processhost

type ActivateRequest struct {
	InstanceID  string
	Artifact    *trust.VerifiedArtifact
	Model       ProcessModel
	Sharing     SharingOptions
	FactoryKind string
	ConfigYAML  []byte
	Secrets     backendplugin.SecretBundle
	Policy      backendplugin.RuntimePolicy
	ExpectedUID *int
	ExpectedSID string
	// DialAndConfigure runs only after peer authentication. Secrets are supplied
	// here by the host only after peer success (never via LaunchSpec).
	DialAndConfigure func(ctx context.Context, conn net.Conn, peer PeerIdentity, generation uint64, secrets backendplugin.SecretBundle, configYAML []byte) error
}

type ActivateResult struct {
	Generation uint64
	PID        int
	Peer       PeerIdentity
	Conn       net.Conn
	Cleanup    func() error
}

type BuildResult struct {
	Backend execbackend.Backend
	// contains filtered or unexported fields
}

type CandidateAssessment struct {
	Candidate       CandidateID
	Dimensions      []DimensionEvidence
	Feasible        bool
	Selectable      bool
	RejectReasons   []string
	ReplacementCost ReplacementCost
}

type CandidateID string

type ChannelFactory interface {
	Listen(ctx context.Context, generation uint64) (lis Listener, inherited []*os.File, err error)
}

type Config struct {
	Launcher Launcher
	Channel  ChannelFactory
	WorkDir  string
	AllowEnv []string
}

type CookiePlaintextChannel struct{}

type DimensionEvidence struct {
	Requirement   RequirementID
	Level         EvidenceLevel
	Notes         string
	Source        *SourceRef
	ReplacesStock bool
}

type EvidenceCatalog map[CandidateID][]DimensionEvidence

type EvidenceLevel string

type ExactlyOnceWait struct {
	// contains filtered or unexported fields
}

type Host struct {
	// contains filtered or unexported fields
}

type HostSecureProfile struct {
	Platform             PlatformID
	Verification         PlatformVerificationStatus
	LaunchBinding        string
	LocalChannel         string
	RuntimeChannelOK     bool
	RuntimeChannelReason string
}

type LaunchEnvProvider interface {
	LaunchEnv() []string
}

type LaunchSpec struct {
	Artifact   *trust.VerifiedArtifact
	WorkDir    string
	Env        []string // minimal non-secret allowlist only; non-nil
	Generation uint64
	// ExtraFiles are confidential one-shot inherited handles (never env bootstrap).
	ExtraFiles []*os.File
}

type Launcher interface {
	Launch(ctx context.Context, spec LaunchSpec) (Process, error)
}

type Listener interface {
	Accept(ctx context.Context) (net.Conn, PeerIdentity, error)
	Close() error
}

type OfficialSourceEvidence struct {
	ModulePath string
	Version    string
	License    string
	SourceURL  string
	LicenseURL string
}

type PeerIdentity struct {
	PID        int
	UID        int
	SID        string // Windows token user SID when available
	Generation uint64
}

type PlatformChannel struct{}

type PlatformID string

type PlatformLauncher struct{}

type PlatformProfile struct {
	Platform      PlatformID
	Verification  PlatformVerificationStatus
	LaunchBinding string
	LocalChannel  string
}

type PlatformVerificationStatus string

type Process interface {
	PID() int
	Generation() uint64
	Wait() (err error)
	SignalKill() error
	GracefulStop(timeout time.Duration) error
	Close() error
	ContainsPID(pid int) bool
	Stdout() io.ReadCloser
	Stderr() io.ReadCloser
}

type ProcessModel string

type Reason string

type ReplacementCost struct {
	Launch               bool
	AuthTransport        bool
	Bootstrap            bool
	Lifecycle            bool
	Limits               bool
	ExceedsRetainedValue bool
	Rationale            string
}

type RequirementID string

type RequirementSpec struct {
	ID        RequirementID
	Mandatory bool
	Summary   string
}

type SelectionResult struct {
	Selected       CandidateID
	Platforms      []PlatformProfile
	Assessments    []CandidateAssessment
	OfficialSource OfficialSourceEvidence
	Task12Blockers []string
}

type SharingOptions struct {
	IsolationDeclared   bool
	ConcurrencyDeclared bool
}

type SourceRef struct {
	Module     string
	Version    string
	Path       string
	Symbol     string
	Lines      string
	URL        string
	License    string
	LicenseURL string
}

type TestChannel struct {
	PeerPID    int
	PeerUID    int
	RejectPeer bool
	StaleGen   bool
	Accepts    atomic.Int64
	// contains filtered or unexported fields
}

type TestLauncher struct {
	Launches      atomic.Int64
	PID           int
	Fail          error
	ContainFail   bool // ContainsPID always false (simulates PID reuse / dead child)
	LastSpec      LaunchSpec
	LastProcess   Process
	OnLaunch      func(LaunchSpec)
	StderrPayload string
}

type UnsupportedChannel struct{}