Help us shape the future of Go! Take the 2026 Go Developer Survey

backuplifecycle

package
v0.54.13 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 31, 2026 License: Apache-2.0 Imports: 31 Imported by: 0

Documentation

Overview

Package backuplifecycle owns the local, owner-authorized backup lifecycle journal while delegating repository mechanics to a narrow runtime boundary.

Index

Constants

View Source 
const (
	EmergencyExportAPI    = "stackkit.backup-emergency-export/v2"
	EmergencyArchive      = "stackkit-emergency.tar.gz.age"
	EmergencyManifestName = "stackkit-emergency-export-manifest.json"
)
View Source 
const (
	ControlPreparing  = "preparing"
	ControlPrepared   = "prepared"
	ControlDispatched = "dispatched"
	ControlObserved   = "observed"
)
View Source 
const ApplicationTransferAPI = "stackkit.application-transfer/v1"
View Source 
const ControlAdopted = "adopted"
View Source 
const ControlFailed = "failed"
View Source 
const ControlNegativeAdopted = "negative-adopted"
View Source 
const DataReadbackMethod = "volume-file-tree-sha256/v1"

DataReadbackMethod names the volume digest every DataReadback uses.

View Source 
const EmergencyRestoreRunbook = `` /* 1875-byte string literal not displayed */

Variables

View Source 
var ErrAppGroupFailed = errors.New("app-group original effect settled negatively")
View Source 
var ErrApplicationTransferHeld = errors.New("selected application transfer is held awaiting authenticated destination outcome")
View Source 
var ErrApplicationTransferHoldNotRecorded = errors.New("authenticated snapshot completed before transfer hold was recorded")
View Source 
var ErrControlUnresolved = errors.New("runtime control is unresolved; observe the original manager handle before any further mutation")

Functions

func AppGroupDigest added in v0.54.10 

func AppGroupDigest(value any) string

func AppGroupRestored added in v0.54.10 

func AppGroupRestored(g AppGroupControl) bool

func AppGroupStopped added in v0.54.10 

func AppGroupStopped(g AppGroupControl) bool

func ApplicationTransferCommitmentKeyRef added in v0.54.10 

func ApplicationTransferCommitmentKeyRef(id string) string

func ApplicationTransferSecretCommitment added in v0.54.10 

func ApplicationTransferSecretCommitment(key []byte, workload, slot string, value []byte) string

func MatchApplicationTransfer added in v0.54.10 

func MatchApplicationTransfer(t ApplicationTransfer, destination Policy, closure ...[]localbackuppolicy.ApplicationRuntime) ([]localbackuppolicy.ApplicationVolume, error)

MatchApplicationTransfer rebinds only placement and generated Docker names. Images, component graph and data targets must match. Selected credential slots are separately adopted into the destination-local generated environment.

func ReadApplicationTransferHold added in v0.54.10 

func ReadApplicationTransferHold(workspace, operation, transferID string) ([]string, error)

func ReadApplicationTransferRetirementCandidate added in v0.54.10 

func ReadApplicationTransferRetirementCandidate(workspace, operation, transferID string) (string, error)

func ReadApplicationTransferRetirementHold added in v0.54.10 

func ReadApplicationTransferRetirementHold(workspace, operation, transferID string) ([]string, error)

ReadApplicationTransferRetirementHold alone admits terminal replay by finish. Export, resume and receipt minting still require an actively held source.

func ReadEmergencyIdentities 

func ReadEmergencyIdentities(filename string) ([]age.Identity, error)

ReadEmergencyIdentities keeps recovery secrets out of argv and JSON output.

func RepositoryConfigurationDigest 

func RepositoryConfigurationDigest(configuration RepositoryConfiguration) string

RepositoryConfigurationDigest is the canonical digest a runtime must echo in its configuration receipt.

func RepositoryRestoreRequestDigest 

func RepositoryRestoreRequestDigest(request RepositoryRestoreRequest) string

RepositoryRestoreRequestDigest is the canonical digest a runtime must echo after full verification and staging of the exact selected snapshot anchor.

func RepositorySnapshotRequestDigest 

func RepositorySnapshotRequestDigest(request RepositorySnapshotRequest) string

RepositorySnapshotRequestDigest is the canonical digest a runtime must echo in both lookup and create receipts.

func RequireSettledRuntimeControls added in v0.53.13 

func RequireSettledRuntimeControls(workspace, resumeOperation string) error

RequireSettledRuntimeControls reads existing authenticated snapshot journals. The shared lifecycle gate calls it before Plan/generation/ordinary mutation; a new operation ID cannot evade an older pending manager dispatch. Only the exact original snapshot may enter its observation/recovery path.

func RestoreApplicationTransferMetadata added in v0.54.10 

func RestoreApplicationTransferMetadata(target string, manifest EmergencyManifest, private ...map[string][]byte) error

RestoreApplicationTransferMetadata restores only metadata of authenticated, task-owned extracted application files. Emergency recovery itself keeps its historically conservative private staging modes.

func RestoreResultEvidenceRef 

func RestoreResultEvidenceRef(resultID string) (string, error)

RestoreResultEvidenceRef returns the canonical owner-custody path shared by CLI, MCP, and the State Console lifecycle projection.

func RestoreStagingPath 

func RestoreStagingPath(operationID string) string

RestoreStagingPath returns the fixed isolated target for one restore operation. Callers cannot supply an alternate host or container path.

func SelectApplicationTransfer added in v0.54.10 

func SelectApplicationTransfer(policy Policy, workloads []string, closure ...[]localbackuppolicy.ApplicationRuntime) ([]localbackuppolicy.ApplicationRuntime, []localbackuppolicy.ApplicationVolume, error)

func SnapshotAnchorEvidenceRef 

func SnapshotAnchorEvidenceRef(anchorID string) (string, error)

SnapshotAnchorEvidenceRef returns the owner-custody path derived solely from a verified content address. Callers never supply or redirect the path.

func ValidAppGroupTransition added in v0.54.10 

func ValidAppGroupTransition(before, after []AppGroupControl) bool

ValidAppGroupTransition enforces append-only intent, immutable G0/binding, exact handle retention and one durable phase per owning-journal CAS.

func ValidateAppGroups added in v0.54.10 

func ValidateAppGroups(groups []AppGroupControl) error

func ValidateRuntimeControls added in v0.53.13 

func ValidateRuntimeControls(controls []RuntimeControl) error

func ValidateSnapshotOperationID added in v0.54.10 

func ValidateSnapshotOperationID(value string) bool

ValidateSnapshotOperationID preserves the public snapshot/recovery identity domain. Native group UUIDs and restore activation IDs have separate owners.

func VerifyApplicationTransferOutcome added in v0.54.10 

func VerifyApplicationTransferOutcome(outcome ApplicationTransferOutcome, t ApplicationTransfer, fingerprint string) error

func VerifyApplicationTransferStaging added in v0.54.10 

func VerifyApplicationTransferStaging(target string, manifest EmergencyManifest, private ...map[string][]byte) error

VerifyApplicationTransferStaging rechecks extracted content at its consuming boundary. ContentVerified from a prior process is never sufficient authority.

func VerifyRestoreAbandonment 

func VerifyRestoreAbandonment(workspaceRoot string, abandonment RestoreAbandonment) error

VerifyRestoreAbandonment verifies the content identity and current local Owner signature of one terminal abandonment record.

func VerifyRestoreRecoveryAnchor 

func VerifyRestoreRecoveryAnchor(workspaceRoot string, recovery RestoreRecoveryAnchor) error

func VerifyRestoreResult 

func VerifyRestoreResult(workspaceRoot string, result RestoreResult) error

func VerifySnapshotAnchor 

func VerifySnapshotAnchor(workspaceRoot string, anchor SnapshotAnchor) error

func VerifySnapshotAppGroup added in v0.54.10 

func VerifySnapshotAppGroup(workspace string, g AppGroupControl, completed bool) error

VerifySnapshotAppGroup authenticates the actual existing operation file and exact group, not an opaque caller digest. Native adapters can use this under the existing node/lifecycle lease; it creates no new credential or journal.

func VerifySnapshotAppGroupAuthority added in v0.54.10 

func VerifySnapshotAppGroupAuthority(workspace string, g AppGroupControl, lineage AuthorityLineage, completed bool) error

Types

type AppGroupBinding added in v0.54.10 

type AppGroupBinding struct {
	ManagerID                string           `json:"managerId"`
	ManagerContainerID       string           `json:"managerContainerId"`
	ManagerImage             string           `json:"managerImage"`
	SourceDigest             string           `json:"sourceDigest"`
	InstallationDigest       string           `json:"installationDigest"`
	OwnerRef                 string           `json:"ownerRef"`
	SiteRef                  string           `json:"siteRef"`
	NodeRef                  string           `json:"nodeRef"`
	AppID                    int              `json:"appId"`
	AppURN                   string           `json:"appUrn"`
	LogicalProject           string           `json:"logicalProject"`
	PhysicalProject          string           `json:"physicalProject"`
	BindingDigest            string           `json:"bindingDigest"`
	JournalOperationID       string           `json:"journalOperationId"`
	NativeJournalOperationID string           `json:"nativeJournalOperationId"`
	PolicySourceDigest       string           `json:"policySourceDigest"`
	AuthorityLineage         AuthorityLineage `json:"authorityLineage"`
	QualificationDigest      string           `json:"qualificationDigest"`
	AppliedRequestDigest     string           `json:"appliedRequestDigest"`
	CustodyDigest            string           `json:"custodyDigest"`
	GroupID                  string           `json:"groupId"`
	RecipeDigest             string           `json:"recipeDigest"`
	EffectiveInputDigest     string           `json:"effectiveInputDigest"`
}

type AppGroupControl added in v0.54.10 

type AppGroupControl struct {
	Version  int                `json:"version"`
	Binding  AppGroupBinding    `json:"binding"`
	Original AppGroupGeneration `json:"original"`
	Effects  []AppGroupEffect   `json:"effects,omitempty"`
	Closed   bool               `json:"closed,omitempty"`
}

AppGroupControl is v2 inside the EXISTING signed owning journal. Original remains the immutable G0 anchor; generations are appended, never substituted into the v1 exact-container field. A native acknowledgment is not a receipt.

func AdvanceAppGroup added in v0.54.10 

func AdvanceAppGroup(ctx context.Context, g AppGroupControl, action string, persist func(AppGroupControl) error, d AppGroupControlDriver) (AppGroupControl, error)

AdvanceAppGroup performs at most one dormant Prepare and one Dispatch. Every recovery first inspects original handles. No power/404/timeout is admission or completion proof. Adoption is signed atomically BEFORE the observed step.

func CloneAppGroups added in v0.54.10 

func CloneAppGroups(groups []AppGroupControl) []AppGroupControl

func ReadSnapshotAppGroupControls added in v0.54.10 

func ReadSnapshotAppGroupControls(workspace, operation string) ([]AppGroupControl, string, bool, error)

ReadSnapshotAppGroupControls is a read-only view of the original authenticated operation. It cannot clear a hold, change phases or create a replacement op.

func SettleAppGroup added in v0.54.10 

func SettleAppGroup(ctx context.Context, g AppGroupControl, persist func(AppGroupControl) error, d AppGroupControlDriver) (AppGroupControl, error)

func (AppGroupControl) Current added in v0.54.10 

func (g AppGroupControl) Current() AppGroupGeneration

func (AppGroupControl) InitialRunning added in v0.54.10 

func (g AppGroupControl) InitialRunning() bool

type AppGroupControlDriver added in v0.54.10 

type AppGroupControlDriver interface {
	RuntimeControlDriver
	Hold(context.Context, AppGroupControl) error
	VerifyCurrent(context.Context, AppGroupControl) error
	Readback(context.Context, AppGroupControl, string, string) (AppGroupReceipt, AppGroupGeneration, error)
	Adopt(context.Context, AppGroupControl) error
	Close(context.Context, AppGroupControl) error
}

The driver must bind its dormant handle to an exact command/action/nonce and native operation. Complete proves terminal native success; Readback then independently checks absent writers or the full successor graph and volumes. Adopt must atomically CAS existing node custody from the preceding journaled generation to the already signed successor. It must be idempotent on replay.

type AppGroupEffect added in v0.54.10 

type AppGroupEffect struct {
	Action     string              `json:"action"`
	State      string              `json:"state"`
	Handle     string              `json:"handle,omitempty"`
	Receipt    *AppGroupReceipt    `json:"receipt,omitempty"`
	Negative   *AppGroupNegative   `json:"negative,omitempty"`
	Generation *AppGroupGeneration `json:"generation,omitempty"`
}

type AppGroupGeneration added in v0.54.10 

type AppGroupGeneration struct {
	ConfigDigests map[string]string           `json:"configDigests"`
	Containers    []SnapshotQuiescedContainer `json:"containers"`
	Volumes       []AppGroupVolume            `json:"volumes"`
	Absent        bool                        `json:"absent"`
	Partial       bool                        `json:"partial,omitempty"`
}

type AppGroupNegative added in v0.54.10 

type AppGroupNegative struct {
	DispatchPhase          string `json:"dispatchPhase,omitempty"`
	OperationID            string `json:"operationId,omitempty"`
	PredecessorOperationID string `json:"predecessorOperationId,omitempty"`
	RequestDigest          string `json:"requestDigest,omitempty"`
	WitnessDigest          string `json:"witnessDigest"`
	Kind                   string `json:"kind"`
	Phase                  string `json:"phase"`
	Reason                 string `json:"reason"`
	NoNativeActuation      bool   `json:"noNativeActuation"`
	ComposeExit            *int   `json:"composeExit,omitempty"`
	PreviousCustodyDigest  string `json:"previousCustodyDigest"`
}

A negative witness never proves STOP or START success. Local undispatched proof is bound to the exact signed pre-dispatch journal; native proof is bound to the original operation and its authenticated durable witness.

type AppGroupNegativeDriver added in v0.54.10 

type AppGroupNegativeDriver interface {
	RecoverUndispatched(context.Context, AppGroupControl, AppGroupEffect) (AppGroupNegative, AppGroupGeneration, error)
	ReadbackNegative(context.Context, AppGroupControl, string, string) (AppGroupNegative, AppGroupGeneration, error)
}

type AppGroupReceipt added in v0.54.10 

type AppGroupReceipt struct {
	OperationID            string `json:"operationId"`
	PredecessorOperationID string `json:"predecessorOperationId,omitempty"`
	RequestDigest          string `json:"requestDigest"`
	WitnessDigest          string `json:"witnessDigest"`
	ComposeExit            int    `json:"composeExit"`
	PreviousCustodyDigest  string `json:"previousCustodyDigest"`
}

type AppGroupVolume added in v0.54.10 

type AppGroupVolume struct {
	Name           string `json:"name"`
	Mountpoint     string `json:"mountpoint"`
	Driver         string `json:"driver"`
	IdentityDigest string `json:"identityDigest"`
}

type ApplicationTransfer added in v0.54.10 

type ApplicationTransfer struct {
	PortableConfiguration map[string]ApplicationTransferWorkloadConfiguration `json:"portableConfiguration"`
	Mode                  string                                              `json:"mode"`
	APIVersion            string                                              `json:"apiVersion"`
	ID                    string                                              `json:"id"`
	SourceOwner           string                                              `json:"sourceOwner"`
	Lineage               AuthorityLineage                                    `json:"lineage"`
	PolicyDigest          string                                              `json:"policyDigest"`
	ManifestDigest        string                                              `json:"manifestDigest"`
	Runtimes              []localbackuppolicy.ApplicationRuntime              `json:"runtimes"`
	Volumes               []localbackuppolicy.ApplicationVolume               `json:"volumes"`

	SecretDigests         map[string]map[string]string               `json:"secretDigests"`
	CredentialSourceIndex *int                                       `json:"credentialSourceIndex,omitempty"`
	Signature             localevidence.ApplicationTransferSignature `json:"signature"`
	Destination           ApplicationTransferDestination             `json:"destination"`
}

ApplicationTransfer is source provenance, not destination mutation authority. ManifestDigest covers every archived byte through the authenticated entry list.

func VerifyApplicationTransfer added in v0.54.10 

func VerifyApplicationTransfer(manifest EmergencyManifest, expectedOwner, expectedFingerprint, expectedID string) (ApplicationTransfer, error)

func VerifyApplicationTransferExportReceipt added in v0.54.10 

func VerifyApplicationTransferExportReceipt(receipt ApplicationTransferExportReceipt, sourceOwner, fingerprint, id, archiveDigest string) (ApplicationTransfer, error)

type ApplicationTransferDestination added in v0.54.10 

type ApplicationTransferDestination struct {
	OwnerRef           string    `json:"ownerRef"`
	SigningFingerprint string    `json:"signingFingerprint"`
	StackID            string    `json:"stackId"`
	SiteRef            string    `json:"siteRef"`
	NodeRef            string    `json:"nodeRef"`
	PlanHash           string    `json:"planHash"`
	Recipient          string    `json:"recipient"`
	Nonce              string    `json:"nonce"`
	ExpiresAt          time.Time `json:"expiresAt"`
}

type ApplicationTransferExportInput added in v0.54.10 

type ApplicationTransferExportInput struct {
	PortableConfiguration map[string]ApplicationTransferWorkloadConfiguration
	Mode                  string
	WorkspaceRoot         string
	OwnerRef              string
	Lineage               AuthorityLineage
	Policy                Policy
	PolicyDigest          string
	Workloads             []string
	RuntimeClosure        []localbackuppolicy.ApplicationRuntime

	SecretMaterials map[string]map[string][]byte
	Target          string
	Recipients      []age.Recipient
	Destination     ApplicationTransferDestination
	// Quiesce must stop precisely the selected source closure and return its
	// resume operation. Export always resumes; it never deletes the source.
	Quiesce func(context.Context) (func() error, error)
}

type ApplicationTransferExportReceipt added in v0.54.10 

type ApplicationTransferExportReceipt struct {
	APIVersion        string                                     `json:"apiVersion"`
	Export            EmergencyExportResult                      `json:"export"`
	SourceOperationID string                                     `json:"sourceOperationId"`
	State             string                                     `json:"state"`
	Signature         localevidence.ApplicationTransferSignature `json:"signature"`
}

ApplicationTransferExportReceipt is outside the encrypted archive so its source signature can bind the final ciphertext digest and durable hold.

func SignApplicationTransferExportReceipt added in v0.54.10 

func SignApplicationTransferExportReceipt(workspace string, result EmergencyExportResult, operation, mode string) (ApplicationTransferExportReceipt, error)

type ApplicationTransferOutcome added in v0.54.10 

type ApplicationTransferOutcome struct {
	APIVersion     string                                     `json:"apiVersion"`
	TransferID     string                                     `json:"transferId"`
	Destination    ApplicationTransferDestination             `json:"destination"`
	State          string                                     `json:"state"`
	ActivationID   string                                     `json:"activationId,omitempty"`
	ReadbackDigest string                                     `json:"readbackDigest,omitempty"`
	CreatedAt      time.Time                                  `json:"createdAt"`
	Signature      localevidence.ApplicationTransferSignature `json:"signature"`
}

func SignApplicationTransferOutcome added in v0.54.10 

func SignApplicationTransferOutcome(workspace string, outcome ApplicationTransferOutcome) (ApplicationTransferOutcome, error)

type ApplicationTransferSecretPayload added in v0.54.10 

type ApplicationTransferSecretPayload struct {
	Materials     map[string]map[string][]byte `json:"materials"`
	CommitmentKey []byte                       `json:"commitmentKey"`
}

Secret commitments are keyed inside the encrypted payload so public receipts cannot be used to dictionary-test application secrets.

type ApplicationTransferWorkloadConfiguration added in v0.54.10 

type ApplicationTransferWorkloadConfiguration struct {
	AlternativeRef string         `json:"alternativeRef"`
	ModuleRef      string         `json:"moduleRef"`
	Settings       map[string]any `json:"settings"`
	Profiles       map[string]any `json:"profiles"`
}

type AuthorityLineage 

type AuthorityLineage struct {
	Binding               generationartifact.PlanBinding `json:"binding"`
	ManifestHash          string                         `json:"manifestHash"`
	GenerationReceiptHash string                         `json:"generationReceiptHash"`
	ApplyResultHash       string                         `json:"applyResultHash"`
	ApplyReceiptHash      string                         `json:"applyReceiptHash"`
	OwnerBindingDigest    string                         `json:"ownerBindingDigest"`
	PocketIDSubject       string                         `json:"pocketIdSubject"`
}

AuthorityLineage binds backup side effects to the complete verified generation and apply chain, rather than to a plan hash in isolation.

type BackupCoverage 

type BackupCoverage struct {
	Scope                string                                `json:"scope"`
	RecoveryMode         string                                `json:"recoveryMode"`
	PolicyArtifactDigest string                                `json:"policyArtifactDigest"`
	Target               localbackuppolicy.Target              `json:"target"`
	ManagedVolumeNames   []string                              `json:"managedVolumeNames"`
	ApplicationVolumes   []localbackuppolicy.ApplicationVolume `json:"applicationVolumes,omitempty"`
	ExcludePaths         []string                              `json:"excludePaths"`
	OffHostRecovery      string                                `json:"offHostRecovery"`
	ApplicationRecovery  string                                `json:"applicationRecovery"`
	SnapshotSources      []localbackuppolicy.SnapshotSource    `json:"snapshotSources,omitempty"`
	DataClasses          []string                              `json:"dataClasses,omitempty"`
	ExcludedDataClasses  []string                              `json:"excludedDataClasses,omitempty"`
}

BackupCoverage describes the selected source policy, not proof that its data is recoverable. Only the owner-bound configuration supplies these facts.

type Configuration 

type Configuration struct {
	APIVersion           string            `json:"apiVersion"`
	OwnerRef             string            `json:"ownerRef"`
	AuthorityRef         string            `json:"authorityRef"`
	Lineage              AuthorityLineage  `json:"lineage"`
	PolicyArtifactDigest string            `json:"policyArtifactDigest"`
	OperationID          string            `json:"operationId"`
	Policy               Policy            `json:"policy"`
	Repository           RepositoryReceipt `json:"repository"`
}

func InspectConfigurationBinding added in v0.48.0 

func InspectConfigurationBinding(workspaceRoot string, input StatusInput) (Configuration, error)

InspectConfigurationBinding reports, without touching the repository runtime, whether the stored backup configuration binds the authority the caller holds now. It returns os.ErrNotExist when no configuration exists and a *ConfigurationBindingError when one exists for an earlier Apply or policy artifact, so `stackkit status` can surface the same condition the backup commands fail on.

type ConfigurationBindingError added in v0.48.0 

type ConfigurationBindingError struct {
	OwnerDiffers     bool
	AuthorityDiffers bool
	LineageDiffers   bool
	PolicyDiffers    bool
}

ConfigurationBindingError reports a stored backup configuration that was made for an earlier authority than the one now in force. Every re-apply (a CLI upgrade included) re-signs Plan and Apply, so the lineage moves even when the owner changed nothing. The configuration, the repository and its snapshots stay intact; `stackkit backup configure` carries them forward to the current Apply with the same Owner custody and no new secret.

func (*ConfigurationBindingError) CarryForwardable added in v0.48.0 

func (e *ConfigurationBindingError) CarryForwardable() bool

CarryForwardable reports whether `stackkit backup configure` can move the configuration to the current authority: the Owner and human authority are unchanged and only the Apply lineage or the generated policy moved.

func (*ConfigurationBindingError) Error added in v0.48.0 

func (e *ConfigurationBindingError) Error() string

func (*ConfigurationBindingError) Guidance added in v0.48.0 

func (e *ConfigurationBindingError) Guidance() []string

Guidance lists the exact recovery commands for the actionable-error contract.

type ConfigureInput 

type ConfigureInput struct {
	OwnerRef       string           `json:"ownerRef"`
	AuthorityRef   string           `json:"authorityRef"`
	Lineage        AuthorityLineage `json:"lineage"`
	PolicyArtifact []byte           `json:"-"`
}

type Consistency 

type Consistency string
const ConsistencyCrashConsistent Consistency = "crash-consistent"

type Creator 

type Creator struct{}

func NewCreator 

func NewCreator() Creator

func (Creator) Create 

func (Creator) Create(workspaceRoot string, runtime RepositoryRuntime) (*Service, error)

func (Creator) OpenTransferJournal added in v0.54.10 

func (Creator) OpenTransferJournal(workspace string) (*Service, error)

OpenTransferJournal opens only the existing backup operation records. Runtime operations remain unavailable until the ordinary Creator.Create supplies one.

type DataReadback added in v0.53.6 

type DataReadback struct {
	Method  string           `json:"method"`
	Volumes []VolumeReadback `json:"volumes"`
}

DataReadback compares restored application data with its staged snapshot content before services start. It does not prove application behaviour.

type EmergencyContractInput 

type EmergencyContractInput struct {
	Plan           backupplan.EmergencyExportPlan
	Policy         localbackuppolicy.Policy
	VolumeRoot     string
	DumpSources    []EmergencySource
	Sources        []EmergencySource
	Target         string
	Recipients     []age.Recipient
	LargeMediaMode string
}

EmergencyContractInput lowers a generated v2 backup contract into the existing portable exporter. Policy supplies the CUE-selected volume set; the recovery plan supplies format, classes, media policy and target.

type EmergencyEntry 

type EmergencyEntry struct {
	UID       int    `json:"uid,omitempty"`
	GID       int    `json:"gid,omitempty"`
	Path      string `json:"path"`
	Directory bool   `json:"directory,omitempty"`
	Bytes     int64  `json:"bytes"`
	SHA256    string `json:"sha256,omitempty"`
	Mode      uint32 `json:"mode"`
}

type EmergencyExportInput 

type EmergencyExportInput struct {
	Target         string
	Sources        []EmergencySource
	Recipients     []age.Recipient
	LargeMediaMode string
	// contains filtered or unexported fields
}

type EmergencyExportResult 

type EmergencyExportResult struct {
	APIVersion    string            `json:"apiVersion"`
	Archive       string            `json:"archive"`
	ArchiveSHA256 string            `json:"archiveSHA256"`
	Manifest      EmergencyManifest `json:"manifest"`
}

func ExportApplicationTransfer added in v0.54.10 

func ExportApplicationTransfer(ctx context.Context, input ApplicationTransferExportInput) (result EmergencyExportResult, returnErr error)

func ExportEmergency 

func ExportEmergency(ctx context.Context, input EmergencyExportInput) (EmergencyExportResult, error)

ExportEmergency writes encrypted tar/gzip bytes through the existing local backup owner. No Kopia repository, Docker daemon or hosted account is needed. Only a complete export is installed at Target; existing targets are preserved.

func ExportFromContract 

func ExportFromContract(ctx context.Context, input EmergencyContractInput) (EmergencyExportResult, error)

ExportFromContract streams the generated v2 backup contract through the existing encrypted portable exporter. It does not activate applications or prove a live restore.

type EmergencyManifest 

type EmergencyManifest struct {
	APIVersion           string               `json:"apiVersion"`
	CreatedAt            time.Time            `json:"createdAt"`
	Consistency          string               `json:"consistency"`
	LargeMediaMode       string               `json:"largeMediaMode"`
	Sources              []EmergencySource    `json:"sources"`
	Entries              []EmergencyEntry     `json:"entries"`
	ApplicationsVerified bool                 `json:"applicationsVerified"`
	ApplicationTransfer  *ApplicationTransfer `json:"applicationTransfer,omitempty"`
}

EmergencyManifest describes bytes actually archived, not a requested backup policy. Copying live files is never an application consistency/restore proof.

type EmergencyRestoreInput 

type EmergencyRestoreInput struct {
	Archive    string
	Identities []age.Identity
	Target     string
	MaxBytes   int64
	MemoryFile string
}

type EmergencyRestoreResult 

type EmergencyRestoreResult struct {
	PrivateFiles         map[string][]byte `json:"-"`
	APIVersion           string            `json:"apiVersion"`
	Target               string            `json:"target"`
	ContentVerified      bool              `json:"contentVerified"`
	ApplicationsVerified bool              `json:"applicationsVerified"`
	Manifest             EmergencyManifest `json:"manifest"`
}

func RestoreEmergency 

func RestoreEmergency(ctx context.Context, input EmergencyRestoreInput) (EmergencyRestoreResult, error)

RestoreEmergency only stages data into a new directory. It requires the private age identity, not old owner custody or access to the failed server. Authentication or checksum failures discard the task-owned staging tree.

type EmergencySource 

type EmergencySource struct {
	Path        string `json:"path"`
	Class       string `json:"class"`
	ArchivePath string `json:"archivePath"`
	Coverage    string `json:"coverage"`
	// Excludes lists regenerable cache subtrees ("/"-separated, relative to
	// Path) that the contract leaves out; the manifest keeps them visible.
	Excludes []string `json:"excludes,omitempty"`
}

EmergencySource is an explicit owner-selected local source. Media omitted by policy remains in the manifest so missing bytes cannot look protected.

func SourcesFromContract 

func SourcesFromContract(plan backupplan.EmergencyExportPlan, policy localbackuppolicy.Policy, volumeRoot string, dumps []EmergencySource) ([]EmergencySource, error)

SourcesFromContract maps the generated local Kopia source policy onto explicit emergency-export sources. Missing include classes omit those volumes; secret volumes are skipped unless secrets are selected. Dump sources replace live volumes of the same class so a hook-produced dump is archived instead of a running database file.

type EvidenceAge 

type EvidenceAge struct {
	State            string     `json:"state"`
	EvidenceID       string     `json:"evidenceId,omitempty"`
	PlanHash         string     `json:"planHash,omitempty"`
	CurrentPlan      bool       `json:"currentPlan"`
	RecordedAt       *time.Time `json:"recordedAt,omitempty"`
	CaptureStartedAt *time.Time `json:"captureStartedAt,omitempty"`
	AgeSeconds       *int64     `json:"ageSeconds,omitempty"`
}

type History 

type History struct {
	ObservedAt         time.Time                     `json:"observedAt"`
	Scope              string                        `json:"scope"`
	Issue              string                        `json:"issue,omitempty"`
	Snapshot           EvidenceAge                   `json:"snapshot"`
	RecoveryPoints     []EvidenceAge                 `json:"recoveryPoints,omitempty"`
	StagedRestore      EvidenceAge                   `json:"stagedRestore"`
	Availability       *SnapshotAvailability         `json:"availability,omitempty"`
	RecoveryObjectives []RecoveryObjectiveAssessment `json:"recoveryObjectives,omitempty"`
}

History reports owner-authenticated receipts for the current source policy. Availability separately observes the latest current-authority snapshot manifest. Neither observation proves complete blob integrity, successful application activation, or compliance with a recovery-time objective.

type Policy 

type Policy = localbackuppolicy.Policy

Policy is the shared strict renderer-to-lifecycle contract.

type RecoveryObjectiveAssessment 

type RecoveryObjectiveAssessment struct {
	BindingRef   string                 `json:"bindingRef"`
	WorkloadRefs []string               `json:"workloadRefs"`
	DataLoss     RecoveryObjectiveCheck `json:"dataLoss"`
	RecoveryTime RecoveryObjectiveCheck `json:"recoveryTime"`
}

RecoveryObjectiveAssessment derives current observations from one governed target-local objective. It is not persisted and cannot authorize operations.

type RecoveryObjectiveCheck 

type RecoveryObjectiveCheck struct {
	State           string `json:"state"`
	Basis           string `json:"basis"`
	LimitSeconds    int    `json:"limitSeconds"`
	ObservedSeconds *int64 `json:"observedSeconds,omitempty"`
	EvidenceID      string `json:"evidenceId,omitempty"`
	Reason          string `json:"reason,omitempty"`
}

type RepositoryConfiguration 

type RepositoryConfiguration struct {
	OwnerRef             string           `json:"ownerRef"`
	AuthorityRef         string           `json:"authorityRef"`
	Lineage              AuthorityLineage `json:"lineage"`
	PolicyArtifactDigest string           `json:"policyArtifactDigest"`
	OperationID          string           `json:"operationId"`
	Policy               Policy           `json:"policy"`
}

type RepositoryReceipt 

type RepositoryReceipt struct {
	APIVersion          string `json:"apiVersion"`
	RepositoryID        string `json:"repositoryId"`
	Backend             string `json:"backend"`
	ConfigurationDigest string `json:"configurationDigest"`
}

type RepositoryRestoreReceipt 

type RepositoryRestoreReceipt struct {
	APIVersion                string    `json:"apiVersion"`
	RepositoryID              string    `json:"repositoryId"`
	SnapshotID                string    `json:"snapshotId"`
	OperationID               string    `json:"operationId"`
	RequestDigest             string    `json:"requestDigest"`
	StagingPath               string    `json:"stagingPath"`
	SnapshotContentDigest     string    `json:"snapshotContentDigest"`
	RepositoryContentVerified bool      `json:"repositoryContentVerified"`
	CompletedAt               time.Time `json:"completedAt"`
}

type RepositoryRestoreRequest 

type RepositoryRestoreRequest struct {
	OwnerRef             string                    `json:"ownerRef"`
	AuthorityRef         string                    `json:"authorityRef"`
	AuthorizationLineage AuthorityLineage          `json:"authorizationLineage"`
	PolicyArtifactDigest string                    `json:"policyArtifactDigest"`
	RepositoryID         string                    `json:"repositoryId"`
	SnapshotAnchorID     string                    `json:"snapshotAnchorId"`
	SnapshotSourceDigest string                    `json:"snapshotSourceDigest"`
	SnapshotRequest      RepositorySnapshotRequest `json:"snapshotRequest"`
	SnapshotReceipt      RepositorySnapshotReceipt `json:"snapshotReceipt"`
	OperationID          string                    `json:"operationId"`
	StagingPath          string                    `json:"stagingPath"`
}

type RepositoryRuntime 

type RepositoryRuntime interface {
	Configure(context.Context, RepositoryConfiguration) (RepositoryReceipt, error)
	Status(context.Context, RepositoryScope) (RepositoryStatus, error)
	LookupSnapshot(context.Context, RepositorySnapshotRequest) (RepositorySnapshotReceipt, bool, error)
	CreateSnapshot(context.Context, RepositorySnapshotRequest) (RepositorySnapshotReceipt, error)
	RestoreSnapshot(context.Context, RepositoryRestoreRequest) (RepositoryRestoreReceipt, error)
}

RepositoryRuntime owns repository-specific side effects. LookupSnapshot must return a receipt only for the exact request digest, allowing a pending journal to recover after repository success without duplicating a snapshot.

type RepositoryScope 

type RepositoryScope struct {
	OwnerRef     string           `json:"ownerRef"`
	AuthorityRef string           `json:"authorityRef"`
	RepositoryID string           `json:"repositoryId"`
	Lineage      AuthorityLineage `json:"lineage"`
}

type RepositorySnapshotReceipt 

type RepositorySnapshotReceipt struct {
	APIVersion    string      `json:"apiVersion"`
	RepositoryID  string      `json:"repositoryId"`
	SnapshotID    string      `json:"snapshotId"`
	OperationID   string      `json:"operationId"`
	RequestDigest string      `json:"requestDigest"`
	ContentDigest string      `json:"contentDigest"`
	Consistency   Consistency `json:"consistency"`
	CreatedAt     time.Time   `json:"createdAt"`
}

type RepositorySnapshotRequest 

type RepositorySnapshotRequest struct {
	Workloads            []string                           `json:"workloads,omitempty"`
	OwnerRef             string                             `json:"ownerRef"`
	AuthorityRef         string                             `json:"authorityRef"`
	Lineage              AuthorityLineage                   `json:"lineage"`
	PolicyArtifactDigest string                             `json:"policyArtifactDigest"`
	RepositoryID         string                             `json:"repositoryId"`
	OperationID          string                             `json:"operationId"`
	Source               string                             `json:"source"`
	Excludes             []string                           `json:"excludes"`
	Sources              []localbackuppolicy.SnapshotSource `json:"sources,omitempty"`
	Consistency          Consistency                        `json:"consistency"`
	ProtectRecovery      bool                               `json:"protectRecovery,omitempty"`
}

type RepositoryStatus 

type RepositoryStatus struct {
	RepositoryID string          `json:"repositoryId"`
	Ready        bool            `json:"ready"`
	Consistency  Consistency     `json:"consistency"`
	History      *History        `json:"history,omitempty"`
	Coverage     *BackupCoverage `json:"coverage,omitempty"`
}

type RestoreAbandonInput 

type RestoreAbandonInput struct {
	OwnerRef       string           `json:"ownerRef"`
	AuthorityRef   string           `json:"authorityRef"`
	Lineage        AuthorityLineage `json:"lineage"`
	PolicyArtifact []byte           `json:"-"`
	OperationID    string           `json:"operationId"`
	OwnerApproved  bool             `json:"ownerApproved"`
}

RestoreAbandonInput authorizes closing one exact pending or staged restore journal without invoking the repository runtime or touching live volumes.

type RestoreAbandonment 

type RestoreAbandonment struct {
	APIVersion           string                                         `json:"apiVersion"`
	ID                   string                                         `json:"id"`
	OwnerRef             string                                         `json:"ownerRef"`
	AuthorityRef         string                                         `json:"authorityRef"`
	AuthorizationLineage AuthorityLineage                               `json:"authorizationLineage"`
	PolicyArtifactDigest string                                         `json:"policyArtifactDigest"`
	SnapshotAnchorID     string                                         `json:"snapshotAnchorId"`
	RecoveryAnchorID     string                                         `json:"recoveryAnchorId"`
	OperationID          string                                         `json:"operationId"`
	ApprovalMethod       string                                         `json:"approvalMethod"`
	AbandonedAt          time.Time                                      `json:"abandonedAt"`
	Signature            localevidence.OwnerRestoreAbandonmentSignature `json:"signature"`
}

RestoreAbandonment is terminal evidence for an explicitly owner-approved abandonment of one historical restore operation. The recovery anchor and any staged receipt remain in the operation journal unchanged.

type RestoreInput 

type RestoreInput struct {
	OwnerRef         string              `json:"ownerRef"`
	AuthorityRef     string              `json:"authorityRef"`
	Lineage          AuthorityLineage    `json:"lineage"`
	PolicyArtifact   []byte              `json:"-"`
	SnapshotAnchorID string              `json:"snapshotAnchorId"`
	OperationID      string              `json:"operationId"`
	OwnerApproved    bool                `json:"ownerApproved"`
	PostVerify       RestorePostVerifier `json:"-"`
}

type RestorePostVerifier 

type RestorePostVerifier func(context.Context, RestoreVerificationRequest) (RestoreVerification, error)

type RestoreRecoveryAnchor 

type RestoreRecoveryAnchor struct {
	APIVersion            string                                      `json:"apiVersion"`
	ID                    string                                      `json:"id"`
	OwnerRef              string                                      `json:"ownerRef"`
	AuthorityRef          string                                      `json:"authorityRef"`
	AuthorizationLineage  AuthorityLineage                            `json:"authorizationLineage"`
	PolicyArtifactDigest  string                                      `json:"policyArtifactDigest"`
	SnapshotAnchorID      string                                      `json:"snapshotAnchorId"`
	SnapshotLineage       AuthorityLineage                            `json:"snapshotLineage"`
	RepositoryID          string                                      `json:"repositoryId"`
	SnapshotID            string                                      `json:"snapshotId"`
	SnapshotContentDigest string                                      `json:"snapshotContentDigest"`
	OperationID           string                                      `json:"operationId"`
	StagingPath           string                                      `json:"stagingPath"`
	Mode                  string                                      `json:"mode"`
	ApprovalMethod        string                                      `json:"approvalMethod"`
	ApprovedAt            time.Time                                   `json:"approvedAt"`
	ExpiresAt             time.Time                                   `json:"expiresAt"`
	Signature             localevidence.OwnerRestoreRecoverySignature `json:"signature"`
}

type RestoreResult 

type RestoreResult struct {
	APIVersion           string                                    `json:"apiVersion"`
	ID                   string                                    `json:"id"`
	OwnerRef             string                                    `json:"ownerRef"`
	AuthorityRef         string                                    `json:"authorityRef"`
	AuthorizationLineage AuthorityLineage                          `json:"authorizationLineage"`
	SnapshotAnchorID     string                                    `json:"snapshotAnchorId"`
	SnapshotLineage      AuthorityLineage                          `json:"snapshotLineage"`
	OperationID          string                                    `json:"operationId"`
	RecoveryAnchor       RestoreRecoveryAnchor                     `json:"recoveryAnchor"`
	Request              RepositoryRestoreRequest                  `json:"request"`
	Receipt              RepositoryRestoreReceipt                  `json:"receipt"`
	Verification         RestoreVerification                       `json:"verification"`
	Signature            localevidence.OwnerRestoreResultSignature `json:"signature"`
}

func LoadRestoreResult 

func LoadRestoreResult(workspaceRoot, resultID string) (RestoreResult, error)

LoadRestoreResult loads one content-addressed staged restore result and verifies its complete owner-signed recovery chain before returning it. Callers cannot select a path: resultID alone derives the confined location.

type RestoreVerification 

type RestoreVerification struct {
	APIVersion         string    `json:"apiVersion"`
	OwnerRef           string    `json:"ownerRef"`
	OwnerBindingDigest string    `json:"ownerBindingDigest"`
	PocketIDSubject    string    `json:"pocketIdSubject"`
	PlanHash           string    `json:"planHash"`
	ServicesVerified   bool      `json:"servicesVerified"`
	VerifiedAt         time.Time `json:"verifiedAt"`
	// DataReadback is set by live restore activation only: it proves the bytes
	// now in each live volume equal the bytes restored from the snapshot.
	DataReadback *DataReadback `json:"dataReadback,omitempty"`
}

type RestoreVerificationRequest 

type RestoreVerificationRequest struct {
	OwnerRef             string           `json:"ownerRef"`
	AuthorizationLineage AuthorityLineage `json:"authorizationLineage"`
	SnapshotAnchorID     string           `json:"snapshotAnchorId"`
	OperationID          string           `json:"operationId"`
	StagingPath          string           `json:"stagingPath"`
}

type RunInput 

type RunInput struct {
	Workloads       []string         `json:"workloads,omitempty"`
	OwnerRef        string           `json:"ownerRef"`
	AuthorityRef    string           `json:"authorityRef"`
	Lineage         AuthorityLineage `json:"lineage"`
	PolicyArtifact  []byte           `json:"-"`
	OperationID     string           `json:"operationId"`
	ProtectRecovery bool             `json:"protectRecovery,omitempty"`
}

type RuntimeControl added in v0.53.13 

type RuntimeControl struct {
	ComponentRef  string               `json:"componentRef"`
	ContainerID   string               `json:"containerId"`
	WasRunning    bool                 `json:"wasRunning"`
	Stop          RuntimeControlEffect `json:"stop"`
	Start         RuntimeControlEffect `json:"start"`
	RollbackStop  RuntimeControlEffect `json:"rollbackStop"`
	RollbackStart RuntimeControlEffect `json:"rollbackStart"`
}

RuntimeControl lives in the owning signed snapshot/activation journal. It retains initial power and exact manager handles across process restarts.

func AdvanceRuntimeControl added in v0.53.13 

func AdvanceRuntimeControl(ctx context.Context, original RuntimeControl, action string,
	persist func(RuntimeControl) error, observe func(context.Context) (string, bool, error),
	driver RuntimeControlDriver,
) (RuntimeControl, error)

AdvanceRuntimeControl dispatches each exact prepared handle once. A lost dispatch response admits only inspection of that handle. persist must atomically retain the next value in the existing owning signed journal.

func SettleRuntimeControl added in v0.53.13 

func SettleRuntimeControl(ctx context.Context, c RuntimeControl, persist func(RuntimeControl) error, observe func(context.Context) (string, bool, error), driver RuntimeControlDriver) (RuntimeControl, error)

SettleRuntimeControl observes only retained handles, never dispatches. It is used across the whole writer set before admitting any opposite action.

type RuntimeControlDriver added in v0.53.13 

type RuntimeControlDriver interface {
	Prepare(context.Context, string) (string, error)
	Dispatch(context.Context, string, string) error
	Complete(context.Context, string, string) (bool, error)
}

RuntimeControlDriver prepares a dormant, command-bound manager handle. Complete requires positive terminal actuation proof. HTTP acceptance and unchanged power are not completion. Dispatch is never replayed.

func NewSynchronousRuntimeControl added in v0.53.13 

func NewSynchronousRuntimeControl(id string, call func(context.Context, string) error) RuntimeControlDriver

NewSynchronousRuntimeControl retains positive terminal replies in-process. A lost reply remains unresolved across restart; power is not a receipt.

type RuntimeControlEffect added in v0.53.13 

type RuntimeControlEffect struct {
	Handle string `json:"handle,omitempty"`
	State  string `json:"state,omitempty"`
}

type Service 

type Service struct {
	// contains filtered or unexported fields
}

func (*Service) AbandonRestore 

func (s *Service) AbandonRestore(ctx context.Context, input RestoreAbandonInput) (RestoreAbandonment, error)

AbandonRestore closes one exact pending or staged restore operation. It is deliberately independent of source-topology compatibility and recovery expiry: those properties govern whether a restore may run, not whether its retained journal may be explicitly released by the current Owner.

func (*Service) CompleteApplicationTransferAbortRetirement added in v0.54.10 

func (s *Service) CompleteApplicationTransferAbortRetirement(operation, transferID, retiredSpecHash string) error

CompleteApplicationTransferAbortRetirement settles the existing target hold only after canonical selected intent retirement. No target runtime is resumed.

func (*Service) CompleteApplicationTransferRetirement added in v0.54.10 

func (s *Service) CompleteApplicationTransferRetirement(operation, transferID, retiredSpecHash string) error

CompleteApplicationTransferRetirement is terminal only after the canonical intent writer retired the selected workloads while retaining their data. Its distinct state is never a successful/restored full-node backup anchor.

func (*Service) Configure 

func (s *Service) Configure(ctx context.Context, input ConfigureInput) (Configuration, error)

func (*Service) PrepareApplicationTransferRetirement added in v0.54.10 

func (s *Service) PrepareApplicationTransferRetirement(operation, transferID, candidateHash string, requireCapability ...bool) error

func (*Service) Rebind added in v0.46.8 

func (s *Service) Rebind(ctx context.Context, input ConfigureInput) (Configuration, bool, error)

Rebind moves an existing backup configuration to the current authority lineage and policy artifact after a converged mutation (a change set that adds a workload selects its data volume and re-signs Plan and Apply). It stays with the same Owner, authority and repository: a configuration of a different Owner or authority, or a runtime that would answer with another repository, fails closed. It reports whether the configuration moved and returns os.ErrNotExist when no configuration exists yet.

func (*Service) RecordApplicationTransferOutcome added in v0.54.10 

func (s *Service) RecordApplicationTransferOutcome(operation, transferID, outcomeDigest, state string) error

RecordApplicationTransferOutcome updates the existing signed snapshot journal; success never restarts source containers or removes their retained data. The caller holds the existing snapshot mutation lease and authenticates the destination outcome before passing its canonical digest/state here.

func (*Service) RecordApplicationTransferRetirementAuthorization added in v0.54.10 

func (s *Service) RecordApplicationTransferRetirementAuthorization(operation, transferID string, raw []byte) error

RecordApplicationTransferRetirementAuthorization stores the already verified secret-free capability in the same Owner-signed journal before intent CAS. The caller must hold the existing snapshot lease and verify issuer trust, signature, trusted time, Owner, stack and reconstructed scope first.

func (*Service) Restore 

func (s *Service) Restore(ctx context.Context, input RestoreInput) (RestoreResult, error)

Restore verifies one owner-signed snapshot anchor, stages its complete contents below the governed isolated restore volume, and signs evidence only after the caller re-verifies the current local Plan/Apply/Owner/service closure. It deliberately does not mutate live Docker volumes.

func (*Service) Run 

func (s *Service) Run(ctx context.Context, input RunInput) (SnapshotAnchor, error)

func (*Service) Status 

func (s *Service) Status(ctx context.Context, input StatusInput) (RepositoryStatus, error)

type SnapshotAnchor 

type SnapshotAnchor struct {
	Workloads            []string                                   `json:"workloads,omitempty"`
	APIVersion           string                                     `json:"apiVersion"`
	ID                   string                                     `json:"id"`
	OwnerRef             string                                     `json:"ownerRef"`
	AuthorityRef         string                                     `json:"authorityRef"`
	Lineage              AuthorityLineage                           `json:"lineage"`
	PolicyArtifactDigest string                                     `json:"policyArtifactDigest"`
	OperationID          string                                     `json:"operationId"`
	Policy               Policy                                     `json:"policy"`
	Repository           RepositoryReceipt                          `json:"repository"`
	Snapshot             RepositorySnapshotReceipt                  `json:"snapshot"`
	Quiescence           *SnapshotQuiescence                        `json:"quiescence,omitempty"`
	Signature            localevidence.OwnerSnapshotAnchorSignature `json:"signature"`
	ProtectRecovery      bool                                       `json:"protectRecovery,omitempty"`
}

func LoadSnapshotAnchor 

func LoadSnapshotAnchor(workspaceRoot, anchorID string) (SnapshotAnchor, error)

LoadSnapshotAnchor reads and verifies the exact persisted content-addressed anchor consumed by restore. It has no repository or restore side effects.

type SnapshotAppGroupEvidence added in v0.54.10 

type SnapshotAppGroupEvidence struct {
	Groups             []AppGroupControl
	Controls           []RuntimeControl
	Phase              string
	State              string
	PolicySourceDigest string
	NativeHoldsClosed  bool
}

ReadSnapshotAppGroupEvidence authenticates the actual policy source and v1 control selection alongside the group for real-product journey assertions.

func ReadSnapshotAppGroupEvidence added in v0.54.10 

func ReadSnapshotAppGroupEvidence(workspace, operation string) (SnapshotAppGroupEvidence, error)

type SnapshotAvailability 

type SnapshotAvailability struct {
	State      string    `json:"state"`
	Reason     string    `json:"reason,omitempty"`
	Scope      string    `json:"scope"`
	ObservedAt time.Time `json:"observedAt"`
	EvidenceID string    `json:"evidenceId,omitempty"`
	SnapshotID string    `json:"snapshotId,omitempty"`
}

SnapshotAvailability is a fresh read-only observation, never an additional durable authority. Present means the exact signed snapshot manifest is still readable in the currently authorized repository; it is not a restore or full content-integrity result.

type SnapshotOperationInspection 

type SnapshotOperationInspection struct {
	Found                   bool
	OperationID             string
	State                   string
	OwnerRef                string
	AuthorityRef            string
	Lineage                 AuthorityLineage
	PolicyArtifactDigest    string
	QuiescencePhase         string
	NativeHoldPending       bool
	QuiescenceAuthenticated bool
	SnapshotAnchorID        string
	SnapshotAnchorVerified  bool
}

SnapshotOperationInspection is a read-only, owner-authenticated view of a snapshot operation journal. It deliberately contains no runtime handle and cannot resume, settle, or mutate the operation.

func InspectSnapshotOperation 

func InspectSnapshotOperation(workspaceRoot, operationID string) (SnapshotOperationInspection, error)

InspectSnapshotOperation reads and authenticates one operation journal. A missing journal is returned as Found=false; malformed, tampered, or internally inconsistent journals fail closed. Found=false only proves that no durable journal is currently present; it does not prove that no earlier runtime effect occurred. The inspection is safe to use while the repository runtime is unavailable.

func (SnapshotOperationInspection) SafeForAuthorityReplacement 

func (inspection SnapshotOperationInspection) SafeForAuthorityReplacement() bool

SafeForAuthorityReplacement reports whether no writer or unresolved snapshot mutation remains in the inspected journal. A missing journal is safe for replacement decisions because no durable journal is present; it is not proof that no transient runtime effect occurred before it disappeared.

type SnapshotQuiesceMount 

type SnapshotQuiesceMount struct {
	Type        string `json:"type"`
	Name        string `json:"name"`
	Source      string `json:"source"`
	Destination string `json:"destination"`
	RW          bool   `json:"rw"`
	Propagation string `json:"propagation"`
}

type SnapshotQuiesceRuntime 

type SnapshotQuiesceRuntime interface {
	CreateSnapshotWithQuiescence(
		context.Context,
		RepositorySnapshotRequest,
		SnapshotQuiescence,
		func(SnapshotQuiescence) error,
	) (RepositorySnapshotReceipt, error)
}

SnapshotQuiesceRuntime is an optional extension for productive runtimes that can stop and restore Docker writers around one Kopia snapshot. Keeping it optional preserves legacy repository fakes and v1 journals.

type SnapshotQuiescedContainer 

type SnapshotQuiescedContainer struct {
	RestartPolicy        string                 `json:"restartPolicy,omitempty"`
	MarketplaceService   string                 `json:"marketplaceService,omitempty"`
	MarketplaceComponent string                 `json:"marketplaceComponent,omitempty"`
	ID                   string                 `json:"id"`
	Name                 string                 `json:"name"`
	WasRunning           bool                   `json:"wasRunning"`
	WorkloadRef          string                 `json:"workloadRef,omitempty"`
	SiteRef              string                 `json:"siteRef,omitempty"`
	NodeRef              string                 `json:"nodeRef,omitempty"`
	ComposeProject       string                 `json:"composeProject,omitempty"`
	ComposeService       string                 `json:"composeService,omitempty"`
	ComponentRef         string                 `json:"componentRef,omitempty"`
	Image                string                 `json:"image,omitempty"`
	StopOrder            int                    `json:"stopOrder,omitempty"`
	Mounts               []SnapshotQuiesceMount `json:"mounts"`
}

type SnapshotQuiescence 

type SnapshotQuiescence struct {
	TransferRetirementRequiresCapability bool                        `json:"transferRetirementRequiresCapability,omitempty"`
	TransferRetirementCapability         []byte                      `json:"transferRetirementCapability,omitempty"`
	TransferWorkloads                    []string                    `json:"transferWorkloads,omitempty"`
	TransferHoldID                       string                      `json:"transferHoldId,omitempty"`
	TransferOutcomeDigest                string                      `json:"transferOutcomeDigest,omitempty"`
	TransferOutcomeState                 string                      `json:"transferOutcomeState,omitempty"`
	TransferRetiredSpecHash              string                      `json:"transferRetiredSpecHash,omitempty"`
	TransferRetirementCandidateHash      string                      `json:"transferRetirementCandidateHash,omitempty"`
	ControlVersion                       int                         `json:"controlVersion,omitempty"`
	AppGroups                            []AppGroupControl           `json:"appGroups,omitempty"`
	Controls                             []RuntimeControl            `json:"controls,omitempty"`
	Phase                                string                      `json:"phase"`
	GraphDigest                          string                      `json:"graphDigest,omitempty"`
	CaptureStartedAt                     *time.Time                  `json:"captureStartedAt,omitempty"`
	Containers                           []SnapshotQuiescedContainer `json:"containers"`
}

SnapshotQuiescence is the journaled pre-snapshot Docker identity set. The operation journal persists this value before the first stop mutation so a retry can address only the exact containers that were running at capture time. CaptureStartedAt, when present, precedes the first writer stop and provides a conservative age boundary, not application-consistency evidence.

type StatusInput 

type StatusInput struct {
	OwnerRef       string           `json:"ownerRef"`
	AuthorityRef   string           `json:"authorityRef"`
	Lineage        AuthorityLineage `json:"lineage"`
	PolicyArtifact []byte           `json:"-"`
}

type VolumeReadback added in v0.53.6 

type VolumeReadback struct {
	MetadataDigest string `json:"metadataDigest,omitempty"`
	LiveName       string `json:"liveName"`
	Files          int64  `json:"files"`
	Bytes          int64  `json:"bytes"`
	Digest         string `json:"digest"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.