peerimage

type AddrPolicy struct {
	// AllowLoopback is the exact "host:port" set permitted to resolve to a
	// loopback address. Populate it with the mesh forward listeners this
	// daemon opened, and nothing else.
	AllowLoopback map[string]struct{}

	// Resolve maps a hostname to IPs. nil → net.DefaultResolver. Injected so
	// the multi-hop tests run offline with no DNS.
	Resolve func(ctx context.Context, host string) ([]net.IP, error)
}

type Builder interface {
	Materialize(ctx context.Context, recipeBody string) error
}

type Challenge struct {
	Node   string `json:"node"`
	Ref    string `json:"ref"`
	Recipe string `json:"recipe_digest"`
	Nonce  string `json:"nonce"`
}

type CtrRuntime struct {
	// BashyBin is the resolved bashy executable.
	BashyBin string
	// BashyPath, when set, resolves the bashy executable lazily on each call
	// and takes precedence over BashyBin. The daemon wires this to its
	// self-healing resolver so constructing the service never blocks boot on
	// provisioning a missing userland — the first digest read resolves it.
	BashyPath func(ctx context.Context) (string, error)
	// Container is the <node-name>-runtime container hosting k3s containerd.
	Container string
	// Namespace is the containerd namespace; empty → k8s.io (what k3s uses
	// for images the kubelet can actually run).
	Namespace string
	// contains filtered or unexported fields
}

type DigestState string

type EnsureResult struct {
	Node          string      `json:"node"`
	Recipe        string      `json:"recipe"`
	Ref           string      `json:"ref"`
	RecipeDigest  string      `json:"recipe_digest"`
	State         DigestState `json:"state"`
	ContentDigest string      `json:"content_digest,omitempty"`
	// Built is true when this call performed the build; false means the image
	// was already resident AND its digest correlated with the provenance.
	Built bool `json:"built"`
}

type Fetcher struct {
	Policy AddrPolicy
	// Client is the underlying transport. Its CheckRedirect is overwritten —
	// this type never lets the stdlib follow a redirect on its own.
	Client *http.Client
}

type Inspector struct {
	// contains filtered or unexported fields
}

type NodeIdentity struct {
	Name string
}

type NonceFunc func() (string, error)

type PeerRef struct {
	Host     string   `json:"host"`
	PeerID   string   `json:"peer_id"`
	Services []string `json:"services,omitempty"`
}

type Provenance struct {
	// Node is the cluster node name this provenance belongs to — the node
	// NAME, never the outpost.dhnt.io/host label, which names a HOST and is
	// shared by every virtual backend that host runs.
	Node string `json:"node"`
	// Ref is the image reference the recipe builds to.
	Ref string `json:"ref"`
	// Recipe is the recipe name.
	Recipe string `json:"recipe"`
	// RecipeDigest is sha256:<hex> over the recipe's canonical form — the
	// CROSS-NODE identity. Two nodes running the same recipe agree here.
	RecipeDigest string `json:"recipe_digest"`
	// ContentDigest is the containerd content digest observed immediately
	// after the local build+load — the PER-NODE identity. Container builds
	// are not bit-reproducible, so two nodes running the same recipe are
	// expected to differ here; that is why the cross-node claim is made on
	// RecipeDigest and the local integrity claim on ContentDigest.
	ContentDigest string `json:"content_digest"`
	// BuiltAt is when the build+load completed.
	BuiltAt time.Time `json:"built_at"`
}

type Publication struct {
	Name        string    `json:"name"`
	Ref         string    `json:"ref"`
	Digest      string    `json:"recipe_digest"`
	PublishedAt time.Time `json:"published_at"`
}

type RecipeBuilder struct {
	Runner           recipebuilder.Runner
	WorkDir          string
	Platform         string
	RuntimeContainer string
}

type Report struct {
	Node   string `json:"node"`
	Ref    string `json:"ref"`
	Recipe string `json:"recipe_digest"`
	Nonce  string `json:"nonce"`

	// State is the tri-state containerd answer.
	State DigestState `json:"state"`
	// ContentDigest is what containerd says is resident RIGHT NOW.
	ContentDigest string `json:"content_digest,omitempty"`
	// ProvenanceDigest is what this node recorded when it built the ref.
	// Empty means the node cannot attribute the resident bytes to any recipe.
	ProvenanceDigest string `json:"provenance_digest,omitempty"`
	// Detail is a human note; never authoritative, never trusted.
	Detail string `json:"detail,omitempty"`
}

type ResolveResult struct {
	Service string    `json:"service"`
	Peers   []PeerRef `json:"peers"`
	// Distinct is the number of DISTINCT peer identities, which is what any
	// "reaches N peers" claim must be made from.
	Distinct int `json:"distinct"`
}

type Runtime interface {
	ResidentDigest(ctx context.Context, ref string) (DigestState, string, error)
}

type Service struct {
	// Identity names THIS node in every piece of evidence it emits.
	Identity NodeIdentity
	// Store holds published recipes + this node's build provenance.
	Store *Store
	// Runtime reads what containerd actually has.
	Runtime Runtime
	// Build materializes a recipe locally. nil → Ensure can verify but not
	// build, and says so rather than reporting success.
	Build Builder
	// Resolver returns the peers exposing a mesh service. nil → mesh-resolve
	// reports the mesh is unavailable rather than returning an empty set.
	Resolver func(service string) ([]PeerRef, error)
	// contains filtered or unexported fields
}

type Store struct {
	// contains filtered or unexported fields
}

type Summary struct {
	// Ref + RecipeDigest are the cross-node claim being proven.
	Ref          string `json:"ref"`
	RecipeDigest string `json:"recipe_digest"`
	// Asked is how many DISTINCT nodes were challenged.
	Asked int `json:"asked"`
	// Proven is how many DISTINCT nodes returned accepted evidence.
	Proven int `json:"proven"`
	// OK is true only when Proven == Asked and Asked >= the required minimum.
	OK       bool      `json:"ok"`
	Reason   string    `json:"reason,omitempty"`
	Verdicts []Verdict `json:"verdicts"`
	// Rejected records evidence the Inspector refused, with the rule that
	// refused it. Rejections are surfaced, never silently dropped.
	Rejected []Verdict `json:"rejected,omitempty"`
}

type Verdict struct {
	Node          string `json:"node"`
	OK            bool   `json:"ok"`
	Reason        string `json:"reason,omitempty"`
	ContentDigest string `json:"content_digest,omitempty"`
}