Documentation
¶
Overview ¶
Package capture retains declared sandbox files as restricted evidence.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Collect ¶
Collect captures only signed declarations and returns verified references. Missing required files fail capture. Partial writes may remain in protected storage on failure; reconcile their preallocated IDs under retention policy. Files, including archives and HTML, are opaque untrusted bytes. This function neither extracts archives nor grades, publishes or deploys their contents.
func ValidateRetention ¶
ValidateRetention requires an explicit host retention window of at most a day. A deployment may disable capture with zero, but cannot call Collect that way.
Types ¶
type Config ¶
type Config struct {
Root string
Repository Repository
Journal Journal
Retention time.Duration
Authorize func(context.Context, sandbox.Job) error
Check func(context.Context) error
Policy func(context.Context, sandbox.Job, evidence.Action, evidence.Ref) error
Now func() time.Time
}
Config holds host services and the retained scratch directory. Check verifies the retained workspace identity. The caller must prove all guest processes stopped before Collect and keep the workspace alive until it returns. Policy checks current artifact grants separately from job authorization.
type Journal ¶
type Journal interface {
Record(context.Context, sandbox.Job, evidence.Ref) error
Confirm(context.Context, sandbox.Job, evidence.Ref) error
}
Journal is the authenticated daemon's durable capture capability. Record commits an immutable intent before upload; Confirm commits verified readback. Both must bind the exact job and reference to its current execution claim, honor the original deadline and return success only after durable commit. A worker must never open the daemon's journal directly. An uncertain response stops capture; this port grants no retry, new identity or execution authority.
type Repository ¶
type Repository interface {
Put(context.Context, evidence.Artifact) (evidence.Ref, error)
Open(context.Context, evidence.Ref) (io.ReadCloser, error)
}
Repository is the immutable write and verified read capability of the host's evidence repository. Calls must honor context; Close must unblock readers. Capture never retries Put. An uncertain write needs reconciliation using the artifact ID already retained in the signed job, not a new execution or ID.
Source Files