agent

type Agent struct {
	// contains filtered or unexported fields
}

type BootMetrics struct {
	StartedAt        time.Time `json:"started_at"`
	LockfileMs       int64     `json:"lockfile_ms"`       // step 1: acquire lockfile
	FetchMs          int64     `json:"fetch_ms"`          // step 3: parallel download
	FetchBytes       int64     `json:"fetch_bytes"`       // bytes downloaded (cache misses only)
	MountMs          int64     `json:"mount_ms"`          // step 4: OverlayFS assembly
	ConfigureMs      int64     `json:"configure_ms"`      // step 5: write env config files
	TotalMs          int64     `json:"total_ms"`          // wall time: start → ready
	LayerCount       int       `json:"layer_count"`       // layers in lockfile
	CachedLayers     int       `json:"cached_layers"`     // sqfs already in /strata/cache
	DownloadedLayers int       `json:"downloaded_layers"` // fetched from S3
}

type BundleFetcher interface {
	FetchBundleJSON(ctx context.Context, layer spec.ResolvedLayer) ([]byte, error)
}

type Config struct {
	Source           LockfileSource
	Fetcher          LayerFetcher
	BundleFetcher    BundleFetcher  // optional; nil skips cosign bundle verification
	Verifier         trust.Verifier // optional; nil skips cosign bundle verification
	Signaler         ReadySignaler
	Mounter          Mounter          // optional; defaults to overlay.Mount
	PackageInstaller PackageInstaller // optional; nil skips package installation
	EnvRootDir       string           // defaults to "/" if empty

	// Warnings receives non-fatal agent diagnostics — notably the disclosure that
	// packages: entries are installed unattested (#139). Optional; nil discards.
	// cmd/strata-agent sets it to os.Stderr so the machine's boot log records that
	// the assembled environment left the attested set.
	Warnings io.Writer

	// MaxAge is the freshness bound (#224, threat T8): the agent refuses to boot a
	// lockfile resolved longer ago than this. Zero means no bound — the default,
	// so a frozen/cited environment of any age still boots and only its age is
	// surfaced. cmd/strata-agent sets it from STRATA_AGENT_MAX_AGE. The bound is
	// meaningful because resolved_at is inside the signed payload, so a replayed
	// stale-but-signed lockfile cannot be backdated past it (checked after the
	// signature verifies).
	MaxAge time.Duration

	// AllowUnverified permits booting when Verifier or BundleFetcher is nil.
	// Default false: the agent refuses to boot rather than mount layers whose
	// authenticity it cannot check (#93). Only a caller that has made the skip a
	// deliberate, logged choice sets this — cmd/strata-agent, under
	// STRATA_AGENT_ALLOW_UNVERIFIED. It has no effect when both Verifier and
	// BundleFetcher are set.
	AllowUnverified bool
}

type ExecPackageInstaller struct{}

type FakeLayerFetcher struct {
	// Paths maps layer ID to local file path.
	Paths map[string]string
	// Err, if non-nil, is returned for every Fetch call.
	Err error
}

type FakeLockfileSource struct {
	Lockfile *spec.LockFile
	Err      error
}

type FakeMounter struct {
	Result *overlay.Overlay
	Err    error
}

type FakePackageInstaller struct {
	Called     bool
	MergedPath string
	Pkgs       []spec.ResolvedPackageSet
	Err        error
}

type FakeReadySignaler struct {
	ReadyCalled  bool
	FailedCalled bool
	FailedReason error
}

type LayerFetcher interface {
	Fetch(ctx context.Context, layer spec.ResolvedLayer) (localPath string, err error)
}

type LockfileSource interface {
	Acquire(ctx context.Context) (*spec.LockFile, error)
}

type Mounter interface {
	Mount(layers []overlay.LayerPath) (*overlay.Overlay, error)
}

type PackageInstaller interface {
	Install(ctx context.Context, pkgs []spec.ResolvedPackageSet, mergedPath string) error
}

type ReadySignaler interface {
	SignalReady(ctx context.Context, lockfile *spec.LockFile) error
	SignalFailed(ctx context.Context, reason error) error
}