorkloadRef   string
	ModuleRef     string
	Release       string
	SiteRef       string
	NodeRef       string
	InstanceRef   string
	AdminTokenRef string
	Components    []SelectedPaaSWorkloadComponentDescriptor
	Route         ApplicationDeliveryRouteDescriptor
}

VaultwardenWorkloadBundleDescriptor is the closed, credential-free runtime artifact accepted by the selected-PaaS executor. AdminTokenRef is opaque.

func ParseVaultwardenWorkloadBundle 

func ParseVaultwardenWorkloadBundle(data []byte) (VaultwardenWorkloadBundleDescriptor, error)

ParseVaultwardenWorkloadBundle validates the closed generated artifact before any selected-PaaS owner may consume it.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.