restoreactivation

package
v0.42.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 24, 2026 License: Apache-2.0 Imports: 27 Imported by: 0

Documentation

Overview

Package restoreactivation derives and executes the fail-closed authority for promoting an owner-verified staged restore into the live Basement runtime.

Index

Constants

View Source 
const (
	// RuntimeRecoveryGraphAPIVersion identifies the canonical derived runtime
	// graph that can later be placed in an owner-signed recovery snapshot.
	RuntimeRecoveryGraphAPIVersion = "stackkit.restoreactivation-runtime-recovery-graph/v1"
	RuntimeRecoveryGraphKind       = "RuntimeRecoveryGraph"
)
View Source 
const (
	ResultAPIVersion = "stackkit.restore-activation-result/v1"
)

Variables

This section is empty.

Functions

func ResultEvidence 

func ResultEvidence(workspace string, result Result) (string, string, error)

ResultEvidence returns the immutable owner-custody location and digest of the exact signed activation result bytes persisted by the service.

func VerifyResult 

func VerifyResult(workspace string, result Result) error

Types

type ActivateInput 

type ActivateInput struct {
	WorkspaceRoot        string
	OperationID          string
	OwnerApproved        bool
	Plan                 generationartifact.VerifiedPlan
	Manifest             generationartifact.ArtifactManifest
	RestoreResult        backuplifecycle.RestoreResult
	CurrentLineage       backuplifecycle.AuthorityLineage
	CreateSafetySnapshot func(context.Context, string) (backuplifecycle.SnapshotAnchor, error)
	VerifyLive           func(context.Context) (LiveVerification, error)
	FinalizeResult       func(context.Context, Result, error) error
}

type ActivationRecoveredError 

type ActivationRecoveredError struct {
	Cause  error
	Result Result
}

ActivationRecoveredError reports that activation failed but the prior live state was restored and its signed result was persisted. Callers must record the requested restore as recovered rather than asking for an impossible second recovery of the terminal journal.

func (*ActivationRecoveredError) Error 

func (err *ActivationRecoveredError) Error() string

func (*ActivationRecoveredError) Unwrap 

func (err *ActivationRecoveredError) Unwrap() error

type Authority 

type Authority struct {
	OperationID          string           `json:"operationId"`
	OwnerRef             string           `json:"ownerRef"`
	RestoreResultID      string           `json:"restoreResultId"`
	PlanHash             string           `json:"planHash"`
	ManifestHash         string           `json:"manifestHash"`
	ApplyResultHash      string           `json:"applyResultHash"`
	ManagedVolumeSetHash string           `json:"managedVolumeSetHash"`
	StackID              string           `json:"stackId"`
	ComposeProject       string           `json:"composeProject"`
	ComposePath          string           `json:"composePath"`
	ComposeDigest        string           `json:"composeDigest"`
	ComposeRuntimes      []ComposeRuntime `json:"composeRuntimes"`
	KopiaHelperImage     string           `json:"kopiaHelperImage"`
	StagingVolume        string           `json:"stagingVolume"`
	StagingPath          string           `json:"stagingPath"`
	Volumes              []string         `json:"volumes"`
	VolumeDetails        []Volume         `json:"volumeDetails"`
}

Authority is the immutable, plan-derived boundary for one restore activation. Volumes is the canonical sorted LiveName set used by the shared lifecycle journal; VolumeDetails carries the corresponding cutover paths.

func BindRuntimeRecoveryGraph 

func BindRuntimeRecoveryGraph(graph RuntimeRecoveryGraph, restoreResult backuplifecycle.RestoreResult) (Authority, error)

BindRuntimeRecoveryGraph binds historical graph data to the exact staged restore result. The lifecycle owner must verify custody of both inputs before using the returned projection; this function grants no mutation permission.

func DeriveAuthority 

func DeriveAuthority(
	workspaceRoot string,
	plan generationartifact.VerifiedPlan,
	manifest generationartifact.ArtifactManifest,
	restoreResult backuplifecycle.RestoreResult,
	operationID string,
) (Authority, error)

DeriveAuthority binds a staged, owner-verified restore to the exact Basement core plan and generation manifest without consulting mutable policy defaults.

type ComposeRuntime 

type ComposeRuntime struct {
	Project           string                    `json:"project"`
	Path              string                    `json:"path"`
	Digest            string                    `json:"digest"`
	EnvironmentPath   string                    `json:"environmentPath,omitempty"`
	EnvironmentDigest string                    `json:"environmentDigest,omitempty"`
	Readiness         []ComposeRuntimeReadiness `json:"readiness,omitempty"`
}

ComposeRuntime binds one local Compose project to the exact owner-custody bytes that were verified before restore mutation. The Basement runtime and every selected standalone-compose Application runtime are represented independently; no PaaS or remote runtime is admitted here.

type ComposeRuntimeReadiness 

type ComposeRuntimeReadiness struct {
	ComponentRef  string `json:"componentRef"`
	Lifecycle     string `json:"lifecycle"`
	HealthFailure string `json:"healthFailure"`
}

ComposeRuntimeReadiness carries the CUE-owned component health impact into restore activation. It lets activation wait for every blocking component while retaining a degraded component's healthcheck and diagnostics.

type LiveVerification 

type LiveVerification = backuplifecycle.RestoreVerification

type RecoverInput 

type RecoverInput struct {
	WorkspaceRoot  string
	OperationID    string
	OwnerApproved  bool
	VerifyLive     func(context.Context) (LiveVerification, error)
	FinalizeResult func(context.Context, Result, error) error
}

type RecoveryAuthorityResolver 

type RecoveryAuthorityResolver func(
	context.Context,
	lifecyclemutation.RestoreActivationAuthority,
) (Authority, error)

type Result 

type Result struct {
	APIVersion           string                                        `json:"apiVersion"`
	OperationID          string                                        `json:"operationId"`
	RestoreResultID      string                                        `json:"restoreResultId"`
	SafetySnapshotID     string                                        `json:"safetySnapshotId"`
	PlanHash             string                                        `json:"planHash"`
	ManagedVolumeSetHash string                                        `json:"managedVolumeSetHash"`
	Status               string                                        `json:"status"`
	Verification         LiveVerification                              `json:"verification"`
	Signature            localevidence.OwnerRestoreActivationSignature `json:"signature"`
}

func ReadResult 

func ReadResult(workspace, operationID string) (Result, error)

ReadResult reads the canonical persisted result and verifies its local Owner signature. Callers must additionally bind it to their current Plan and operation evidence.

type Runtime 

type Runtime interface {
	Inspect(context.Context, Authority) error
	ValidateStaging(context.Context, Authority) error
	Stop(context.Context, Authority) error
	PrepareRollback(context.Context, Authority, Volume) error
	ActivateVolume(context.Context, Authority, Volume) error
	RestoreVolume(context.Context, Authority, Volume) error
	Start(context.Context, Authority) error
	CleanupRollback(context.Context, Authority, Volume) error
}

func NewDockerRuntime 

func NewDockerRuntime(workspace string) (Runtime, error)

type RuntimeRecoveryGraph 

type RuntimeRecoveryGraph struct {
	APIVersion           string                         `json:"apiVersion"`
	Kind                 string                         `json:"kind"`
	OperationID          string                         `json:"operationId"`
	PlanBinding          generationartifact.PlanBinding `json:"planBinding"`
	PlanHash             string                         `json:"planHash"`
	ManifestHash         string                         `json:"manifestHash"`
	ManagedVolumeSetHash string                         `json:"managedVolumeSetHash"`
	StackID              string                         `json:"stackId"`
	ComposeProject       string                         `json:"composeProject"`
	ComposePath          string                         `json:"composePath"`
	ComposeDigest        string                         `json:"composeDigest"`
	ComposeRuntimes      []ComposeRuntime               `json:"composeRuntimes"`
	CorePolicyArtifactID string                         `json:"corePolicyArtifactId"`
	CorePolicyPath       string                         `json:"corePolicyPath"`
	CorePolicyDigest     string                         `json:"corePolicyDigest"`
	KopiaHelperImage     string                         `json:"kopiaHelperImage"`
	StagingVolume        string                         `json:"stagingVolume"`
	StagingRoot          string                         `json:"stagingRoot"`
	Volumes              []string                       `json:"volumes"`
	VolumeDetails        []Volume                       `json:"volumeDetails"`
}

RuntimeRecoveryGraph is canonical derived runtime custody data from a verified plan, its generation manifest, and one operation identity. Its future signed snapshot or opaque materialization handle supplies immutable authority; this caller-mutable value is never a VerifiedPlan or mutation authorization by itself. Staging paths are deliberately absent from VolumeDetails until a real, verified RestoreResult is bound.

func DeriveRuntimeRecoveryGraph 

func DeriveRuntimeRecoveryGraph(
	workspaceRoot string,
	plan generationartifact.VerifiedPlan,
	manifest generationartifact.ArtifactManifest,
	operationID string,
) (RuntimeRecoveryGraph, error)

DeriveRuntimeRecoveryGraph derives the current CUE-owned runtime graph without manufacturing a restore result. The returned graph is suitable for later owner-signed custody, while parsed graph data remains non-authorizing.

func ParseRuntimeRecoveryGraph 

func ParseRuntimeRecoveryGraph(data []byte) (RuntimeRecoveryGraph, error)

ParseRuntimeRecoveryGraph accepts only the exact canonical JSON emitted by MarshalCanonical and never turns the result into a verified plan.

func (RuntimeRecoveryGraph) MarshalCanonical 

func (graph RuntimeRecoveryGraph) MarshalCanonical() ([]byte, error)

MarshalCanonical emits the one stable JSON representation used by signed recovery custody. It does not add CUE or runtime authorization semantics.

func (RuntimeRecoveryGraph) Validate 

func (graph RuntimeRecoveryGraph) Validate() error

Validate checks the closed, portable shape and internal bindings of a graph. It validates graph data only; it does not re-resolve CUE or authorize a mutation.

type Service 

type Service struct {
	// contains filtered or unexported fields
}

func NewService 

func NewService(runtime Runtime, resolver RecoveryAuthorityResolver) (*Service, error)

func (*Service) Activate 

func (service *Service) Activate(ctx context.Context, input ActivateInput) (Result, error)

func (*Service) Recover 

func (service *Service) Recover(ctx context.Context, input RecoverInput) (Result, error)

type StandaloneComposeRuntimeCustody 

type StandaloneComposeRuntimeCustody struct {
	Project     string
	Runtime     ComposeRuntime
	Compose     StandaloneComposeRuntimeFile
	Environment StandaloneComposeRuntimeFile
	ConfigFiles []StandaloneComposeRuntimeFile
}

StandaloneComposeRuntimeCustody contains the generated runtime files that must travel with one standalone Compose application. Its contents are derived from the same CUE-owned runtime graph used by restore activation.

func DeriveStandaloneComposeRuntimeCustody 

func DeriveStandaloneComposeRuntimeCustody(
	workspaceRoot string,
	plan generationartifact.VerifiedPlan,
	manifest generationartifact.ArtifactManifest,
	operationID string,
) ([]StandaloneComposeRuntimeCustody, error)

DeriveStandaloneComposeRuntimeCustody reads and verifies the exact owner-local standalone Compose runtime files selected by a verified plan. It shares restore activation's CUE/runtime binding and is intended for inclusion in another owner-signed recovery closure.

type StandaloneComposeRuntimeFile 

type StandaloneComposeRuntimeFile struct {
	Path string
	Mode string
	Data []byte
}

StandaloneComposeRuntimeFile is one owner-local runtime file that belongs to a selected standalone Compose application. The bytes are returned only to the caller that is building an owner-signed recovery closure.

type Volume 

type Volume struct {
	ComponentRef   string `json:"componentRef"`
	LogicalName    string `json:"logicalName"`
	ComposeProject string `json:"composeProject"`
	LiveName       string `json:"liveName"`
	StagingPath    string `json:"stagingPath"`
	RollbackName   string `json:"rollbackName"`
}

Volume is one exact persistent backup volume selected by the Basement core runtime. LogicalName comes from the component graph; LiveName is the Compose-qualified Docker volume name. RollbackName is deterministic for the activation operation and never caller supplied.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.