deploy

package
v0.0.0-...-43e0272 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 14, 2026 License: MIT Imports: 40 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	ControlledSessionIncidentReceiptSchemaV1 = "controlled-session-incident-v1"
	ControlledSessionIncidentReceiptLimitV1  = 8 * 1024
)
View Source 
const (
	DeploymentStateSchemaV1       = "deployment-v1"
	InstallationSchemaV1          = "installation-v1"
	InstallationStatusConfiguring = "configuring"
	InstallationStatusReady       = "ready"
)
View Source 
const (
	ImageDescriptorSchemaV1 = "image-descriptor-v1"
	BaseConfigSchemaV1      = "base-config-v1"
	RootFSSubjectSchemaV1   = "rootfs-subject-v1"
)
View Source 
const (
	PendingBuildSchemaV1 = "pending-build-v1"

	PendingBuildPhaseValidated         = "validated"
	PendingBuildPhaseGenerationCreated = "generation-created"
	PendingBuildPhaseLockPublished     = "lock-published"
	PendingBuildPhaseStateCommitted    = "state-committed"
	PendingBuildPhaseCleanup           = "cleanup"

	CleanupKindContainer               = "container"
	CleanupKindMount                   = "mount"
	CleanupKindTemporaryFile           = "temporary-file"
	CleanupKindTemporaryImageReference = "temporary-image-reference"
	CleanupKindGenerationReference     = "generation-reference"
)
View Source 
const (
	PrefixValidationSchemaV1 = "prefix-validation-v1"
	ValidationLabelPrefix    = "io.reploy.validation."
	ValidationSchemaLabel    = ValidationLabelPrefix + "schema"
	ValidationSubjectLabel   = ValidationLabelPrefix + "subject"
	ValidationRecordLabel    = ValidationLabelPrefix + "record"
)
View Source 
const (
	RuntimePolicySchemaV1 = "runtime-policy-v1"
	ReployImageRoot       = "/opt/reploy"
	ReployProviderRoot    = "/opt/reploy/providers"

	ProtectedPathReployRoot     = "reploy-root"
	ProtectedPathProviderRoot   = "provider-root"
	ProtectedPathProviderLeaf   = "provider-leaf"
	ProtectedPathExecutablePath = "executable-path"

	RuntimeMountSourceFile      = "file"
	RuntimeMountSourceDirectory = "directory"
	RuntimeMountSourceGenerated = "generated"
)
View Source 
const (
	ApplicationStartupVerifierSchemaV1 = "application-startup-verifier-v1"
	ApplicationStartupVerifierRecipeV1 = "linux-network-policy-sandbox-exec-v1"
	ApplicationStartupVerifierPathV1   = "/reploy-probe"
	ApplicationRuntimeLayerSchemaV1    = "application-runtime-layer-v1"
	ApplicationLocalAccountSchemaV1    = "application-local-account-v1"
)
View Source 
const BlueprintManifestGlob = "*.blueprint.yaml"
View Source 
const BuildLockSchemaV1 = "lock-v1"
View Source 
const ControlledSessionNetworkRoleV1 = "network"
View Source 
const LiveRunQueueSchemaV1 = "live-run-queue-v1"
View Source 
const PackageOverrideIntentSchemaV1 = "package-override-intent-v1"
View Source 
const PackageOverridesFilename = "overrides.yaml"
View Source 
const PendingValidatedBuildSchemaV1 = "pending-validated-build-v1"
View Source 
const PortableRuntimeLayerSchemaV1 = "portable-runtime-layer-v1"
View Source 
const RequestOverlaySchemaV1 = "overlay-v1"
View Source 
const StagingStateSchemaV1 = "staging-v1"
View Source 
const StateSchemaV1 = "state-v1"
View Source 
const (
	ValidatedBuildSchemaV1 = "validated-build-v1"
)

Variables

View Source 
var ErrDesiredStateAlreadyExists = errors.New("deployment desired state already exists")
View Source 
var ErrLegacyStateUnsupported = errors.New("state.legacy_unsupported")
View Source 
var ErrLiveRunConflict = errors.New("another run must finish first")
View Source 
var ToolVersion = reploy.Version

Functions

func AdmitControlMarkerV1 

func AdmitControlMarkerV1(queue LiveRunQueueV1, candidate ControlMarkerV1, wait bool) (LiveRunQueueV1, LiveRunStatusV1, error)

func AdmitLiveRunV1 

func AdmitLiveRunV1(queue LiveRunQueueV1, candidate LiveRunV1, wait bool) (LiveRunQueueV1, LiveRunStatusV1, error)

func ApplicationRuntimeLayerTransactionDigestV1 

func ApplicationRuntimeLayerTransactionDigestV1(
	verifier ApplicationStartupVerifierV1,
	account ApplicationLocalAccountV1,
	upstream providers.RealizedImageV1,
	platform blueprint.Platform,
) (canonical.Digest, error)

func BuildLockDigestV1 

func BuildLockDigestV1(lock BuildLockV1, validateProfileOwner providers.RequirementProfileOwnerValidator) (canonical.Digest, error)

func BuildLockStoreClosure 

func BuildLockStoreClosure(
	lock BuildLockV1,
	store providerstore.Store,
	validateProfileOwner providers.RequirementProfileOwnerValidator,
	validateBundleOwner providers.ResolvedBundleOwnerValidator,
) ([]providerstore.StoreObjectRef, error)

func BuildLockStoreClosureBytes 

func BuildLockStoreClosureBytes(
	lock BuildLockV1,
	store providerstore.Store,
	validateProfileOwner providers.RequirementProfileOwnerValidator,
	validateBundleOwner providers.ResolvedBundleOwnerValidator,
) (uint64, error)

BuildLockStoreClosureBytes returns the logical bytes written when every object in the locked closure is copied. It validates record content and blob layout and size, but deliberately does not hash blob bodies; transfer does that while streaming each object into the destination store.

func CancelWaitingLiveRunsV1 

func CancelWaitingLiveRunsV1(queue LiveRunQueueV1) (LiveRunQueueV1, []LiveRunV1, error)

func CanonicalRuntimeInboundTCPV1 

func CanonicalRuntimeInboundTCPV1(values []int) []string

func ControlledSessionIncidentReceiptPathV1 

func ControlledSessionIncidentReceiptPathV1(channelDirectory string, liveRunID string) (string, error)

func CurrentBootSessionIDV1 

func CurrentBootSessionIDV1() (string, error)

CurrentBootSessionIDV1 returns an opaque host execution-session identity. It remains stable across Docker daemon restarts and suspend/resume, but changes when the host boots a new operating-system session.

func DecidePendingRecoveryWithBuildLock 

func DecidePendingRecoveryWithBuildLock(
	current *EnvironmentGenerationState,
	pending PendingBuildV1,
	load PendingBuildLockLoader,
	validateProfileOwner providers.RequirementProfileOwnerValidator,
) (PendingRecoveryDecision, *EnvironmentGenerationState, error)

func EffectiveBaseImageV1 

func EffectiveBaseImageV1(document blueprint.Document, overrides PackageOverridesV1) (string, error)

func EncodeBuildLockV1 

func EncodeBuildLockV1(lock BuildLockV1, validateProfileOwner providers.RequirementProfileOwnerValidator) ([]byte, error)

func EncodeControlledSessionCleanupManifest 

func EncodeControlledSessionCleanupManifest(manifest ControlledSessionCleanupManifest) ([]byte, error)

func EncodeControlledSessionIncidentReceiptV1 

func EncodeControlledSessionIncidentReceiptV1(receipt ControlledSessionIncidentReceiptV1) ([]byte, error)

func EncodeLiveRunQueueV1 

func EncodeLiveRunQueueV1(queue LiveRunQueueV1) ([]byte, error)

func EncodePackageOverridesV1 

func EncodePackageOverridesV1(overrides PackageOverridesV1) ([]byte, error)

func EncodePendingBuild 

func EncodePendingBuild(record PendingBuildV1) ([]byte, error)

func EncodePendingValidatedBuildV1 

func EncodePendingValidatedBuildV1(intent PendingValidatedBuildV1) ([]byte, error)

func EncodePrefixValidation 

func EncodePrefixValidation(record PrefixValidationV1) ([]byte, providerstore.StoreObjectRef, error)

func EncodeStateV1 

func EncodeStateV1(state StateV1) ([]byte, error)

func EncodeValidatedBuildV1 

func EncodeValidatedBuildV1(record ValidatedBuildV1) ([]byte, error)

func HashBytes 

func HashBytes(content []byte) string

func HashFile 

func HashFile(path string) (string, error)

func InspectBuildLockStoreClosure 

func InspectBuildLockStoreClosure(
	lock BuildLockV1,
	store providerstore.Store,
	validateProfileOwner providers.RequirementProfileOwnerValidator,
	validateBundleOwner providers.ResolvedBundleOwnerValidator,
) ([]providerstore.StoreObjectRef, uint64, error)

InspectBuildLockStoreClosure returns the ordered closure and its logical transfer size. It validates records plus blob layout and size without hashing blob bodies; transfer remains responsible for streaming verification.

func NewControlMarkerIDV1 

func NewControlMarkerIDV1() (string, error)

func NewLiveRunIDV1 

func NewLiveRunIDV1() (string, error)

func NormalizePackageAdditionV1 

func NormalizePackageAdditionV1(provider string, requirement string) (string, error)

NormalizePackageAdditionV1 validates a provider-native development package addition without translating its package name. The os provider currently selects the Debian/Ubuntu APT implementation at build time.

func NormalizePackageOverrideExclusionsV1 

func NormalizePackageOverrideExclusionsV1(exclusions []string) ([]string, error)

NormalizePackageOverrideExclusionsV1 validates exact source-relative paths and returns their stable lexical order. Entries select the named path and its descendants; they are deliberately not glob or ignore-file patterns.

func PackageOverridesDigestV1 

func PackageOverridesDigestV1(overrides PackageOverridesV1) (canonical.Digest, error)

func PackageOverridesPath 

func PackageOverridesPath(deploymentDir string) (string, error)

func PortableRuntimeLayerTransactionDigestV1 

func PortableRuntimeLayerTransactionDigestV1(lock providers.PortableToolLockV1, upstream, result providers.RealizedImageV1) (canonical.Digest, error)

func PrefixValidationDigest 

func PrefixValidationDigest(record PrefixValidationV1) (canonical.Digest, error)

func PrefixValidationLabels 

func PrefixValidationLabels(subject canonical.Digest, reference providerstore.StoreObjectRef) ([]providers.ImageLabel, error)

func PublishPrefixValidation 

func PublishPrefixValidation(ctx context.Context, store providerstore.Store, record PrefixValidationV1) (providerstore.StoreObjectRef, error)

func RequestOverlayDigestV1 

func RequestOverlayDigestV1(overlay RequestOverlayV1) (canonical.Digest, error)

RequestOverlayDigestV1 rejects noncanonical ordering before hashing so two spellings cannot acquire distinct identities for the same overlay intent.

func ResolvePackageOverrideWorkspaceRootV1 

func ResolvePackageOverrideWorkspaceRootV1(value string) (string, error)

ResolvePackageOverrideWorkspaceRootV1 expands a current-user home shorthand only when the workspace is used. The sidecar retains the user's original spelling.

func ReusableBuildLockStoreClosure 

func ReusableBuildLockStoreClosure(
	lock BuildLockV1,
	store providerstore.Store,
	validateProfileOwner providers.RequirementProfileOwnerValidator,
	validateBundleOwner providers.ResolvedBundleOwnerValidator,
) ([]providerstore.StoreObjectRef, error)

ReusableBuildLockStoreClosure verifies the closure for deployment-local cache reuse. Debian archives use deployment-local verification stamps so an unchanged size and modification time avoid rereading their bodies. All other artifacts continue to receive full content hashing.

func RootFSSubject 

func RootFSSubject(diffIDs []canonical.Digest) (canonical.Digest, error)

func RuntimePolicyDigestV1 

func RuntimePolicyDigestV1(policy RuntimePolicyV1) (canonical.Digest, error)

func ValidateApplicationLocalAccountV1 

func ValidateApplicationLocalAccountV1(account ApplicationLocalAccountV1) error

func ValidateApplicationRuntimeLayerV1 

func ValidateApplicationRuntimeLayerV1(layer ApplicationRuntimeLayerV1, platform blueprint.Platform) error

func ValidateApplicationStartupVerifierV1 

func ValidateApplicationStartupVerifierV1(verifier ApplicationStartupVerifierV1, requireArtifact bool) error

func ValidateBaseImageReferenceV1 

func ValidateBaseImageReferenceV1(reference string) error

ValidateBaseImageReferenceV1 validates one Docker author reference without resolving or pulling it. A bare sha256 digest is a full local image ID; repository digests remain valid remote references.

func ValidateBuildLockV1 

func ValidateBuildLockV1(lock BuildLockV1, validateProfileOwner providers.RequirementProfileOwnerValidator) error

func ValidateControlMarkerIDV1 

func ValidateControlMarkerIDV1(id string) error

func ValidateControlledSessionCleanupManifest 

func ValidateControlledSessionCleanupManifest(manifest ControlledSessionCleanupManifest) error

func ValidateControlledSessionIncidentReceiptV1 

func ValidateControlledSessionIncidentReceiptV1(receipt ControlledSessionIncidentReceiptV1) error

func ValidateDeploymentStateV1 

func ValidateDeploymentStateV1(state DeploymentStateV1) error

func ValidateEnvironmentGenerationState 

func ValidateEnvironmentGenerationState(generation EnvironmentGenerationState) error

func ValidateInstallationStateV1 

func ValidateInstallationStateV1(state InstallationStateV1) error

func ValidateLiveRunIDV1 

func ValidateLiveRunIDV1(id string) error

func ValidateLiveRunQueueV1 

func ValidateLiveRunQueueV1(queue LiveRunQueueV1) error

func ValidatePackageOverrideIntentV1 

func ValidatePackageOverrideIntentV1(intent PackageOverrideIntentV1) error

func ValidatePackageOverridesV1 

func ValidatePackageOverridesV1(overrides PackageOverridesV1) error

func ValidatePendingBuild 

func ValidatePendingBuild(record PendingBuildV1) error

func ValidatePendingValidatedBuildV1 

func ValidatePendingValidatedBuildV1(intent PendingValidatedBuildV1) error

func ValidatePrefixValidation 

func ValidatePrefixValidation(record PrefixValidationV1) error

func ValidatePrefixValidationLabels 

func ValidatePrefixValidationLabels(labels map[string]string, image providers.RealizedImageV1, reference providerstore.StoreObjectRef) error

func ValidateRuntimePolicyV1 

func ValidateRuntimePolicyV1(policy RuntimePolicyV1) error

func ValidateStagingStateV1 

func ValidateStagingStateV1(state StagingStateV1, _ blueprint.Document) error

func ValidateStateV1 

func ValidateStateV1(state StateV1) error

func ValidateValidatedBuildV1 

func ValidateValidatedBuildV1(record ValidatedBuildV1) error

func WriteControlledSessionIncidentReceiptV1 

func WriteControlledSessionIncidentReceiptV1(file *os.File, receipt ControlledSessionIncidentReceiptV1) error

Types

type ApplicationLocalAccountV1 

type ApplicationLocalAccountV1 struct {
	Schema string `json:"schema"`
	Name   string `json:"name"`
	UID    string `json:"uid"`
	GID    string `json:"gid"`
	Home   string `json:"home"`
}

type ApplicationRuntimeLayerV1 

type ApplicationRuntimeLayerV1 struct {
	Schema            string                       `json:"schema"`
	Verifier          ApplicationStartupVerifierV1 `json:"verifier"`
	Account           ApplicationLocalAccountV1    `json:"account"`
	TransactionDigest canonical.Digest             `json:"transaction_digest"`
	Upstream          providers.RealizedImageV1    `json:"upstream"`
	Result            providers.RealizedImageV1    `json:"result"`
}

type ApplicationStartupVerifierV1 

type ApplicationStartupVerifierV1 struct {
	Schema        string           `json:"schema"`
	RecipeVersion string           `json:"recipe_version"`
	Path          string           `json:"path"`
	Artifact      canonical.Digest `json:"artifact"`
	Size          string           `json:"size"`
}

func ApplicationStartupVerifierContractV1 

func ApplicationStartupVerifierContractV1() ApplicationStartupVerifierV1

type BaseConfig 

type BaseConfig struct {
	Schema      string                      `json:"schema"`
	Environment []ConfigEnvironmentVariable `json:"environment"`
	User        string                      `json:"user"`
	WorkingDir  string                      `json:"working_dir"`
	Entrypoint  []string                    `json:"entrypoint"`
	Command     []string                    `json:"command"`
	Healthcheck string                      `json:"healthcheck"`
	StopSignal  string                      `json:"stop_signal"`
	OnBuild     []string                    `json:"on_build"`
	Volumes     []string                    `json:"volumes"`
}

func (BaseConfig) Validate 

func (config BaseConfig) Validate() error

type BaseImageOverrideV1 

type BaseImageOverrideV1 struct {
	Image string `yaml:"image"`
}

type BuildLockV1 

type BuildLockV1 struct {
	Schema                string                        `json:"schema"`
	BlueprintDigest       canonical.Digest              `json:"blueprint_digest"`
	Overlay               RequestOverlayV1              `json:"overlay"`
	PackageOverrides      PackageOverrideIntentV1       `json:"package_overrides"`
	ResolvedRequestDigest canonical.Digest              `json:"resolved_request_digest"`
	Platform              blueprint.Platform            `json:"platform"`
	Base                  ImageDescriptor               `json:"base"`
	BasePlanDigest        canonical.Digest              `json:"base_plan_digest,omitempty"`
	Graph                 ProviderGraphLockV1           `json:"graph"`
	Nodes                 []NodeLockV1                  `json:"nodes"`
	Catalog               []providers.RealizedOutput    `json:"catalog"`
	PortableTools         *providers.PortableToolLockV1 `json:"portable_tools,omitempty"`
	PortableRuntimeLayer  *PortableRuntimeLayerV1       `json:"portable_runtime_layer,omitempty"`
	RuntimePolicy         RuntimePolicyV1               `json:"runtime_policy"`
	RuntimeLayer          ApplicationRuntimeLayerV1     `json:"runtime_layer"`
	ValidationRecord      providerstore.StoreObjectRef  `json:"validation_record"`
	FinalImage            providers.RealizedImageV1     `json:"final_image"`
}

func DecodeBuildLockV1 

func DecodeBuildLockV1(content []byte, validateProfileOwner providers.RequirementProfileOwnerValidator) (BuildLockV1, error)

type CleanupItemV1 

type CleanupItemV1 struct {
	Kind     string `json:"kind"`
	Identity string `json:"identity"`
}

type ConfigEnvironmentVariable 

type ConfigEnvironmentVariable struct {
	Name  string `json:"name"`
	Value string `json:"value"`
}

type ControlLeaseV1 

type ControlLeaseV1 = QueueEntryLeaseV1

ControlLeaseV1 is retained as the public lifecycle-operation name.

type ControlMarkerV1 

type ControlMarkerV1 struct {
	ID                  string
	Operation           ControlOperationV1
	GenerationReference string
	BootSession         string
	Status              LiveRunStatusV1
}

func ControlMarkersV1 

func ControlMarkersV1(queue LiveRunQueueV1) []ControlMarkerV1

type ControlOperationV1 

type ControlOperationV1 string
const (
	ControlOperationUpV1        ControlOperationV1 = "up"
	ControlOperationStopV1      ControlOperationV1 = "stop"
	ControlOperationRestartV1   ControlOperationV1 = "restart"
	ControlOperationInstallV1   ControlOperationV1 = "install"
	ControlOperationUninstallV1 ControlOperationV1 = "uninstall"
	ControlOperationStageV1     ControlOperationV1 = "stage"
)

type ControlledSessionCleanupManifest 

type ControlledSessionCleanupManifest struct {
	LiveRunID        string                                `json:"live_run_id"`
	BootSession      string                                `json:"boot_session"`
	DockerEndpoint   string                                `json:"docker_endpoint"`
	ChannelDirectory string                                `json:"channel_directory"`
	IncidentReceipt  string                                `json:"incident_receipt"`
	Controller       ControlledSessionContainerOwnershipV1 `json:"controller"`
	Workload         ControlledSessionContainerOwnershipV1 `json:"workload"`
	Networks         []ControlledSessionNetworkOwnershipV1 `json:"networks"`
	Volumes          []string                              `json:"volumes"`
}

ControlledSessionCleanupManifest is the complete immutable resource selection a session watchdog may receive. It is derived from durable ownership rather than accepting later resource choices.

Networks and volumes are explicit arrays. Network entries carry the exact immutable identity selected by durable ownership; volumes remain reserved for a later resource slice.

func ControlledSessionCleanupManifestFromOwnership 

func ControlledSessionCleanupManifestFromOwnership(ownership ControlledSessionOwnershipV1) (ControlledSessionCleanupManifest, error)

ControlledSessionCleanupManifestFromOwnership creates the watchdog input from the exact durable ownership record. The session handle is deliberately omitted because cleanup does not need protocol authority.

func DecodeControlledSessionCleanupManifest 

func DecodeControlledSessionCleanupManifest(content []byte) (ControlledSessionCleanupManifest, error)

type ControlledSessionContainerOwnershipV1 

type ControlledSessionContainerOwnershipV1 struct {
	Role                string `json:"role"`
	ID                  string `json:"id"`
	Name                string `json:"name"`
	DeploymentID        string `json:"deployment_id"`
	GenerationReference string `json:"generation_reference"`
	BuildIdentity       string `json:"build_identity"`
}

type ControlledSessionIncidentCleanupStatusV1 

type ControlledSessionIncidentCleanupStatusV1 string
const (
	ControlledSessionIncidentCleanupSucceededV1 ControlledSessionIncidentCleanupStatusV1 = "succeeded"
	ControlledSessionIncidentCleanupFailedV1    ControlledSessionIncidentCleanupStatusV1 = "failed"
)

type ControlledSessionIncidentContainerV1 

type ControlledSessionIncidentContainerV1 struct {
	Role                string                                    `json:"role"`
	ID                  string                                    `json:"id"`
	DeploymentID        string                                    `json:"deployment_id"`
	GenerationReference string                                    `json:"generation_reference"`
	BuildIdentity       string                                    `json:"build_identity"`
	CleanupStatus       ControlledSessionIncidentResourceStatusV1 `json:"cleanup_status"`
}

ControlledSessionIncidentContainerV1 contains only immutable ownership and the watchdog's allowlisted cleanup outcome. It deliberately has no free-form diagnostic or container-output field.

type ControlledSessionIncidentNetworkV1 

type ControlledSessionIncidentNetworkV1 struct {
	Role          string                                    `json:"role"`
	ID            string                                    `json:"id"`
	Name          string                                    `json:"name"`
	CleanupStatus ControlledSessionIncidentResourceStatusV1 `json:"cleanup_status"`
}

ControlledSessionIncidentNetworkV1 carries only the immutable network identity and its allowlisted cleanup outcome. The ownership labels are the receipt live-run ID and the fixed network role.

type ControlledSessionIncidentReceiptTargetV1 

type ControlledSessionIncidentReceiptTargetV1 struct {
	// contains filtered or unexported fields
}

func (*ControlledSessionIncidentReceiptTargetV1) Close 

func (target *ControlledSessionIncidentReceiptTargetV1) Close() error

func (*ControlledSessionIncidentReceiptTargetV1) File 

func (target *ControlledSessionIncidentReceiptTargetV1) File() *os.File

func (*ControlledSessionIncidentReceiptTargetV1) Path 

func (target *ControlledSessionIncidentReceiptTargetV1) Path() string

func (*ControlledSessionIncidentReceiptTargetV1) Remove 

func (target *ControlledSessionIncidentReceiptTargetV1) Remove() error

type ControlledSessionIncidentReceiptV1 

type ControlledSessionIncidentReceiptV1 struct {
	Schema               string                                    `json:"schema"`
	LiveRunID            string                                    `json:"live_run_id"`
	BootSession          string                                    `json:"boot_session"`
	RecordedAt           string                                    `json:"recorded_at"`
	Trigger              ControlledSessionIncidentTriggerV1        `json:"trigger"`
	Controller           ControlledSessionIncidentContainerV1      `json:"controller"`
	Workload             ControlledSessionIncidentContainerV1      `json:"workload"`
	Networks             []ControlledSessionIncidentNetworkV1      `json:"networks,omitempty"`
	ChannelCleanupStatus ControlledSessionIncidentResourceStatusV1 `json:"channel_cleanup_status"`
	CleanupStatus        ControlledSessionIncidentCleanupStatusV1  `json:"cleanup_status"`
	RecoveryAction       ControlledSessionIncidentRecoveryActionV1 `json:"recovery_action"`
}

ControlledSessionIncidentReceiptV1 is the bounded durable evidence written by the session watchdog after loss of its parent. The fixed fields cannot carry PTY bytes, environment values, secrets, arbitrary logs, or raw Docker output.

func DecodeControlledSessionIncidentReceiptV1 

func DecodeControlledSessionIncidentReceiptV1(content []byte) (ControlledSessionIncidentReceiptV1, error)

type ControlledSessionIncidentRecoveryActionV1 

type ControlledSessionIncidentRecoveryActionV1 string
const (
	ControlledSessionIncidentRecoveryNoneV1          ControlledSessionIncidentRecoveryActionV1 = "none"
	ControlledSessionIncidentRecoveryNextOperationV1 ControlledSessionIncidentRecoveryActionV1 = "retry-next-operation"
)

type ControlledSessionIncidentResourceStatusV1 

type ControlledSessionIncidentResourceStatusV1 string
const (
	ControlledSessionIncidentResourceVerifiedAbsentV1 ControlledSessionIncidentResourceStatusV1 = "verified-absent"
	ControlledSessionIncidentResourceCleanupFailedV1  ControlledSessionIncidentResourceStatusV1 = "cleanup-failed"
)

type ControlledSessionIncidentTriggerV1 

type ControlledSessionIncidentTriggerV1 string
const (
	ControlledSessionIncidentParentLostV1 ControlledSessionIncidentTriggerV1 = "parent-lost"
)

type ControlledSessionNetworkOwnershipV1 

type ControlledSessionNetworkOwnershipV1 struct {
	Role string `json:"role"`
	ID   string `json:"id"`
	Name string `json:"name"`
}

type ControlledSessionOwnershipV1 

type ControlledSessionOwnershipV1 struct {
	LiveRunID                     string                                `json:"live_run_id"`
	BootSession                   string                                `json:"boot_session"`
	SessionHandle                 string                                `json:"session_handle"`
	DockerEndpoint                string                                `json:"docker_endpoint,omitempty"`
	ControllerDeploymentDirectory string                                `json:"controller_deployment_directory,omitempty"`
	WorkloadDeploymentDirectory   string                                `json:"workload_deployment_directory,omitempty"`
	ChannelDirectory              string                                `json:"channel_directory"`
	NetworkID                     string                                `json:"network_id,omitempty"`
	NetworkName                   string                                `json:"network_name,omitempty"`
	Controller                    ControlledSessionContainerOwnershipV1 `json:"controller"`
	Workload                      ControlledSessionContainerOwnershipV1 `json:"workload"`
}

type DeploymentStateV1 

type DeploymentStateV1 struct {
	Schema       string              `json:"schema"`
	Installation InstallationStateV1 `json:"installation"`
}

DeploymentStateV1 contains machine-local operational facts. It is not an input to environment resolution, provider identity, or build reuse.

type DesiredPlatformSelector 

type DesiredPlatformSelector func(blueprint.Document) (blueprint.Platform, error)

DesiredPlatformSelector chooses one backend-supported target from the exact resolved blueprint protected by the deployment operation lock.

type DesiredStateUpdateResult 

type DesiredStateUpdateResult struct {
	State   StateV1
	Changed bool
}

DesiredStateUpdateResult reports the complete desired state after staging. Changed is false when the deployment already contains the same canonical blueprint, platform, and overlay.

func CreateDesiredStateV1 

func CreateDesiredStateV1(
	ctx context.Context,
	deploymentDir string,
	document blueprint.Document,
	platform blueprint.Platform,
	validatePackage PackageRequestValidator,
) (result DesiredStateUpdateResult, err error)

CreateDesiredStateV1 atomically stages a new deployment and refuses to replace any existing state. It shares SetDesiredStateV1's validation and publication rules.

func CreateStagedDesiredStateWithPackageOverridesV1 

func CreateStagedDesiredStateWithPackageOverridesV1(
	ctx context.Context,
	deploymentDir string,
	document blueprint.Document,
	platform blueprint.Platform,
	validatePackage PackageRequestValidator,
	blueprintSource string,
	overrides PackageOverridesV1,
) (result DesiredStateUpdateResult, err error)

CreateStagedDesiredStateWithPackageOverridesV1 records a new staged deployment and its local-development package overrides under one operation lock. It refuses to replace either existing deployment state or an existing sidecar.

func SelectDesiredPlatformV1 

func SelectDesiredPlatformV1(
	ctx context.Context,
	deploymentDir string,
	selectPlatform DesiredPlatformSelector,
	validatePackage PackageRequestValidator,
) (result DesiredStateUpdateResult, err error)

SelectDesiredPlatformV1 selects and commits a target without allowing the stored blueprint to change between those operations.

func SetDesiredPlatformV1 

func SetDesiredPlatformV1(
	ctx context.Context,
	deploymentDir string,
	platform blueprint.Platform,
	validatePackage PackageRequestValidator,
) (result DesiredStateUpdateResult, err error)

SetDesiredPlatformV1 atomically updates only the selected target of an existing deployment. The resolved blueprint, request overlay, and current generation are retained exactly.

func SetDesiredStateV1 

func SetDesiredStateV1(
	ctx context.Context,
	deploymentDir string,
	document blueprint.Document,
	platform blueprint.Platform,
	validatePackage PackageRequestValidator,
) (result DesiredStateUpdateResult, err error)

SetDesiredStateV1 atomically stages a resolved blueprint and selected target platform. Existing overlay intent and the last successful generation are retained. If that overlay is invalid for the new blueprint, no state is changed. Staging never resolves providers or builds an image.

func SetStagedDesiredStateV1 

func SetStagedDesiredStateV1(
	ctx context.Context,
	deploymentDir string,
	document blueprint.Document,
	platform blueprint.Platform,
	validatePackage PackageRequestValidator,
	blueprintSource string,
	requireMissing bool,
) (result DesiredStateUpdateResult, err error)

SetStagedDesiredStateV1 records the author-provided blueprint text alongside the resolved document.

type DirectPackageRequest 

type DirectPackageRequest struct {
	Contribution string                            `json:"contribution"`
	Package      providers.CanonicalPackageRequest `json:"package"`
}

func ParseDirectPackageRequests 

func ParseDirectPackageRequests(
	document blueprint.Document,
	contributionRef string,
	requirements []string,
	parse PackageRequestParser,
) ([]DirectPackageRequest, error)

type EnvironmentGenerationState 

type EnvironmentGenerationState struct {
	Reference           string             `json:"reference"`
	ImageDigest         canonical.Digest   `json:"image_digest"`
	RootFSSubject       canonical.Digest   `json:"rootfs_subject"`
	BuildLockDigest     canonical.Digest   `json:"build_lock_digest"`
	Platform            blueprint.Platform `json:"platform"`
	RuntimePolicyDigest canonical.Digest   `json:"runtime_policy_digest"`
}

func CandidateGenerationFromBuildLock 

func CandidateGenerationFromBuildLock(
	pending PendingBuildV1,
	lock BuildLockV1,
	validateProfileOwner providers.RequirementProfileOwnerValidator,
) (EnvironmentGenerationState, error)

type ImageDescriptor 

type ImageDescriptor struct {
	Schema             string             `json:"schema"`
	Platform           blueprint.Platform `json:"platform"`
	AuthorReference    string             `json:"author_reference"`
	ImmutableReference string             `json:"immutable_reference"`
	ManifestDigest     canonical.Digest   `json:"manifest_digest"`
	ConfigDigest       canonical.Digest   `json:"config_digest"`
	RootFSDiffIDs      []canonical.Digest `json:"rootfs_diff_ids"`
}

func (ImageDescriptor) Validate 

func (descriptor ImageDescriptor) Validate() error

type InstallationPortBindingV1 

type InstallationPortBindingV1 struct {
	Name          string `json:"name"`
	HostBind      string `json:"host_bind"`
	HostPort      string `json:"host_port"`
	ContainerPort string `json:"container_port"`
}

type InstallationStateV1 

type InstallationStateV1 struct {
	Schema         string                      `json:"schema"`
	Status         string                      `json:"status"`
	TargetDir      string                      `json:"target_dir"`
	Scope          string                      `json:"scope"`
	Service        string                      `json:"service"`
	UnitPath       string                      `json:"unit_path"`
	InstanceID     string                      `json:"instance_id"`
	ComposeProject string                      `json:"compose_project"`
	ContainerName  string                      `json:"container_name"`
	NetworkName    string                      `json:"network_name"`
	Ports          []InstallationPortBindingV1 `json:"ports"`
}

type LegacyComponentsStagingRecoveryV1 

type LegacyComponentsStagingRecoveryV1 struct {
	State               StateV1
	PreviousCurrent     *EnvironmentGenerationState
	PreviousEnvironment string
	// contains filtered or unexported fields
}

LegacyComponentsStagingRecoveryV1 is a recovery intent prepared from one exact legacy state snapshot. State is the source-authoritative, unbuilt replacement. PreviousCurrent and PreviousEnvironment identify only the superseded Docker generation whose cleanup must be coordinated around publication; it must never remain selected by the recovered state.

type LiveRunContainerCleanupV1 

type LiveRunContainerCleanupV1 struct {
	Container string                  `json:"container"`
	RunID     string                  `json:"run_id"`
	Kind      LiveRunKindV1           `json:"kind"`
	Name      string                  `json:"name"`
	Reason    LiveRunRecoveryReasonV1 `json:"reason"`
}

type LiveRunKindV1 

type LiveRunKindV1 string
const (
	LiveRunKindAppV1     LiveRunKindV1 = "app"
	LiveRunKindShellV1   LiveRunKindV1 = "shell"
	LiveRunKindControlV1 LiveRunKindV1 = "control"
)

type LiveRunQueueV1 

type LiveRunQueueV1 struct {
	Schema             string                         `json:"schema"`
	Runs               []LiveRunV1                    `json:"runs"`
	ControlledSessions []ControlledSessionOwnershipV1 `json:"controlled_sessions,omitempty"`
	Cleanup            []LiveRunContainerCleanupV1    `json:"cleanup,omitempty"`
}

func ActivateReadyLiveRunV1 

func ActivateReadyLiveRunV1(queue LiveRunQueueV1, id string) (LiveRunQueueV1, error)

func DecodeLiveRunQueueV1 

func DecodeLiveRunQueueV1(content []byte) (LiveRunQueueV1, error)

func NewLiveRunQueueV1 

func NewLiveRunQueueV1() LiveRunQueueV1

func RemoveControlMarkerV1 

func RemoveControlMarkerV1(queue LiveRunQueueV1, id string) (LiveRunQueueV1, bool, error)

func RemoveLiveRunV1 

func RemoveLiveRunV1(queue LiveRunQueueV1, id string) (LiveRunQueueV1, bool, error)

type LiveRunRecoveryReasonV1 

type LiveRunRecoveryReasonV1 string
const (
	LiveRunRecoveryAbandonedOwnerV1 LiveRunRecoveryReasonV1 = "abandoned-owner"
	LiveRunRecoveryPriorSessionV1   LiveRunRecoveryReasonV1 = "prior-session"
	LiveRunRecoveryLegacyEntryV1    LiveRunRecoveryReasonV1 = "legacy-entry"
	LiveRunRecoveryCleanupFailedV1  LiveRunRecoveryReasonV1 = "cleanup-failed"
)

type LiveRunRecoveryV1 

type LiveRunRecoveryV1 struct {
	Removed            []RecoveredLiveRunV1
	ControlledSessions []ControlledSessionOwnershipV1
}

type LiveRunStatusV1 

type LiveRunStatusV1 string
const (
	LiveRunStatusActiveV1  LiveRunStatusV1 = "active"
	LiveRunStatusWaitingV1 LiveRunStatusV1 = "waiting"
	LiveRunStatusReadyV1   LiveRunStatusV1 = "ready"
)

type LiveRunV1 

type LiveRunV1 struct {
	ID                  string          `json:"id"`
	Kind                LiveRunKindV1   `json:"kind"`
	Name                string          `json:"name"`
	GenerationReference string          `json:"generation_reference"`
	BootSession         string          `json:"boot_session,omitempty"`
	Status              LiveRunStatusV1 `json:"status"`
	Exclusive           bool            `json:"exclusive"`
	WritableMount       string          `json:"writable_mount,omitempty"`
	WritablePaths       []string        `json:"writable_paths,omitempty"`
	Container           string          `json:"container,omitempty"`
}

type LoadedBlueprint 

type LoadedBlueprint struct {
	Document         blueprint.Document
	Ref              PackRef
	RequestedRef     PackRef
	ResolvedArtifact *ResolvedPackArtifact
	ManifestPath     string
	BlueprintSource  string
}

func LoadBlueprint 

func LoadBlueprint(ref PackRef) (LoadedBlueprint, error)

LoadBlueprint resolves and validates one environment blueprint. It does not project the document through the removed app/install/bundle schema.

type NodeLockV1 

type NodeLockV1 struct {
	NodeID               providers.NodeID                        `json:"node_id"`
	Provider             blueprint.ComponentType                 `json:"provider"`
	PlanDigest           canonical.Digest                        `json:"plan_digest"`
	ResolverCacheKey     canonical.Digest                        `json:"resolver_cache_key"`
	RequirementProfile   providers.RequirementProfile            `json:"requirement_profile"`
	ValidationEvidence   providers.ValidationEvidence            `json:"validation_evidence"`
	BundleManifest       providerstore.StoreObjectRef            `json:"bundle_manifest"`
	TransactionDigest    canonical.Digest                        `json:"transaction_digest"`
	Upstream             providers.RealizedImageV1               `json:"upstream"`
	Result               providers.RealizedImageV1               `json:"result"`
	GeneratedExecutables []providers.RealizedGeneratedExecutable `json:"generated_executables"`
	Outputs              []providers.RealizedOutput              `json:"outputs"`
}

type OperationLock 

type OperationLock struct {
	// contains filtered or unexported fields
}

OperationLock holds the kernel advisory lock for one deployment directory. The lock-file path is stable, but file existence never indicates ownership.

func AcquireExistingOperationLock 

func AcquireExistingOperationLock(ctx context.Context, deploymentDir string) (*OperationLock, error)

AcquireExistingOperationLock acquires an already-initialized deployment's operation lock without creating the state directory or lock file. Read-only diagnostics use it so a missing or malformed deployment is never changed by inspection.

func AcquireOperationLock 

func AcquireOperationLock(ctx context.Context, deploymentDir string) (*OperationLock, error)

AcquireOperationLock acquires the deployment's exclusive advisory operation lock and keeps its descriptor open until Unlock. Waiting is bounded only by caller cancellation.

func (*OperationLock) AcknowledgeControlledSessionIncidentReceiptV1 

func (lock *OperationLock) AcknowledgeControlledSessionIncidentReceiptV1(liveRunID string) (bool, error)

func (*OperationLock) AcquireControlLeaseV1 

func (lock *OperationLock) AcquireControlLeaseV1(id string) (*ControlLeaseV1, error)

AcquireControlLeaseV1 creates and holds the ownership lease for a control marker. The deployment operation lock prevents marker/lease publication from racing queue recovery.

func (*OperationLock) AcquireLiveRunLeaseV1 

func (lock *OperationLock) AcquireLiveRunLeaseV1(id string) (*QueueEntryLeaseV1, error)

AcquireLiveRunLeaseV1 holds ownership of an app or shell queue entry.

func (*OperationLock) ActivateReadyControlMarkerV1 

func (lock *OperationLock) ActivateReadyControlMarkerV1(id string) error

func (*OperationLock) ActivateReadyLiveRunV1 

func (lock *OperationLock) ActivateReadyLiveRunV1(id string) error

func (*OperationLock) AdmitControlMarkerV1 

func (lock *OperationLock) AdmitControlMarkerV1(candidate ControlMarkerV1, wait bool) (LiveRunStatusV1, error)

func (*OperationLock) AdmitLiveRunV1 

func (lock *OperationLock) AdmitLiveRunV1(candidate LiveRunV1, wait bool) (LiveRunStatusV1, error)

func (*OperationLock) AdvancePendingBuildPhase 

func (lock *OperationLock) AdvancePendingBuildPhase(next string) error

func (*OperationLock) BeginTerminalRemovalV1 

func (lock *OperationLock) BeginTerminalRemovalV1(expected StateV1) error

BeginTerminalRemovalV1 closes ordinary admission only after publication recovery. An uncertain write grants no retirement permission in this attempt.

func (*OperationLock) CancelWaitingLiveRunsV1 

func (lock *OperationLock) CancelWaitingLiveRunsV1() (LiveRunQueueV1, []LiveRunV1, error)

func (*OperationLock) ClearInstallationStateV1 

func (lock *OperationLock) ClearInstallationStateV1(expected InstallationStateV1) (StateV1, bool, error)

ClearInstallationStateV1 removes the exact recorded installation facts after host uninstall succeeds, returning the deployment to staged state without changing its current build.

func (*OperationLock) CommitInstalledStateV1 

func (lock *OperationLock) CommitInstalledStateV1(
	expected *EnvironmentGenerationState,
	sourceState StateV1,
	destinationGeneration EnvironmentGenerationState,
	installation InstallationStateV1,
) (StateV1, bool, error)

CommitInstalledStateV1 is the destination state commit point for install. Artifact transfer, image-reference creation, and host-file candidate preparation must succeed first. The caller commits status configuring before replacing live host configuration, then uses MarkInstallationReadyV1.

func (*OperationLock) CommitLegacyComponentsStagingRecoveryV1 

func (lock *OperationLock) CommitLegacyComponentsStagingRecoveryV1(
	recovery LegacyComponentsStagingRecoveryV1,
) error

CommitLegacyComponentsStagingRecoveryV1 atomically publishes a prepared recovery only if the exact incompatible state snapshot is still present.

func (*OperationLock) CommitLiveRunQueueV1 

func (lock *OperationLock) CommitLiveRunQueueV1(queue LiveRunQueueV1) error

func (*OperationLock) CommitPackageOverridesV1 

func (lock *OperationLock) CommitPackageOverridesV1(overrides PackageOverridesV1) error

CommitPackageOverridesV1 atomically replaces the sidecar while the deployment operation lock is held.

func (*OperationLock) CommitStateV1 

func (lock *OperationLock) CommitStateV1(expected *EnvironmentGenerationState, state StateV1) error

CommitStateV1 atomically replaces state only if its current generation still matches the caller's locked observation. The operation lock is the primary serialization boundary; the comparison also makes publication intent explicit and testable.

func (*OperationLock) CommitValidatedBuildV1 

func (lock *OperationLock) CommitValidatedBuildV1(record ValidatedBuildV1) error

func (*OperationLock) CompleteControlledSessionV1 

func (lock *OperationLock) CompleteControlledSessionV1(id string) (bool, error)

CompleteControlledSessionV1 atomically removes a verified-clean session's ownership record and admitted run. Failed cleanup must not call this method.

func (*OperationLock) CompleteLiveRunContainerCleanupV1 

func (lock *OperationLock) CompleteLiveRunContainerCleanupV1(container string) (bool, error)

func (*OperationLock) CompleteLiveRunWithContainerCleanupV1 

func (lock *OperationLock) CompleteLiveRunWithContainerCleanupV1(id string, container string) (bool, error)

CompleteLiveRunWithContainerCleanupV1 atomically removes a completed live run while retaining its exact container identity for a later cleanup retry.

func (*OperationLock) IsolateOriginalDirectory 

func (lock *OperationLock) IsolateOriginalDirectory(destination string) (bool, error)

IsolateOriginalDirectory moves this lock's original deployment directory to an unoccupied sibling path. The caller must first bind terminal removal and finish retiring every owner. This primitive does not retire or erase anything.

On Unix the operation lock remains held until the caller unlocks it. Windows captures the original directory before releasing the child-file lock, then renames that captured object. A true result means the directory moved, even if closing a Windows handle subsequently failed; retry must use that location.

func (*OperationLock) MarkInstallationReadyV1 

func (lock *OperationLock) MarkInstallationReadyV1(ready InstallationStateV1) (StateV1, bool, error)

MarkInstallationReadyV1 completes the only supported installation-state transition. The ready record must describe the exact configuring install; changing any other installation fact requires a new install publication.

func (*OperationLock) Path 

func (lock *OperationLock) Path() string

Path returns the stable lock-file path for diagnostics and tests. It does not reveal whether another process owns the advisory lock.

func (*OperationLock) PrepareControlledSessionIncidentReceiptV1 

func (lock *OperationLock) PrepareControlledSessionIncidentReceiptV1(channelDirectory string, liveRunID string) (*ControlledSessionIncidentReceiptTargetV1, error)

PrepareControlledSessionIncidentReceiptV1 pre-creates the exact private watchdog write target while the deployment operation lock is held. The inherited descriptor keeps an advisory lock on that exact target until both the parent and watchdog close it, so recovery cannot unlink the file while a surviving watchdog can still write. Existing completed receipts are never overwritten or silently evicted.

func (*OperationLock) PrepareLegacyComponentsStagingRecoveryV1 

func (lock *OperationLock) PrepareLegacyComponentsStagingRecoveryV1(
	selectPlatform DesiredPlatformSelector,
	validatePackage PackageRequestValidator,
	preserveSelectedPlatform bool,
) (LegacyComponentsStagingRecoveryV1, error)

PrepareLegacyComponentsStagingRecoveryV1 converts only the recognized unreleased components-based staging shape. It preserves Reploy-managed user intent, but deliberately clears the selected build generation. The caller must stop and clean any PreviousCurrent resources before committing the prepared replacement.

func (*OperationLock) PublishBuildLock 

func (lock *OperationLock) PublishBuildLock(record BuildLockV1, validateProfileOwner providers.RequirementProfileOwnerValidator) (canonical.Digest, error)

func (*OperationLock) ReadBuildLock 

func (lock *OperationLock) ReadBuildLock(digest canonical.Digest, validateProfileOwner providers.RequirementProfileOwnerValidator) (BuildLockV1, bool, error)

func (*OperationLock) ReadControlledSessionIncidentReceiptsV1 

func (lock *OperationLock) ReadControlledSessionIncidentReceiptsV1() ([]ControlledSessionIncidentReceiptV1, error)

func (*OperationLock) ReadLiveRunQueueV1 

func (lock *OperationLock) ReadLiveRunQueueV1() (LiveRunQueueV1, bool, error)

func (*OperationLock) ReadPendingBuild 

func (lock *OperationLock) ReadPendingBuild() (PendingBuildV1, bool, error)

func (*OperationLock) ReadPendingValidatedBuildV1 

func (lock *OperationLock) ReadPendingValidatedBuildV1() (PendingValidatedBuildV1, bool, error)

func (*OperationLock) ReadStateV1 

func (lock *OperationLock) ReadStateV1() (StateV1, bool, error)

func (*OperationLock) ReadValidatedBuildV1 

func (lock *OperationLock) ReadValidatedBuildV1() (ValidatedBuildV1, bool, error)

func (*OperationLock) RecordControlledSessionOwnershipV1 

func (lock *OperationLock) RecordControlledSessionOwnershipV1(ownership ControlledSessionOwnershipV1) (ControlledSessionOwnershipV1, error)

RecordControlledSessionOwnershipV1 durably binds the planned resources to an active admitted shell and monotonically fills each exact network and container ID after Docker returns it. The boot identity comes from the admitted run already protected by this lock.

func (*OperationLock) RecordLiveRunContainerV1 

func (lock *OperationLock) RecordLiveRunContainerV1(id string, container string) error

func (*OperationLock) RecoverAbandonedControlMarkerV1 

func (lock *OperationLock) RecoverAbandonedControlMarkerV1() (ControlMarkerV1, bool, error)

RecoverAbandonedControlMarkerV1 removes lifecycle queue entries whose owner no longer holds its kernel-backed lease. It is valid while the deployment operation lock is held and recovers waiting, ready, and active entries.

func (*OperationLock) RecoverLiveRunQueueV1 

func (lock *OperationLock) RecoverLiveRunQueueV1() (LiveRunRecoveryV1, error)

RecoverLiveRunQueueV1 removes entries that cannot belong to a live owner in the current host boot session. It never replays work. Ordinary container identities move into non-scheduling cleanup inventory; controlled-session ownership remains durable and is returned for verified cleanup and retry.

func (*OperationLock) RemoveAllBuildLocks 

func (lock *OperationLock) RemoveAllBuildLocks(validateProfileOwner providers.RequirementProfileOwnerValidator) error

func (*OperationLock) RemoveAllBuildObjects 

func (lock *OperationLock) RemoveAllBuildObjects(store providerstore.Store) error

func (*OperationLock) RemoveBuildLock 

func (lock *OperationLock) RemoveBuildLock(digest canonical.Digest, validateProfileOwner providers.RequirementProfileOwnerValidator) error

func (*OperationLock) RemoveBuildLocksExcept 

func (lock *OperationLock) RemoveBuildLocksExcept(keep []canonical.Digest, validateProfileOwner providers.RequirementProfileOwnerValidator) error

RemoveBuildLocksExcept removes every verified build lock except the selected roots. An empty root set removes all locks.

func (*OperationLock) RemoveControlMarkerV1 

func (lock *OperationLock) RemoveControlMarkerV1(id string) (LiveRunQueueV1, bool, error)

func (*OperationLock) RemoveLiveRunV1 

func (lock *OperationLock) RemoveLiveRunV1(id string) (LiveRunQueueV1, bool, error)

func (*OperationLock) RemoveOtherBuildLocks 

func (lock *OperationLock) RemoveOtherBuildLocks(current canonical.Digest, validateProfileOwner providers.RequirementProfileOwnerValidator) error

func (*OperationLock) RemovePendingBuild 

func (lock *OperationLock) RemovePendingBuild() error

func (*OperationLock) RemovePendingValidatedBuildV1 

func (lock *OperationLock) RemovePendingValidatedBuildV1() error

func (*OperationLock) RemoveProviderStore 

func (lock *OperationLock) RemoveProviderStore(store providerstore.Store) (bool, error)

RemoveProviderStore deletes the complete deployment-owned provider cache while retaining state, build locks, and the operation lock itself.

func (*OperationLock) RemoveUnreachableBuildObjects 

func (lock *OperationLock) RemoveUnreachableBuildObjects(
	store providerstore.Store,
	build BuildLockV1,
	validateProfileOwner providers.RequirementProfileOwnerValidator,
	validateBundleOwner providers.ResolvedBundleOwnerValidator,
) error

func (*OperationLock) RemoveUnreachableBuildObjectsForBuilds 

func (lock *OperationLock) RemoveUnreachableBuildObjectsForBuilds(
	store providerstore.Store,
	builds []BuildLockV1,
	validateProfileOwner providers.RequirementProfileOwnerValidator,
	validateBundleOwner providers.ResolvedBundleOwnerValidator,
) error

RemoveUnreachableBuildObjectsForBuilds retains the union of the selected build closures. An empty root set removes every provider-store object.

func (*OperationLock) RemoveValidatedBuildV1 

func (lock *OperationLock) RemoveValidatedBuildV1() error

func (*OperationLock) RequireHeld 

func (lock *OperationLock) RequireHeld() error

RequireHeld fails when the operation lock has not been acquired or has already been released, or its original directory or lock file was replaced.

func (*OperationLock) RequireQueueEntryLeaseHeldV1 

func (lock *OperationLock) RequireQueueEntryLeaseHeldV1(id string) error

RequireQueueEntryLeaseHeldV1 verifies that an admission owner acquired the entry lease before publishing its durable queue record.

func (*OperationLock) RequireRetirement 

func (lock *OperationLock) RequireRetirement() error

RequireRetirement permits existing cleanup operations under unguarded authority or an explicit continuation of the exact retained terminal state.

func (*OperationLock) RequireWritable 

func (lock *OperationLock) RequireWritable() error

RequireWritable rejects terminal authority even for a caller-held diagnostic lock or a lock explicitly bound to removal. New ownership is never retirement.

func (*OperationLock) ResumeTerminalRemovalV1 

func (lock *OperationLock) ResumeTerminalRemovalV1(expected StateV1) error

ResumeTerminalRemovalV1 is explicit removal retry, never ordinary admission. It rereads exact retained state and confirms its directory durability before permitting cleanup; callers validate retained owner inventories separately.

func (*OperationLock) SetInstallationStateV1 

func (lock *OperationLock) SetInstallationStateV1(installation InstallationStateV1) (StateV1, bool, error)

SetInstallationStateV1 records where the current built environment was installed. The caller retains the deployment operation lock across any filesystem, service, image-reference, and provider-store work that precedes this final state publication.

func (*OperationLock) TransferBuildLockStoreClosure 

func (sourceLock *OperationLock) TransferBuildLockStoreClosure(
	ctx context.Context,
	destinationLock *OperationLock,
	sourceStore providerstore.Store,
	destinationStore providerstore.Store,
	build BuildLockV1,
	validateProfileOwner providers.RequirementProfileOwnerValidator,
	validateBundleOwner providers.ResolvedBundleOwnerValidator,
) ([]providerstore.StoreObjectRef, error)

TransferBuildLockStoreClosure copies exactly one build lock's verified provider-store closure between two locked deployments. Callers acquire the source operation lock before the destination lock and retain both until the installed state commit that follows this transfer.

func (*OperationLock) Unlock 

func (lock *OperationLock) Unlock() error

Unlock releases the kernel lock and closes its descriptor. Repeated calls are harmless so cleanup paths can defer it safely.

func (*OperationLock) ValidateProviderStore 

func (lock *OperationLock) ValidateProviderStore(store providerstore.Store) error

func (*OperationLock) WritePendingBuild 

func (lock *OperationLock) WritePendingBuild(record PendingBuildV1) error

func (*OperationLock) WritePendingValidatedBuildV1 

func (lock *OperationLock) WritePendingValidatedBuildV1(intent PendingValidatedBuildV1) error

type OwnedImageReferenceV1 

type OwnedImageReferenceV1 struct {
	Reference string                    `json:"reference"`
	Image     providers.RealizedImageV1 `json:"image"`
}

OwnedImageReferenceV1 retains exact image identity and one owner reference.

type PackRef 

type PackRef struct {
	Raw      string     `json:"raw"`
	Scheme   string     `json:"scheme"`
	Source   string     `json:"source"`
	Subdir   string     `json:"subdir,omitempty"`
	Query    url.Values `json:"query,omitempty"`
	IsPinned bool       `json:"is_pinned"`
}

func ParsePackRef 

func ParsePackRef(raw string) (PackRef, error)

type PackageAdditionIntentV1 

type PackageAdditionIntentV1 struct {
	Provider    string `json:"provider"`
	Requirement string `json:"requirement"`
}

type PackageOverrideChoiceV1 

type PackageOverrideChoiceV1 struct {
	Path    string   `yaml:"path,omitempty"`
	Version string   `yaml:"version,omitempty"`
	Exclude []string `yaml:"exclude,omitempty"`
}

PackageOverrideChoiceV1 selects exactly one local source or exact upstream version. A mapping never requests installation by itself.

func (PackageOverrideChoiceV1) Empty 

func (choice PackageOverrideChoiceV1) Empty() bool

type PackageOverrideIntentChoiceV1 

type PackageOverrideIntentChoiceV1 struct {
	Provider string   `json:"provider"`
	Package  string   `json:"package"`
	Kind     string   `json:"kind"`
	Version  string   `json:"version"`
	Exclude  []string `json:"exclude,omitempty"`
}

type PackageOverrideIntentV1 

type PackageOverrideIntentV1 struct {
	Schema        string                          `json:"schema"`
	EnvironmentID string                          `json:"environment_id"`
	Additions     []PackageAdditionIntentV1       `json:"additions,omitempty"`
	Choices       []PackageOverrideIntentChoiceV1 `json:"choices"`
}

PackageOverrideIntentV1 is the path-free build input retained in the lock. Local paths are deliberately represented only as kind=local; selected content is bound separately by source-input, retained source-artifact, build-environment, and output-artifact digests.

func EmptyPackageOverrideIntentV1 

func EmptyPackageOverrideIntentV1(environmentID string) PackageOverrideIntentV1

func (PackageOverrideIntentV1) AdditionsForProvider 

func (intent PackageOverrideIntentV1) AdditionsForProvider(provider string) []PackageAdditionIntentV1

func (PackageOverrideIntentV1) ChoicesForProvider 

func (intent PackageOverrideIntentV1) ChoicesForProvider(provider string) []PackageOverrideIntentChoiceV1

type PackageOverridesEnvironmentV1 

type PackageOverridesEnvironmentV1 struct {
	ID               string                                        `yaml:"id"`
	Vars             map[string]any                                `yaml:"vars,omitempty"`
	Base             *BaseImageOverrideV1                          `yaml:"base,omitempty"`
	PackageAdditions map[string][]string                           `yaml:"package_additions,omitempty"`
	PackageOverrides map[string]map[string]PackageOverrideChoiceV1 `yaml:"package_overrides"`
}

type PackageOverridesV1 

type PackageOverridesV1 struct {
	Environment PackageOverridesEnvironmentV1 `yaml:"environment"`
}

PackageOverridesV1 is the explicit, staging-only developer intent stored beside a staged deployment. It is not part of the published blueprint.

func DecodePackageOverridesV1 

func DecodePackageOverridesV1(content []byte) (PackageOverridesV1, error)

DecodePackageOverridesV1 strictly decodes one YAML document. Provider-owned package identities are normalized later, when the provider is known.

func EmptyPackageOverridesV1 

func EmptyPackageOverridesV1(environmentID string) PackageOverridesV1

func ReadPackageOverridesV1 

func ReadPackageOverridesV1(deploymentDir string) (PackageOverridesV1, bool, error)

ReadPackageOverridesV1 reads one complete sidecar snapshot. Missing files are normal and do not create any deployment state.

type PackageRequestParser 

type PackageRequestParser func(blueprint.ComponentType, string) (providers.CanonicalPackageRequest, error)

type PackageRequestValidator 

type PackageRequestValidator func(blueprint.ComponentType, providers.CanonicalPackageRequest) error

PackageRequestValidator is supplied by the provider registry. It binds the target contribution type to an exact provider-owned package schema and value.

type PendingBuildLockLoader 

type PendingBuildLockLoader func(canonical.Digest) (BuildLockV1, error)

type PendingBuildV1 

type PendingBuildV1 struct {
	Schema    string                      `json:"schema"`
	Phase     string                      `json:"phase"`
	Old       *EnvironmentGenerationState `json:"old"`
	Candidate PendingCandidateV1          `json:"candidate"`
	Cleanup   []CleanupItemV1             `json:"cleanup"`
	// OldReferences survives pruning the retired owner's build lock.
	OldReferences []OwnedImageReferenceV1 `json:"old_references,omitempty"`
}

func DecodePendingBuild 

func DecodePendingBuild(content []byte) (PendingBuildV1, error)

type PendingCandidateV1 

type PendingCandidateV1 struct {
	TemporaryReference  string                         `json:"temporary_reference"`
	GenerationReference string                         `json:"generation_reference"`
	Image               providers.RealizedImageV1      `json:"image"`
	BuildLockDigest     canonical.Digest               `json:"build_lock_digest"`
	StoreObjects        []providerstore.StoreObjectRef `json:"store_objects"`
	// Owner and Companion are present together only for a portable candidate.
	Owner     *EnvironmentGenerationState `json:"owner,omitempty"`
	Companion *OwnedImageReferenceV1      `json:"companion,omitempty"`
}

type PendingRecoveryDecision 

type PendingRecoveryDecision string
const (
	PendingRecoveryDiscardCandidate PendingRecoveryDecision = "discard-candidate"
	PendingRecoveryKeepCandidate    PendingRecoveryDecision = "keep-candidate"
	PendingRecoveryStateConflict    PendingRecoveryDecision = "state-conflict"
)

func DecidePendingRecovery 

func DecidePendingRecovery(
	current *EnvironmentGenerationState,
	pending PendingBuildV1,
	candidate EnvironmentGenerationState,
) (PendingRecoveryDecision, error)

type PendingValidatedBuildV1 

type PendingValidatedBuildV1 struct {
	Schema    string            `json:"schema"`
	Previous  *ValidatedBuildV1 `json:"previous"`
	Candidate ValidatedBuildV1  `json:"candidate"`
}

The committed validated record selects previous or candidate ownership. This intent is durable before either candidate reference is created.

func DecodePendingValidatedBuildV1 

func DecodePendingValidatedBuildV1(content []byte) (PendingValidatedBuildV1, error)

type PortableRuntimeLayerV1 

type PortableRuntimeLayerV1 struct {
	Schema            string                    `json:"schema"`
	Upstream          providers.RealizedImageV1 `json:"upstream"`
	Result            providers.RealizedImageV1 `json:"result"`
	TransactionDigest canonical.Digest          `json:"transaction_digest"`
}

PortableRuntimeLayerV1 connects the provider graph to an intervening application layer containing selected payloads or runtime environment. The portable lock supplies the exact byte and configuration authority.

type PrefixValidationV1 

type PrefixValidationV1 struct {
	Schema         string                         `json:"schema"`
	SubjectRootFS  canonical.Digest               `json:"subject_rootfs"`
	Profiles       []providers.ValidationEvidence `json:"profiles"`
	RuntimePolicy  canonical.Digest               `json:"runtime_policy"`
	ExposedOutputs []providers.ExecutableEvidence `json:"exposed_outputs"`
}

func DecodePrefixValidation 

func DecodePrefixValidation(content []byte, reference providerstore.StoreObjectRef) (PrefixValidationV1, error)

func LoadPrefixValidation 

func LoadPrefixValidation(store providerstore.Store, reference providerstore.StoreObjectRef) (PrefixValidationV1, error)

type ProtectedPathV1 

type ProtectedPathV1 struct {
	Path  string `json:"path"`
	Kind  string `json:"kind"`
	Owner string `json:"owner"`
}

type ProviderGraphLockV1 

type ProviderGraphLockV1 struct {
	Nodes []providers.NodeID         `json:"nodes"`
	Edges []providers.ProviderEdgeV1 `json:"edges"`
}

type QualifiedOption 

type QualifiedOption struct {
	Application string `json:"application"`
	Option      string `json:"option"`
}

func ParseQualifiedOptionGroups 

func ParseQualifiedOptionGroups(arguments []string) ([]QualifiedOption, error)

ParseQualifiedOptionGroups parses APPLICATION/OPTION[,OPTION...] arguments into sorted, duplicate-free overlay entries.

type QueueEntryLeaseV1 

type QueueEntryLeaseV1 struct {
	// contains filtered or unexported fields
}

QueueEntryLeaseV1 proves that the process which queued an operation is still alive. The kernel releases the advisory lock if that process exits, even when it cannot run normal cleanup.

func (*QueueEntryLeaseV1) Close 

func (lease *QueueEntryLeaseV1) Close() error

Close releases the kernel lease while preserving its file. Terminal removal uses it to retain the original admission files after incomplete retirement.

func (*QueueEntryLeaseV1) Release 

func (lease *QueueEntryLeaseV1) Release() error

Release drops the ownership lease and removes its deployment-local file. Repeated calls are harmless so error cleanup can use it freely.

type RecoveredLiveRunV1 

type RecoveredLiveRunV1 struct {
	Run    LiveRunV1
	Reason LiveRunRecoveryReasonV1
}

type RequestOverlayMutation 

type RequestOverlayMutation func(blueprint.Document, RequestOverlayV1) (RequestOverlayV1, error)

type RequestOverlayMutationResult 

type RequestOverlayMutationResult struct {
	Overlay RequestOverlayV1
	Digest  canonical.Digest
	Changed bool
}

func MutateRequestOverlayV1 

func MutateRequestOverlayV1(
	ctx context.Context,
	deploymentDir string,
	validatePackage PackageRequestValidator,
	mutate RequestOverlayMutation,
) (result RequestOverlayMutationResult, err error)

MutateRequestOverlayV1 performs one complete directory-scoped state transaction. It never resolves packages, prepares a bundle, or builds an image. A changed desired overlay retains the current generation, which then fails exact reuse as stale until an explicit build publishes its replacement.

type RequestOverlayV1 

type RequestOverlayV1 struct {
	Schema          string                 `json:"schema"`
	SelectedOptions []QualifiedOption      `json:"selected_options"`
	DirectPackages  []DirectPackageRequest `json:"direct_packages"`
}

func AddOverlayOptions 

func AddOverlayOptions(overlay RequestOverlayV1, options []QualifiedOption) RequestOverlayV1

func AddOverlayPackages 

func AddOverlayPackages(overlay RequestOverlayV1, packages []DirectPackageRequest) RequestOverlayV1

func EmptyRequestOverlayV1 

func EmptyRequestOverlayV1() RequestOverlayV1

func NormalizeRequestOverlayV1 

func NormalizeRequestOverlayV1(document blueprint.Document, overlay RequestOverlayV1, validatePackage PackageRequestValidator) (RequestOverlayV1, error)

NormalizeRequestOverlayV1 validates deployment intent against the resolved blueprint, removes exact duplicates, and returns the sole canonical order.

func RemoveOverlayOptions 

func RemoveOverlayOptions(overlay RequestOverlayV1, options []QualifiedOption) (RequestOverlayV1, error)

func RemoveOverlayPackages 

func RemoveOverlayPackages(overlay RequestOverlayV1, packages []DirectPackageRequest) (RequestOverlayV1, error)

type ResolvedPackArtifact 

type ResolvedPackArtifact struct {
	Scheme        string `json:"scheme"`
	Package       string `json:"package,omitempty"`
	Version       string `json:"version,omitempty"`
	Filename      string `json:"filename,omitempty"`
	SHA256        string `json:"sha256,omitempty"`
	Subdir        string `json:"subdir,omitempty"`
	CachePath     string `json:"cache_path,omitempty"`
	BlueprintPath string `json:"blueprint_path,omitempty"`
}

type ResolvedPackageOverrideChoiceV1 

type ResolvedPackageOverrideChoiceV1 struct {
	Path    string
	Version string
	Exclude []string
}

type ResolvedPackageOverridesV1 

type ResolvedPackageOverridesV1 struct {
	EnvironmentID string
	Additions     map[string][]string
	Providers     map[string]map[string]ResolvedPackageOverrideChoiceV1
}

ResolvedPackageOverridesV1 contains interpolated, normalized lookup keys and lexical absolute local paths. Resolving it performs no filesystem access so unused mappings remain completely unobserved.

func ResolvePackageOverridesV1 

func ResolvePackageOverridesV1(
	overrides PackageOverridesV1,
	sidecarDir string,
	normalizePackage func(provider string, packageID string, choice PackageOverrideChoiceV1) (string, error),
) (ResolvedPackageOverridesV1, error)

ResolvePackageOverridesV1 interpolates sidecar variables and creates stable provider/package lookup maps. normalizePackage owns ecosystem-specific package-name canonicalization and supported-choice validation.

func (ResolvedPackageOverridesV1) Intent 

func (overrides ResolvedPackageOverridesV1) Intent() (PackageOverrideIntentV1, error)

type RuntimeMountV1 

type RuntimeMountV1 struct {
	Destination string `json:"destination"`
	SourceKind  string `json:"source_kind"`
	ReadOnly    bool   `json:"read_only"`
}

type RuntimePlanV1 

type RuntimePlanV1 struct {
	ID          string                      `json:"id"`
	InboundTCP  []string                    `json:"inbound_tcp"`
	Mounts      []RuntimeMountV1            `json:"mounts"`
	Executables []providers.QualifiedOutput `json:"executables"`
}

type RuntimePolicyV1 

type RuntimePolicyV1 struct {
	Schema          string                       `json:"schema"`
	StartupVerifier ApplicationStartupVerifierV1 `json:"startup_verifier"`
	Network         blueprint.RuntimeNetwork     `json:"network"`
	ProtectedPaths  []ProtectedPathV1            `json:"protected_paths"`
	Plans           []RuntimePlanV1              `json:"plans"`
}

type StagingStateV1 

type StagingStateV1 struct {
	Schema string `json:"schema"`
}

StagingStateV1 marks a deployment as staged. Staging-only package overrides live in the private sidecar rather than deployment state.

type StateV1 

type StateV1 struct {
	Schema          string                       `json:"schema"`
	Blueprint       blueprint.ResolvedDocumentV1 `json:"blueprint"`
	BlueprintSource string                       `json:"blueprint_source"`
	Platform        blueprint.Platform           `json:"platform"`
	Overlay         RequestOverlayV1             `json:"overlay"`
	Current         *EnvironmentGenerationState  `json:"current"`
	Staging         *StagingStateV1              `json:"staging"`
	Deployment      *DeploymentStateV1           `json:"deployment"`
	TerminalRemoval bool                         `json:"terminal_removal,omitempty"`
}

func DecodeStateV1 

func DecodeStateV1(content []byte) (StateV1, error)

type UpdateStatus 

type UpdateStatus string
const (
	UpdateStatusUpdated  UpdateStatus = "updated"
	UpdateStatusUpToDate UpdateStatus = "up_to_date"
	UpdateStatusSkipped  UpdateStatus = "skipped"
	UpdateStatusRemoved  UpdateStatus = "removed"
)

type ValidatedBuildReferenceV1 

type ValidatedBuildReferenceV1 struct {
	Image          providers.RealizedImageV1 `json:"image"`
	ImageReference string                    `json:"image_reference"`
	// A companion cleanup pair retains its generation scope after lock pruning.
	CompanionOwner *EnvironmentGenerationState `json:"companion_owner,omitempty"`
}

ValidatedBuildReferenceV1 retains enough trusted identity to remove a retired Docker reference without depending on its build lock remaining.

type ValidatedBuildV1 

type ValidatedBuildV1 struct {
	Schema                 string                      `json:"schema"`
	BlueprintDigest        canonical.Digest            `json:"blueprint_digest"`
	OverlayDigest          canonical.Digest            `json:"overlay_digest"`
	PackageOverridesDigest canonical.Digest            `json:"package_overrides_digest"`
	Platform               blueprint.Platform          `json:"platform"`
	BuildLockDigest        canonical.Digest            `json:"build_lock_digest"`
	Image                  providers.RealizedImageV1   `json:"image"`
	ImageReference         string                      `json:"image_reference"`
	PendingCleanup         []ValidatedBuildReferenceV1 `json:"pending_cleanup,omitempty"`
	// PendingStorageCleanup keeps successful validation authoritative while
	// superseded locks or provider-store objects await another cleanup attempt.
	PendingStorageCleanup bool `json:"pending_storage_cleanup,omitempty"`
	// Discarded prevents reuse before reference retirement starts. PendingCleanup
	// retains exact remaining aliases until storage cleanup can safely run.
	Discarded bool `json:"discarded,omitempty"`
	// Owner and Companion retain portable ownership without making it current.
	Owner     *EnvironmentGenerationState `json:"owner,omitempty"`
	Companion *OwnedImageReferenceV1      `json:"companion,omitempty"`
}

ValidatedBuildV1 records one opt-in trial build without making it the deployment's current generation. Every input identity is retained so an editor can report whether the currently saved choices are still validated.

func DecodeValidatedBuildV1 

func DecodeValidatedBuildV1(content []byte) (ValidatedBuildV1, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.