managed

package
v1.8.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 20, 2026 License: Apache-2.0 Imports: 15 Imported by: 0

README

Managed worker persistence

You can persist a physical instance's deployment obligations through managed.Store. Memory and PostgreSQL implement the capability independently of controller options. managed.ProtectionStore exposes protection without requiring worker lifecycle ports. The aggregate ordinary store interface is unchanged.

This package supplies storage contracts. It does not install service guards, call a provider, authenticate a caller or verify remote evidence. The host must authorize each operation and verify the actual runtime, artifact, provider operation and proof before submitting the typed result. Direct provider handles, SQL access and older unguarded controllers remain trusted operations outside this protection boundary.

Identity and progress

Create a target with its tenant, fresh instance TypeID, stable provision operation TypeID, provider identity, placement, project, generation and immutable manifest. Provider plus placement must identify the actual provider authority, including its account/daemon and namespace. A mutable registry alias is insufficient. The project name is permanently unique within that authority, including after tombstoning.

Claim a conditional lease before advancing the target. Every mutation checks the parent revision and lease epoch. A successful command returns an immutable receipt. Retry exactly after a lost reply. Changing the request under an accepted command ID conflicts. Receipt recovery does not issue another remote call and does not authorize reusing an old deletion or provisioning permission. Hosts must reconcile the same external operation, including delayed calls that were already permitted.

Provisioning and registration record potential issuance before a remote call. Sealing revokes permissions which were never issued and retains outstanding calls. A missing container, receipt lookup, expired lease or stopped controller cannot settle an issued operation. A trusted provision result must establish settlement of the entire creation operation, including network, service and init creation, before its exact resources are bound. Partial creation remains unresolved. This version also refuses a terminal empty provider result because it has no qualified producer contract for that disposition. That is a liveness limitation, distinct from an unknown result.

A sealed provision that was atomically revoked before issuance can close locally. The store checks that no create was authorized, no resources or issued bindings exist, and no deletion operation was allocated. It retains a no_resources_created tombstone and the exact local command receipt. Missing resources alone never qualify.

Removal checks the complete bounded obligation set under one lock. Each accepted binding needs its current opaque query fence, compatibility/retirement evidence and completed quiescent drain or a fresh accepted later observation for that exact reservation. Fence survivors must be off the target instance. The host must recheck current remote fences immediately before provider execution; a stored sample cannot make Docker deletion atomic.

Only atomic pre-issue revocation creates not_issued settlement. Other closed settlement dispositions require verified external facts for the configured verifier, operation and full fence digest. An abort also needs an original-binding proof captured at or after settlement and still valid after acquiring the store lock. Accepted abort keeps enrollment closed. Each binding's finish or abort receipt is retained independently of later desired-state changes.

A replacement allocation persists its own immutable identity and the allocating operation ID before provisioning. The next target must reserve its physical ownership through CreateManagedTarget before any provider call. Allocating a replacement does not grant ownership of another target's project.

Bounds and retained receipts

The first profile permits 32 manifest members and 64 total reservations per physical instance. Historical incarnations count toward the reservation limit. Once full, new enrollment and restarts fail before issue; use a distinct managed replacement. Do not drop an old command to make room.

Identifiers are at most 256 bytes and use ASCII letters, digits or -_.:/@+=. Opaque command, specification, evidence and remote receipt fields are each bounded at 4096 bytes. There are at most 64 survivor identities per binding and 33 bound provider resource entries. A host must confirm these protocol bounds before it issues work. Large payloads and secret material do not belong in these fields.

The complete target document has an 8 MiB ceiling. Tests serialize all maximum fields together, including base64 expansion, maximal counters/timestamps and even mutually exclusive terminal/abort fields. They also measure PostgreSQL's canonical JSON representation. Enrollment cannot consume the space reserved for terminal results. Oversized identifiers that could escape or expand in JSON are rejected.

Local command receipts live outside the target document in independently retained rows/maps. They are committed atomically with each transition and are checked before fresh phase, lease or capacity validation. There is no shared receipt-count quota that could block closure, takeover or exact accepted replay. PostgreSQL limits each local receipt row to 2048 bytes; receipt fields are generated by the store.

Receipt rows, reservations and tombstones have no reclamation in this profile. Storage use therefore grows with accepted commands. Normal memory/disk exhaustion, database unavailability and caller cancellation can stop progress; these contracts do not promise availability without functioning authoritative storage. A cleanup policy requires separate proof that delayed issuance cannot apply.

Reading and backend scope

ListManagedTargets returns compact summaries and tenant-bound continuation cursors, with a default page of 100 and maximum of 500. It does not return commands or proofs. The explicit controller enumeration can discover targets whose tenant metadata was removed; authorize that method as a controller capability. ReadManagedTarget returns the complete bounded record for reconciliation. A list page never proves closure.

Protection reads include sealed, aborted and deleted targets even if mutable instance or tenant rows are absent. Only authoritative absence permits ordinary unmanaged behavior. Unsupported capability, missing schema, failed reads and ownership mismatch must refuse affected mutations in service integration. Custom wrappers must preserve the same store authority; an empty substitute reader is not a fallback.

PostgreSQL uses a parent row lock, post-lock database time and one transaction for state plus receipt. Additive migrations retain managed tables and reject rollback which would discard protection. Memory uses one mutex and defensive copies; its persistence lasts only for that store object's lifetime. Other backends do not gain managed lifecycle support through the aggregate interface.

Run the store package tests with CTRLPLANE_TEST_POSTGRES_DSN to exercise real PostgreSQL. Configured connection failures fail the tests; absence of that variable skips database cases. The optional restart test has separate seed and verify phases around an externally managed restart of an owned fixture. Normal test runs do not restart databases. Service authorization, remote workers and Docker qualification remain separate integration work.

Controller persistence

Use ControllerStore to accept a managed action, its reserved identities, immutable receipt and pending audit intent in one authority transaction. Access attempts use the same outbox without changing desired state. Tenant, authorized global and configured denial scopes are explicit. Exact replay preserves original source identity, occurrence time and command digests. It does not authorize the current caller or prove delivery to an external audit sink.

Memory stages the complete change under its existing mutex. PostgreSQL takes one controller advisory transaction lock, then physical parent locks in sorted instance order, then reads database time. Nested lifecycle operations share that transaction and only the outer operation commits. The advisory lock serializes controller reads and writes across tenants. This is a throughput limit; remote calls never run while these locks are held. When you use a backend that implements controller authority, all direct lifecycle mutations acquire it before the parent lock. Nested mutations reuse the held controller transaction. Backends without that support use their existing parent transaction. None acquires controller authority from a held parent callback.

The progress journal and persisted continuation are recovery state. They grant no provider permission. Each finite provider step validates the accepted action, audit, immutable release association, projected rows, current parent revision and lease, plus the full removal closure when applicable. A committed permission marks possible issuance. Only a newly committed grant permits the first send; replay returns the original permission for inspection and cannot authorize another send. Result recording retains uncertainty and definitive responses separately from the target document. A missing result remains unresolved.

Projection derives a pending Instance, an optional reserved Workload and an immutable Release from accepted facts. It creates no successful Deployment or route. Owner reuse needs retained managed provenance. Generic owners, identity collisions and missing projected rows refuse; replay does not recreate them. Direct store access remains a trusted embedding capability.

New actions use the strict ctrlplane.managed.v1 envelope inside the existing 4096-byte Spec. Roles stay in member order. Every service pins a nonsecret startup binding ID, generation and digest alongside its immutable image and positive resource limits. This publication validates and preserves those references. It does not resolve credentials, start processes or attest a runtime. Legacy opaque Specs keep their original bytes and protection obligations and cannot gain new managed issue permission through this controller profile.

ValidateRoleBinding checks an exact target/member/reservation mapping and refuses contradictory roles sharing a RuntimeID. This is a leaf contract, not a change to raw lifecycle reservation admission. The later secured service must validate the current snapshot and bind issuance to that same revision, then refetch after contention. Activation must reject contradictory persisted bindings, including bindings admitted by trusted raw store callers. Every incarnation still counts.

Leaf transport values encode integer counters as canonical decimal strings, including nested identities, fences, receipts and provider steps. Checked wire conversions preserve original bytes and stored digests; they never rehash historical commands during translation. Lifecycle and routing values carry bounded proofs and explicit command schema versions. Your trusted adapter must validate these values and authenticate their source before using them as evidence.

New retained action, operation and association rows are limited to 256 KiB; audit rows to 32 KiB; provider step rows to 16 KiB; continuation rows to 32 KiB. Each opaque proof or command is at most 4096 bytes, tokens are at most 256 ASCII bytes, cursors are at most 1024 bytes, and controller pages and pending continuation keys are at most 64 entries. The first profile permits at most 32 services and 98 distinct steps: one network create, service creates and starts, service removals, and one network removal. The Spec byte limit can reduce the number of representable services. Separate history and receipt rows preserve completion headroom without changing the existing 8 MiB target bound. Retained rows have no reclamation policy.

Controller persistence supplies no running controller, provider executor, public managed endpoint, Chronicle publisher or protected disclosure adapter. Your secured composition must close raw routes, supply machine authorization and durable access recording, and privately resolve pinned startup configuration. The historical settlement reader is a leaf interface for those consumers; this slice supplies no new continuation generations or invented provider evidence.

Original lifecycle evidence

Use AcceptManagedOriginalRegistration and RecordManagedOriginalDrain when you need to recover the original native receipt together with its local acceptance. You supply leaf facts and the exact opaque receipt export. The wrapper computes its compact reference and commits that reference, the retained material and the local receipt in one authority transaction. ReadManagedOriginalLifecycle takes the target key, original kind and local operation ID. It resolves that exact row.

Replay checks the original A request digest, saved local receipt and current immutable target, reservation and descriptor associations before returning the saved result. Current lease ownership and expiry do not invalidate an exact accepted replay. Missing history refuses recovery. You cannot backfill a legacy receipt or replace an original drain with another local operation ID.

The first drain records process acceptance and permanent admission closure. Its saved A drain remains incomplete and nonquiescent, with no completion timestamp. Every reservation sharing the runtime must independently resolve its original registration and match the same process, configuration and startup descriptor. These facts do not grant removal permission or prove a later terminal outcome.

The profile uses fixed typed Go JSON field order and UTC timestamps. Decode and re-encode must reproduce the accepted bytes. Required null values, duplicate or unknown fields and trailing values refuse. Every adapter-facing counter is a canonical decimal string, including the parent CAS and saved receipt projection. Parent, descriptor generation and native signed counters retain their signed limits. The immutable manifest version retains its uint64 domain; the native configuration version stays an opaque token. A's stored bytes do not change.

The digest preimage is the UTF-8 domain, one newline and the fixed typed JSON value:

  • ctrlplane.managed.identity.v1 hashes key, provision operation ID, physical identity and the complete manifest in that order, with manifest version encoded as decimal and spec bytes preserved exactly.
  • ctrlplane.managed.original-facts.v1 hashes kind and its normalized facts variant.
  • ctrlplane.managed.original-material.v1 hashes the single material snapshot: original command and reservation, kind, identity digest, facts, raw receipt and its digest. It excludes the reference and local receipt.
  • ctrlplane.managed.drain-handle.v1 hashes the target identity digest, complete process facts, operation ID and UTC deadline. Runtime ID is inside process facts. This derived profile reference does not add a field to the native handle tuple.

The raw native receipt digest is SHA256 of its exact bytes. Native request and operator command digests keep their own domains; the stored registration command has a separate digest. You must not substitute one for another.

An original row contains one material snapshot, its computed reference and one local receipt projection. Its actual JSON encoding is bounded to 32768 bytes; references to 1024 bytes; raw native exports to 4096 bytes; ASCII tokens to 256 bytes; and TypeIDs to 64 bytes with their required prefixes. The PostgreSQL constraint applies only to original record kinds in the existing record table. No target column or extra backend map is required.

Your trusted adapter must authenticate the producer, validate the full native receipt schema and verify descriptor, role and process provenance before calling these methods. The store tests use synthetic receipt bytes and qualify storage only. They do not establish that a real full native receipt fits this profile, that a process accepted the request, or that the system meets a production SLO.

Later quiescence

Use AcceptManagedQuiescence after your adapter has authenticated a terminal native observation. You can submit terminal success or deadline-incomplete quiescence. Both require permanently closed admission, zero active and unknown claims, and an exact association with the retained registration and original drain. Other error classes refuse. LifecycleObservation retains its successful-drain validator.

The observation binds the target identity digest, reservation, member, role, both original operation IDs, exact reference-byte and material digests, process facts, startup descriptor and native RuntimeID/OperationID/Deadline tuple. It contains no full manifest copy. Its challenge digest covers every field of QuiescenceLeaf, including source times, terminal outcome, claim counts, observation/challenge IDs and producer verifier. The attestation is opaque. The optional QuiescenceObservationPort runs outside storage transactions; the store neither calls it nor authenticates its output.

Source ObservedAt must be nonzero and no later than the accepting authority time. That time must be strictly before ValidUntil, with a positive validity interval of at most 60 seconds. There is no future-time tolerance. Clock disagreement can refuse progress, and the store never substitutes a convenient source timestamp. VerifiedAt comes from the fresh parent transition callback after locking. There is no native completion timestamp in this contract.

Acceptance commits one immutable request snapshot, its local receipt and a current index in the same transaction. The original native exports, saved A drain and original local receipt stay byte-identical. You cannot use an observation to backfill a missing original, extend its deadline or replace its receipt.

Current selection advances only for a strictly newer source time. A distinct equal or older observation conflicts. Exact historical replay checks the saved original associations, receipt and current history before returning its original result, even after lease takeover or expiry. It cannot select the historical value again. Missing or corrupt history refuses recovery. When a current index is absent, a one-row existence probe in that exact reservation scope distinguishes first acceptance from a lost index; it never selects evidence or enumerates obligations.

Removal admission, deletion issuance and each fresh provider removal step resolve all reservations from the authoritative target under the same transaction. Each binding still needs its fence and every other closure condition. A successful A drain remains valid through its existing branch. The later branch requires that binding's exact current observation to remain fresh. Fence-set hashing is unchanged. A saved permission replay is inspection-only and cannot authorize another send.

The additional digest preimages use UTF-8 domain, newline, then fixed typed JSON:

  • ctrlplane.managed.quiescence-scope.v1 covers {key, reservation_id} in that order.
  • ctrlplane.managed.quiescence-challenge.v1 covers the complete QuiescenceLeaf field order. It excludes the challenge digest itself and opaque attestation.
  • ctrlplane.managed.quiescence-record.v1 covers the final record, including its single request snapshot, verification time and saved local receipt.

History uses the reservation scope and exact original local operation ID. The current row uses that scope and key current. Its typed value contains the schema, reservation, local operation ID, source observation time and final record digest. Actual JSON caps are 16384 bytes for each history row and 1024 for each current index, with at most 4096 raw attestation bytes. The codec uses canonical decimal counters, UTC timestamps and strict accepted-byte round trips, as original evidence does. No target column or extra backend map is needed. Retained observation history has no total count or lifetime storage bound.

Tests qualify storage admission using synthetic producer bytes. Native receipt validation, machine authentication, descriptor provenance and real process observations remain requirements for the secured adapter. An independent PostgreSQL connection can recover the retained association; that check does not establish native process or daemon recovery.

Original removal attempts

For a ctrlplane.managed.v1 target, start with BeginManagedRemovalAttempt. You need a sealed, resolved registration set and complete provisioned resources. The store retains generation one, permanent attempt and provider operation IDs, root/current records, the initial local receipt association, and an anchor on the original projected operation in one transaction. You can't bootstrap an attempt from old partial fences. Other supported A-only manifests keep their existing lifecycle.

Use the attempt methods in this order:

  1. Authorize each original native Begin with AuthorizeManagedAttemptCommand. Persist its authenticated acceptance with RecordManagedAttemptFence.
  2. Call AdmitManagedRemovalAttempt after every required binding has its original fence. Fresh provider permissions still go through AuthorizeManagedProviderStep.
  3. Record the exact original provider result. After all removal steps have positive terminal results, call SettleManagedRemovalAttempt with Removed.
  4. Authorize and retain each original native Finish, then call TombstoneManagedRemovalAttempt.

A command slot means the original invocation may have been sent, even if your process stopped before transport. Inspecting or replaying that slot does not grant a new send. AuthorizeManagedAttemptRecovery requires fresh parent CAS and lease checks but can grant only the exact retained native request. It neither advances the target/attempt revision nor authorizes a provider retry. Concurrent recovery grants can repeat that same native idempotent request, so your native adapter must preserve its original operation, request and command identities.

You can permanently revoke unissued work with RevokeManagedRemovalAttempt. Already accepted native commands remain obligations. A late original Begin may be recorded after expiry for recovery and Abort, but it does not create live provider authority. Before Abort, retain RecordManagedAttemptBindingSettlement; its witness uses actual callback time, after the original native acceptance. The Abort proof must be verified after that witness and remain fresh when the store records it. Use the binding and historical settlement readers when an attempt never reached aggregate admission.

ProviderStepFailureAuthority accepts one initial failure class: ctrlplane.managed.local-no-dispatch.v1, local_no_dispatch, before_transport_delegate. Its reason is authority_refused, request_binding_mismatch or invocation_closed. Your trusted hook must establish that the exact permission's invocation never entered the transport delegate. Remote status codes, timeouts, unavailable results and negative inspection do not prove this fact. A qualified failure can support SettledWithoutDeletion only when complete provider coverage has no positive deletion or unresolved issued step. Positive and failure facts conflict atomically. Partial deletion followed by a failure stays unresolved.

Every fresh provider send validates all retained reservations and all required provider steps under the current authority transaction. The maximum is 64 reservations and 33 steps. Quiescence remains limited to 60 seconds, and renewing it does not extend the original native fence. Once that fence expires, further provider issuance refuses; already issued positive results can still support truthful Removed settlement, Finish and tombstoning. This interface has no native fence renewal. Successor allocation uses the separate typed continuation contract below.

Attempt state contains fixed 64-byte binding and 33-byte provider presence masks, encoded as canonical base64. Each bit must agree with its exact retained row, local event and receipt. Missing rows never turn an issued slot into an unissued one. Qualified failure, positive result and uncertainty maintenance is atomic and does not consume parent or attempt revisions. Local operation IDs are part of new fact digests; use the same local request to replay an accepted fact.

New digest preimages use UTF-8 domain, a newline, then fixed typed JSON: ctrlplane.managed.attempt-scope.v1, ctrlplane.managed.removal-attempt.v1, ctrlplane.managed.attempt-fact.v1, ctrlplane.managed.attempt-command.v1, ctrlplane.managed.attempt-coverage.v1, ctrlplane.managed.provider-step-failure.v1, ctrlplane.managed.attempt-registration-set.v1 and ctrlplane.managed.attempt-resources.v1. New envelopes encode counters as canonical decimal strings. Existing A receipts, positive provider records and operation history keep their original numeric encodings; operation state adds only the optional attempt anchor.

Before allocation, the store reserves 7*N + S + 8 target revisions for the finite original transitions, plus one for Begin. At the maximum set that is 489 reserved revisions and one allocation revision. Fresh observations, lease renewals and other optional metadata need their own capacity. A genuine positive deletion, validated against complete coverage, can release reserve for impossible Abort branches. A local_no_dispatch fact alone cannot release Finish capacity.

The fixed manifest profile has a separate 64 KiB specification limit, sufficient for its supported 32 services and 32 members. Native command and evidence limits remain 4096 bytes. Typed attempt limits apply to complete encoded records and readers, including nested evidence and receipts.

Managed authority transitions acquire controller authority before the physical parent lock. PostgreSQL currently uses a global controller advisory lock; Memory uses its existing store mutex and staged clones. This serialization and retained history growth need deployment measurement. Immutable receipt probes read only inside the held transaction, and successful immutable row reuse lasts for one read-only validation. It cannot cross a write or fresh callback.

Store tests use synthetic native and failure producers. You'll still need an authenticated native adapter, the qualified transport hook and separate process, daemon and database recovery qualification before deploying this protocol.

You can refresh a descriptor-ordered subset of 1 to 64 observations through the optional QuiescenceBatchStore capability. Each entry keeps its own operation ID and unchanged individual request bytes, derived at parent revision R+i. The batch saves those individual receipts at R+i+1 and one aggregate receipt at R+N+1 in the same transaction. It consumes N+1 parent revisions, with no attempt revision, event, journal or lease-epoch change. Budget every renewal.

Use a new batch ID and new child operation IDs for fresh observations. Replaying the exact accepted batch validates its retained graph and returns its saved receipt, including after tombstoning. A missing child or receipt refuses the whole read; the store does not rebuild it. If the batch fails, don't fall back to partial individual writes. Check that your store implements the optional capability.

Generation-one batches and individual observations reject a projected Abort on any reservation sharing the selected runtime. An Abort on another runtime does not block that observation. Historical reads still validate the retained registration, drain and receipts after Abort. They grant no send authority. Revocation, Removed settlement and Finish permit observational retention; Deleted refuses fresh observations. The original native fence and the 60-second proof lifetime still apply to fresh provider issuance.

Current-code legacy-method refusals protect enrolled attempts only when those calls reach this implementation. They do not fence an older binary that writes the same database. Mixed-version operation and rollback remain unqualified until storage admission and the trusted transport enforce a writer floor.

The maximum lifecycle campaigns run separately from ordinary unit tests. CI's persistence job requires all three generation-one campaigns against PostgreSQL and retains their structured logs. You can run the same selections locally with a private CTRLPLANE_TEST_POSTGRES_DSN pointing to a throwaway database:

GOWORK=off CTRLPLANE_MANAGED_MAXIMUM=individual go test ./store ./store/memory -run '^(TestManagedAttemptFullFiniteSet|TestManagedAttemptPostgresFullFiniteSetNearLimit|TestManagedAttemptMemoryFullFiniteSetNearLimit)$' -count=1 -timeout=30m -v
GOWORK=off CTRLPLANE_MANAGED_MAXIMUM=batch go test ./store ./store/memory -run '^TestManagedQuiescenceBatch(FullFiniteSet|PostgresFullFiniteSetNearLimit|MemoryFullFiniteSetNearLimit)$' -count=1 -timeout=30m -v
GOWORK=off CTRLPLANE_MANAGED_MAXIMUM=batch go test -race ./store ./store/memory -run '^TestManagedQuiescenceBatch(FullFiniteSet|PostgresFullFiniteSetNearLimit|MemoryFullFiniteSetNearLimit)$' -count=1 -timeout=30m -v

Without that selector, ordinary test runs visibly skip the six maximum entry points. The exact 490 acceptance and 489 refusal checks still run by default. The normal individual campaign preserves its 555-revision fixture. Normal and race constrained batch completion fixtures start with 2,862 transitions of headroom. That finite allowance covers the 490-transition admission boundary, at most 34 full batches and 162 lease renewals from the fixture's declared call sites. Each run counts attempted and accepted renewals. The unconstrained case also retains its final diagnostic batch. A single operation that outlasts its proof still fails; this allowance does not promise progress through arbitrary delays. Separate 64-binding, 24-positive-slot tests prove that a full batch refuses 206 headroom without writes and accepts 209, leaving 144 for the unchanged terminal reserve. The full positive lifecycle consumes 293 parent transitions including allocation, and 292 attempt transitions after revision 1; the latter includes all 33 provider permissions. Positive result retention does not advance either counter. Sequential individual race sweeps remain explicit timing diagnostics, with their actual failures reported separately.

Removal continuations

Use RemovalContinuationStore.BeginManagedRemovalContinuation after the current attempt is permanently revoked with not_issued or qualified settled_without_deletion coverage. Every retained Begin needs its exact native fence, a settlement witness and accepted Abort. Missing receipts and expired leases cannot establish settlement. Generic SubmitManagedAction always refuses Continue, including replay.

Build a ContinuationRequest with the exact predecessor, a fresh action ID, fresh successor attempt and provider IDs, and the existing parent authority. RemovalContinuationDigest computes its dedicated digest without authorizing it. The store checks the complete retained graph under the parent lock, closes the predecessor and allocates one successor atomically. Original target bindings, fences, Abort proofs and generation-one descriptors remain unchanged. Generation and pointer counters advance once; there is no lifetime generation quota.

You can reconcile an uncertain reply with ReadManagedRemovalContinuation and exact same-ID replay. An error may follow a committed transaction. No usable grant accompanies that error, and timeout alone never proves rollback or permits a replacement identity. If authoritative reads establish absence, fresh acceptance still needs valid current revision, lease and predecessor. A partial graph refuses without repair. Historical replay returns the saved acceptance, not current send authority.

A fresh successor Begin requires AttemptCurrentBindingObservation, supplied by the trusted native producer. It binds the original registration and process, current native version and removal epoch, verifier, evidence and validity window. The original process profile bounds that window. The store validates the exact supplied facts and native response association; it does not authenticate an external native authority. You still need that producer and transport integration. Synthetic storage fixtures do not establish it.

Successor batches accept 1 through 64 observations. They classify every sibling sharing a runtime, including an original projected Abort, against its retained root fence, witness and Abort. Original individual-observation behavior stays the same. A still-live observation from before Continue can be reused with its original source time and 60-second maximum lifetime. Continue never refreshes it. Native source expiry and quiescence expiry independently deny fresh provider issue.

Revocation permanently denies new Begin and provider permissions. It still permits an exact eligible terminal Abort or Finish and nonissuing recovery of an already retained command. Fresh terminal commands keep their existing settlement and witness prerequisites. Diagnostic observation retention alone grants no issue.

The fixed old executable in qualification/oldb23a tests the published B23a library. Its recognized successor issuance paths refuse, but a valid old journal advance can discard the successor association. The new strict reader detects that loss. Passing these fixtures does not establish mixed-writer safety, rollback safety, a writer floor or authenticated native execution.

Run the successor maximum explicitly:

GOWORK=off CTRLPLANE_MANAGED_MAXIMUM=successor go test ./store -run '^TestManagedRemovalContinuationFullFiniteSet$' -count=1 -timeout=30m -v

It completes a generation-three 64-binding, 33-step lifecycle with 4 KiB evidence fields and checks Memory and PostgreSQL. PostgreSQL combines completion with a synthetic near-limit parent seed before the final Continue. The required lifecycle uses 292 attempt transitions after allocation and 293 parent transitions including Continue. Optional work is counted separately: at most 34 full batches and 162 lease renewals. The 2,864-transition fixture allowance retains the conservative 490 reserve and two explicit spare transitions. CI requires this campaign under race on the exact commit and audits every required case without skips.

Recovery foundation

The optional removal recovery contracts preserve the original attempt identity, provider command and possible effects while retaining revalidation, invocation and retry records separately. Configure the complete native and provider adapters before you use ctrlplane.managed.removal-recovery.v1. A successful read of one retained record does not establish that host contract. The assembled provider and host still need implementation and qualification.

Memory and PostgreSQL retain an unresolved-work index with bounded pages when an action or continuation is accepted. WorkDiscoveryStore pages it by ordinal; a newer user request does not hide older obligations. PhaseCommandStore retains the exact registration, drain, activation or route command with its independent parent receipt and required audit. PhaseOriginalResultStore attaches an independently retained original registration or drain result to that command. Both receipts must agree with the full stored associations. A missing row refuses without backfill. These records remain unresolved until a later qualified lifecycle closes them.

Use the producer's native request and command digests when you construct a PhaseNativeIdentity. A hash of a local transport envelope cannot replace the native protocol's digest. The configured host must authenticate that translation before accepting the result.

Recovery invocation readers verify the retained permission, marker, result and native commit associations before returning them. Fresh public commands require the complete configured recovery capability. A retained cutoff revokes further issuance but does not prove that an earlier command had no effect or authorize settlement. Late results still need their original associations.

Effective coverage keeps each fixed step explicit: unissued, removed or closed before dispatch. Uncertainty cannot satisfy coverage. Its ordered binding records and close-intent sponsor are bound to an independent acceptance receipt.

Native intent and guard-close readers authenticate the original request, event and receipt. Close acceptance checks the configured producer outside authority locks, then checks the same binding, cutoff and coverage again inside the transaction. Each retained close intent and result consumes only its matching reserved slot. Replaying a request returns its retained record and never grants another send.

Terminal settlement binds complete coverage and every closed guard to an independent acceptance receipt. Finish and Abort retain their exact commands and historical binding records in the same transaction as the state transition. You can inspect those records after completion without renewing authority.

Use PrepareManagedGuardedOriginal to retain a pending original permission and its exact native proof set. This does not authorize a send. After the configured provider binds the exact resource and incarnation, MaterializeManagedGuardedOriginal retains that same permission's root and current selection. Native binding and the one-shot marker are still required before execution. A missing pending selector refuses inspection and further work because the attempt state independently commits the accepted pending record. It cannot turn into unissued coverage.

Revalidation readers check the retained request, event and receipt before returning a proof. An effect_complete proof also needs the exact positive provider result, resource incarnation and original process association. For the original invocation, the fence receipt must precede the permission revision even when their timestamps match. Retries name their accepted permission-time proof. Your configured verifier must authenticate the resource-to-process association; missing resources and local record shapes cannot establish it. Full public recovery and concrete rollback still need qualification before the capability can be enabled.

Protected writer admission

You can opt a Memory or PostgreSQL store into managed write admission with NewWithWriterFloorAdmission. Its authority is fixed when you construct the store. The PostgreSQL protected schema must be installed separately through the floor administrator before you use this mode. Missing tables or denied reads refuse; they do not select legacy behavior.

A pristine protected namespace admits existing managed writes. The compiled core writer supports floor 1 and refuses higher floors. Each mutation validates the current floor against its retained history before comparing the protocol number. The check covers managed commands, retained records and audits, projections and direct quiescence batch staging. The floor decision stays inside the same locked transaction as the mutation. Exact read-only receipt recovery does not authorize a write.

This opt-in store check does not fence an old executable, an ordinary store write such as InsertAuditEntry, or a raw database handle. Existing New constructors remain legacy. You need a separate deployed credential and grant barrier covering all writers before activating a protected deployment. The dedicated administrator and read handles separate library capabilities; they do not prove database role isolation. Restoring an older database also requires independent admission state and effect reconciliation before any writer can restart.

For a dedicated PostgreSQL authority database, NewWriterFloorExclusionAdmin adds grant revocation to the floor administrator's transaction. Configure its separate administrator, offline owner and exact retired writer roles. Your launcher must first close admission, disable those logins and drain their sessions. Activation checks the roles, sessions and catalog, then revokes table, column, sequence, routine, schema, database and default privileges before updating the floor and history. Any refusal rolls back both the privilege changes and the floor update.

The exclusion administrator grants no replacement writer access. Core support for floor 1 does not certify your assembled host. You still need the launcher admission barrier and independent state that quarantines a restored database.

Documentation

Overview

Package managed defines persisted worker protection and physical-instance lifecycle contracts. Hosts translate opaque evidence; this package does not import a worker engine. Store support alone does not install service guards or authorize provider operations.

Index

Constants

View Source 
const (
	MaxAttemptDescriptor         = 16384
	MaxAttemptPointer            = 2048
	MaxAttemptFact               = 8192
	MaxAttemptCommand            = 16384
	MaxAttemptFence              = 49152
	MaxAttemptSettlement         = 16384
	MaxAttemptAssociation        = 1024
	MaxAttemptReceipt            = 2048
	MaxAttemptBindingResponse    = 192 << 10
	MaxAttemptSettlementResponse = 1 << 20
	AttemptBegin                 = "begin"
	AttemptAbort                 = "abort"
	AttemptFinish                = "finish"
	LocalNoDispatchProfile       = "ctrlplane.managed.local-no-dispatch.v1"
)

Attempt record limits apply to the complete encoded JSON document.

View Source 
const (
	MaxRemovalContinuationMaterial    = 16384
	MaxRemovalContinuationClosure     = 8192
	MaxRemovalContinuationAssociation = 1024
	MaxRemovalContinuationReceipt     = 2048
	MaxRemovalContinuationRecord      = 32768
	MaxRemovalContinuationRequest     = 16384
	MaxSuccessorCommandRequest        = 32768
	MaxAttemptCurrentBinding          = 8192
)

Removal continuation limits bound complete encoded records.

View Source 
const (
	DiscoverySchema  = "ctrlplane.managed.discovery.v1"
	MaxWorkReference = 2048
	MaxWorkHead      = 8192
	MaxWorkPage      = 73728
	MaxWorkPageItems = 32
	MaxWorkCursor    = 1024
)

Discovery bounds apply to actual canonical JSON bytes, including envelope fields.

View Source 
const (
	MaxControllerRecord = 256 << 10
	MaxAuditIntent      = 32 << 10
	MaxProviderStep     = 16 << 10
	MaxContinuation     = 32 << 10
	MaxControllerPage   = 64
	MaxControllerCursor = 1024
	MaxProviderSteps    = 3*MaxMembers + 2
)

Controller storage bounds leave retained completion records outside A's target document.

View Source 
const (
	MaxOriginalLifecycleRecord    = 32768
	MaxOriginalLifecycleReference = 1024
	MaxOriginalNativeReceipt      = 4096
	OriginalRegistration          = "original_registration"
	OriginalDrain                 = "original_drain"
)

Original lifecycle bounds apply to actual JSON bytes, including base64 expansion.

View Source 
const (
	MaxProviderEffectCommand     = 4096
	MaxProviderEffectAttestation = 4096
	MaxProviderEffectBinding     = 16384
)

Effect evidence has independent input caps and a cap on the complete encoded row.

View Source 
const (
	MaxStepRetryRoot    = 8192
	MaxStepRetryPointer = 2048
	MaxStepRetryFact    = 16384
)

Retry limits apply to complete encoded records, including their local acceptance.

View Source 
const (
	MaxQuiescenceRecord      = 16384
	MaxQuiescenceIndex       = 1024
	MaxQuiescenceAttestation = 4096
	QuiescenceHistory        = "quiescence_observation"
	QuiescenceCurrent        = "quiescence_current"
)

Quiescence bounds apply to actual typed JSON, including attestation base64 expansion.

View Source 
const (
	MaxQuiescenceBatchEntries    = 64
	MaxQuiescenceBatchEntry      = 16384
	MaxQuiescenceBatchInput      = 1052672
	MaxQuiescenceBatchRecord     = 32768
	MaxQuiescenceBatchReceipt    = 4096
	QuiescenceBatchHistory       = "quiescence_observation_batch"
	QuiescenceBatchRequestSchema = "ctrlplane.quiescence-batch-request.v1"
	QuiescenceBatchRecordSchema  = "ctrlplane.quiescence-batch-record.v1"
	QuiescenceBatchReceiptSchema = "ctrlplane.quiescence-batch-receipt.v1"
)

Quiescence batch bounds cover complete encoded values, including nested evidence.

View Source 
const (
	RemovalRecoveryProfile      = "ctrlplane.managed.removal-recovery.v1"
	ProviderStepRetryProfile    = "ctrlplane.managed.provider-step-retry.v1"
	MaxRemovalRevalidation      = 32768
	MaxRecoveryCurrent          = 1024
	MaxRecoveryAssociation      = 1024
	MaxRecoveryExport           = 4096
	MaxRecoveryAttestation      = 4096
	MaxRecoveryFact             = 8192
	MaxRecoveryNativeAcceptance = 16384
	MaxRecoveryNativeIntent     = 16384
	MaxRecoveryReceipt          = 2048
	MaxRecoveryLeafSet          = 4 << 20
	MaxRecoveryBindings         = 64
	MaxRecoverySteps            = 33
)

Recovery profiles leave the original manifest and original attempt facts unchanged.

View Source 
const (
	DefaultPage     = 100
	MaxPage         = 500
	MaxMembers      = 32
	MaxReservations = 64
	MaxEvidence     = 4096
	// MaxManifestSpec bounds the recognized fixed-profile specification separately from native evidence.
	MaxManifestSpec             = 64 << 10
	MaxDocument                 = 8 << 20
	MaxLease                    = 5 * time.Minute
	PrefixOperation   id.Prefix = "mop"
	PrefixReservation id.Prefix = "mres"
)

Bounds limit persisted records and public pages. Exhaustion refuses new work.

View Source 
const MaxPhaseCommand = 262144

MaxPhaseCommand bounds a complete retained original command in the existing record table.

View Source 
const MaxPhaseOriginalResult = 16384

MaxPhaseOriginalResult bounds the complete evidence link and its independent receipts.

View Source 
const MaxWriterFloor = 4096

MaxWriterFloor bounds each complete canonical request and retained activation in bytes.

View Source 
const ProviderEffectBindingKind = "provider_effect_binding"

ProviderEffectBindingKind is the exact immutable controller row kind.

View Source 
const ProviderEffectBindingProfile = "ctrlplane.managed.provider-effect-binding.v1"

ProviderEffectBindingProfile identifies additive evidence beside an original permission.

View Source 
const WriterFloorSchema = "ctrlplane.managed.writer-floor.v1"

WriterFloorSchema identifies protected deployment metadata, not an earned writer protocol.

Variables

View Source 
var (
	ErrNotFound    = errors.New("managed: target not found")
	ErrConflict    = errors.New("managed: conflicting command or revision")
	ErrInvalid     = errors.New("managed: invalid request")
	ErrBlocked     = errors.New("managed: unresolved lifecycle obligation")
	ErrUnavailable = errors.New("managed: protection authority unavailable")
	ErrUnsupported = errors.New("managed: protection capability unsupported")
	ErrAuthority   = errors.New("managed: ownership or authority mismatch")
	ErrCapacity    = errors.New("managed: record capacity exceeded")
)

Errors distinguish absent records, conflicts and unavailable protection authority.

View Source 
var ErrWriterFloorCorrupt = errors.New("managed: protected writer floor is corrupt")

ErrWriterFloorCorrupt distinguishes damaged protected metadata from unavailable storage.

Functions

func ActionDigest 

func ActionDigest(q ActionSubmission) (string, error)

ActionDigest binds parsed acceptance, original bytes and all reserved identities. CanonicalDigest itself is excluded to avoid a self-referential digest.

func AttemptFenceFactDigest 

func AttemptFenceFactDigest(fence AttemptFenceRecord) (string, error)

AttemptFenceFactDigest returns the retained removal-fence fact digest. Callers obtain the fence from an authenticated attempt binding read. Computing this digest does not validate the fence or confer mutation authority.

func Digest 

func Digest(b []byte) string

Digest identifies exact non-secret command or evidence bytes.

func EncodePhaseCommandRecord 

func EncodePhaseCommandRecord(r PhaseCommandRecord) ([]byte, error)

EncodePhaseCommandRecord bounds the complete envelope including base64 command expansion.

func EncodePhaseOriginalResult 

func EncodePhaseOriginalResult(r PhaseOriginalResult) ([]byte, error)

EncodePhaseOriginalResult bounds the full result link after checking exact identities.

func EncodeProviderEffectBinding 

func EncodeProviderEffectBinding(record ProviderEffectBindingRecord) ([]byte, error)

EncodeProviderEffectBinding checks the entire stored JSON including base64 and receipts.

func EncodeProviderEffectCommand 

func EncodeProviderEffectCommand(command ProviderEffectCommand) ([]byte, error)

EncodeProviderEffectCommand enforces the canonical command shape and actual byte cap.

func EncodeRecoveryRecord 

func EncodeRecoveryRecord[T any](record RecoveryRecord[T]) ([]byte, error)

EncodeRecoveryRecord checks the fact type, its digest and the complete encoded byte cap. This codec validates storage shape, not native authenticity or transition authority.

func EncodeWorkHead 

func EncodeWorkHead(h WorkHead) ([]byte, error)

EncodeWorkHead validates both retained selections without interpreting progress as closure.

func EncodeWorkPage 

func EncodeWorkPage(p WorkPage) ([]byte, error)

EncodeWorkPage enforces its full envelope cap after checking all compact items.

func EncodeWorkReference 

func EncodeWorkReference(r WorkReference) ([]byte, error)

EncodeWorkReference preserves the exact canonical reference bytes.

func EncodeWriterFloor 

func EncodeWriterFloor(floor WriterFloor) ([]byte, error)

EncodeWriterFloor validates the schema, signed counters, UTC timestamp and both hashes.

func EncodeWriterFloorActivation 

func EncodeWriterFloorActivation(request WriterFloorActivation) ([]byte, error)

EncodeWriterFloorActivation validates administration input without accepting it.

func MatchWriterFloor 

func MatchWriterFloor(floor WriterFloor, external WriterFloorReference) error

MatchWriterFloor compares validated local state with an externally retained exact reference. The host must authenticate and freshly obtain the reference. Equality alone cannot reopen a restored database that omitted a later delegation under the same activation.

func OriginalDrainHandleDigest 

func OriginalDrainHandleDigest(targetDigest string, f OriginalDrainFacts) (string, error)

OriginalDrainHandleDigest hashes the tuple and its complete immutable process scope. This is a profile reference, not an additional native handle field.

func OriginalIdentityDigest 

func OriginalIdentityDigest(i Identity) (string, error)

OriginalIdentityDigest hashes the complete immutable Identity in fixed field order. Only manifest.version is projected to decimal; the spec bytes remain opaque and exact.

func PhaseCommandDigest 

func PhaseCommandDigest(q PhaseCommandRequest) (string, error)

PhaseCommandDigest validates the closed request union and hashes its original bytes.

func ProjectionOwner 

func ProjectionOwner(i Identity) (id.ID, error)

ProjectionOwner returns the single immutable owner supported by this profile. Multiple owners or mixed standalone ownership require a separate profile.

func ProviderEffectBindingAcceptanceDigest 

func ProviderEffectBindingAcceptanceDigest(requestDigest, factDigest string) (string, error)

ProviderEffectBindingAcceptanceDigest binds the request and verified facts to the independent parent receipt. Rewriting a row cannot authenticate replacement evidence.

func ProviderEffectBindingDigest 

func ProviderEffectBindingDigest(facts ProviderEffectBindingFacts) (string, error)

ProviderEffectBindingDigest binds evidence to the original independently of acceptance.

func ProviderEffectCommandDigest 

func ProviderEffectCommandDigest(raw []byte) (string, error)

ProviderEffectCommandDigest excludes every local invocation and receipt association.

func ProviderEffectOriginalEqual 

func ProviderEffectOriginalEqual(left, right ProviderEffectOriginal) bool

ProviderEffectOriginalEqual preserves the complete accepted permission and receipt.

func QuiescenceBatchScope 

func QuiescenceBatchScope(k Key) (string, error)

QuiescenceBatchScope uses a separate domain and the exact nested target key.

func QuiescenceChallengeDigest 

func QuiescenceChallengeDigest(leaf QuiescenceLeaf) (string, error)

QuiescenceChallengeDigest hashes every typed leaf field, excluding the attestation.

func QuiescenceRecordDigest 

func QuiescenceRecordDigest(r QuiescenceRecord) (string, error)

QuiescenceRecordDigest hashes the entire final record, including the saved local receipt.

func QuiescenceScope 

func QuiescenceScope(k Key, reservationID id.ID) (string, error)

QuiescenceScope hashes the typed target key and reservation, in that field order.

func RecoveryCurrentDigest 

func RecoveryCurrentDigest(current RemovalRevalidationCurrent) (string, error)

RecoveryCurrentDigest hashes a current proof pointer without its self digest.

func RecoveryFactDigest 

func RecoveryFactDigest[T any](facts T) (string, error)

RecoveryFactDigest hashes only the normalized typed fact, excluding local acceptance. Semantic authority and evidence authenticity must be checked before accepting the fact.

func RecoveryFactKey 

func RecoveryFactKey(k AttemptKey, kind RecoveryRecordKind, operation id.ID, facts any) (string, error)

RecoveryFactKey derives a canonical lookup address from a typed fact subject. Partial subjects are supported for exact store reads. This does not validate a complete record or prove acceptance; use RecoveryRecordAssociation for records.

func RecoveryProofFresh 

func RecoveryProofFresh(facts RemovalRevalidationFacts, now time.Time) bool

RecoveryProofFresh checks actual callback time independently of native acceptance time.

func RecoveryRecordLimit 

func RecoveryRecordLimit(kind RecoveryRecordKind) int

RecoveryRecordLimit returns zero for an unsupported record kind.

func RemovalContinuationDigest 

func RemovalContinuationDigest(q ContinuationRequest) (string, error)

RemovalContinuationDigest binds typed inputs, without reading or authorizing state.

func RequireRemovalRecovery 

func RequireRemovalRecovery(authority any) (RemovalRevalidationStore, ProviderInvocationStore, ProviderStepRetryStore, error)

RequireRemovalRecovery refuses partial capability before any recovery profile issuance. This checks interface support only. Hosts must also configure and authenticate each producer.

func RetryCurrentDigest 

func RetryCurrentDigest(current ProviderStepRetryCurrent) (string, error)

RetryCurrentDigest hashes one selected invocation without its self digest.

func RetryPreviousDigest 

func RetryPreviousDigest(previous ProviderStepRetryPrevious) (string, error)

RetryPreviousDigest hashes the fixed predecessor certificate without its self digest.

func SameAuthority 

func SameAuthority(configured, candidate any) bool

SameAuthority proves that two configurations reference the same nonnil object. Equal values and indeterminate identities cannot establish shared authority.

func ValidateProviderEffectBindingFacts 

func ValidateProviderEffectBindingFacts(facts ProviderEffectBindingFacts) error

ValidateProviderEffectBindingFacts validates shape and local equality, not authenticity.

func ValidateProviderEffectOriginal 

func ValidateProviderEffectOriginal(original ProviderEffectOriginal) error

ValidateProviderEffectOriginal checks shape and local identity associations. Ordinary permissions and command receipts use different digest domains. The store must also reload both records from the same persistence authority.

func ValidateRecoveryAssociation 

func ValidateRecoveryAssociation(reference RecoveryAssociation) error

ValidateRecoveryAssociation checks the bounded exact address; it never proves acceptance.

func ValidateRecoveryNativeExport 

func ValidateRecoveryNativeExport(value RecoveryNativeExport) error

ValidateRecoveryNativeExport checks independently bounded raw exports and attestation hashes.

func ValidateRoleBinding 

func ValidateRoleBinding(target Target, binding RoleBinding) error

ValidateRoleBinding checks the exact accepted target, member and reservation mapping. It does not attest the remote process or replace authenticated host verification.

func WriterFloorActivationDigest 

func WriterFloorActivationDigest(request WriterFloorActivation) (string, error)

WriterFloorActivationDigest validates and hashes a bounded canonical activation request.

Types

type AbortProof 

type AbortProof struct {
	FenceDigest string    `json:"fence_digest"`
	VerifiedAt  time.Time `json:"verified_at"`
	ValidUntil  time.Time `json:"valid_until"`
	Evidence    []byte    `json:"evidence"`
	Receipt     []byte    `json:"receipt"`
}

AbortProof binds a recovered abort receipt and fresh original-binding query proof.

type AbortRequest 

type AbortRequest struct {
	ReservationRequest

	Proof AbortProof `json:"proof"`
}

AbortRequest records an accepted per-binding abort after exact operation settlement.

type AcceptanceRequest 

type AcceptanceRequest struct {
	ReservationRequest

	Receipt []byte `json:"receipt"`
}

AcceptanceRequest records the exact accepted remote result.

type AccessAuditReceipt 

type AccessAuditReceipt struct {
	ID         id.ID     `json:"id"`
	Digest     string    `json:"digest"`
	AuditID    id.ID     `json:"audit_id"`
	AcceptedAt time.Time `json:"accepted_at"`
}

AccessAuditReceipt proves local access intent persistence without granting access.

type AccessAuditRequest 

type AccessAuditRequest struct {
	AttemptID      id.ID      `json:"attempt_id"`
	Installation   string     `json:"installation"`
	Authority      string     `json:"authority"`
	ApplicationID  string     `json:"application_id"`
	OrganizationID string     `json:"organization_id"`
	Actor          AuditActor `json:"actor"`
	Scope          AuditScope `json:"scope"`
	Action         string     `json:"action"`
	ResourceKind   string     `json:"resource_kind"`
	ResourceID     string     `json:"resource_id"`
	SelectorDigest string     `json:"selector_digest,omitempty"`
	Outcome        string     `json:"outcome"`
	Reason         string     `json:"reason"`
	OccurredAt     time.Time  `json:"occurred_at"`
	DecisionID     string     `json:"decision_id,omitempty"`
	CorrelationID  string     `json:"correlation_id,omitempty"`
}

AccessAuditRequest freezes one server-issued disclosure or refusal attempt. SelectorDigest is a sanitized fingerprint, never row contents or credentials.

type ActionKind 

type ActionKind string

ActionKind identifies the finite set of accepted operator decisions. 

const (
	ActionDeploy   ActionKind = "deploy"
	ActionPause    ActionKind = "pause"
	ActionRetire   ActionKind = "retire"
	ActionRollback ActionKind = "rollback"
	// ActionContinue requires the typed removal continuation capability; generic submission refuses it.
	ActionContinue ActionKind = "continue"
)

type ActionReceipt 

type ActionReceipt struct {
	ID              id.ID     `json:"id"`
	Key             Key       `json:"key"`
	Target          Key       `json:"target"`
	CanonicalDigest string    `json:"canonical_digest"`
	OriginalDigest  string    `json:"original_digest"`
	Revision        uint64    `json:"revision"`
	DesiredRevision uint64    `json:"desired_revision"`
	AuditID         id.ID     `json:"audit_id"`
	ReleaseID       id.ID     `json:"release_id,omitzero"`
	AcceptedAt      time.Time `json:"accepted_at"`
}

ActionReceipt is immutable local acceptance, separate from external completion.

type ActionSubmission 

type ActionSubmission struct {
	Command

	Kind                    ActionKind `json:"kind"`
	Installation            string     `json:"installation"`
	Authority               string     `json:"authority"`
	ApplicationID           string     `json:"application_id"`
	OrganizationID          string     `json:"organization_id"`
	Actor                   AuditActor `json:"actor"`
	OriginalCommand         []byte     `json:"original_command"`
	OriginalDigest          string     `json:"original_digest"`
	CanonicalDigest         string     `json:"canonical_digest"`
	ExpectedDesiredRevision uint64     `json:"expected_desired_revision"`
	NewTarget               *Identity  `json:"new_target,omitempty"`
	ReleaseID               id.ID      `json:"release_id,omitzero"`
	RollbackReleaseID       id.ID      `json:"rollback_release_id,omitzero"`
	OccurredAt              time.Time  `json:"occurred_at"`
}

ActionSubmission freezes authenticated command content and reserved identities. The trusted service authenticates first; this persistence interface is not public.

type AdmissionRequest 

type AdmissionRequest struct {
	Command

	OperationID id.ID  `json:"operation_id"`
	Verifier    string `json:"verifier"`
}

AdmissionRequest allocates the deletion operation only after whole-instance closure.

type AttemptAbortRequest 

type AttemptAbortRequest struct {
	AttemptRequest

	ReservationID   id.ID                   `json:"reservation_id"`
	Acceptance      AttemptNativeAcceptance `json:"acceptance"`
	ProofVerifiedAt time.Time               `json:"proof_verified_at"`
	ProofValidUntil time.Time               `json:"proof_valid_until"`
}

AttemptAbortRequest records an original Abort receipt and separately fresh binding proof.

func (AttemptAbortRequest) MarshalJSON 

func (v AttemptAbortRequest) MarshalJSON() ([]byte, error)

MarshalJSON projects AttemptAbortRequest parent counters into canonical decimal strings.

func (*AttemptAbortRequest) UnmarshalJSON 

func (v *AttemptAbortRequest) UnmarshalJSON(raw []byte) error

UnmarshalJSON validates the exact accepted AttemptAbortRequest encoding.

type AttemptAdmission 

type AttemptAdmission struct {
	LocalOperationID      id.ID      `json:"local_operation_id"`
	SchemaVersion         Decimal    `json:"schema_version"`
	AttemptRef            AttemptRef `json:"attempt_ref"`
	ProviderOperationID   id.ID      `json:"provider_operation_id"`
	FenceSetDigest        string     `json:"fence_set_digest"`
	RegistrationSetDigest string     `json:"registration_set_digest"`
	ResourcesDigest       string     `json:"resources_digest"`
	VerifierID            string     `json:"verifier_id"`
	AcceptedAt            time.Time  `json:"accepted_at"`
	ParentRevision        Decimal    `json:"parent_revision"`
}

AttemptAdmission retains the original complete fence-set acceptance.

type AttemptAdmissionRequest 

type AttemptAdmissionRequest struct {
	AttemptRequest

	VerifierID string `json:"verifier_id"`
}

AttemptAdmissionRequest selects the descriptor's configured verifier.

func (AttemptAdmissionRequest) MarshalJSON 

func (v AttemptAdmissionRequest) MarshalJSON() ([]byte, error)

MarshalJSON projects AttemptAdmissionRequest parent counters into canonical decimal strings.

func (*AttemptAdmissionRequest) UnmarshalJSON 

func (v *AttemptAdmissionRequest) UnmarshalJSON(raw []byte) error

UnmarshalJSON validates the exact accepted AttemptAdmissionRequest encoding.

type AttemptBindingKey 

type AttemptBindingKey struct {
	AttemptKey

	ReservationID id.ID `json:"reservation_id"`
}

AttemptBindingKey selects one original reservation within an attempt.

type AttemptBindingRecord 

type AttemptBindingRecord struct {
	Key              AttemptBindingKey                 `json:"key"`
	DescriptorDigest string                            `json:"descriptor_digest"`
	Commands         []AttemptCommandRecord            `json:"commands"`
	Fence            *AttemptFenceRecord               `json:"fence,omitempty"`
	Abort            *AttemptTerminalRecord            `json:"abort,omitempty"`
	Finish           *AttemptTerminalRecord            `json:"finish,omitempty"`
	Witness          *AttemptBindingSettlement         `json:"witness,omitempty"`
	CurrentBinding   *AttemptCurrentBindingObservation `json:"current_binding,omitempty"`
}

AttemptBindingRecord returns one complete exact binding, never a page of obligations.

type AttemptBindingReference 

type AttemptBindingReference struct {
	ReservationID                   id.ID   `json:"reservation_id"`
	ReservationVersion              Decimal `json:"reservation_version"`
	OriginalRegistrationOperationID id.ID   `json:"original_registration_operation_id"`
	OriginalRegistrationDigest      string  `json:"original_registration_digest"`
	ProcessDigest                   string  `json:"process_digest"`
}

AttemptBindingReference binds retained native commands to original registration.

type AttemptBindingSettlement 

type AttemptBindingSettlement struct {
	LocalOperationID  id.ID             `json:"local_operation_id"`
	SchemaVersion     Decimal           `json:"schema_version"`
	Key               AttemptBindingKey `json:"key"`
	DescriptorDigest  string            `json:"descriptor_digest"`
	FenceFactDigest   string            `json:"fence_fact_digest"`
	NativeFenceDigest string            `json:"native_fence_digest"`
	RevocationDigest  string            `json:"revocation_digest"`
	SettlementDigest  string            `json:"settlement_digest,omitempty"`
	CoverageDigest    string            `json:"coverage_digest"`
	Disposition       Disposition       `json:"disposition"`
	WitnessedAt       time.Time         `json:"witnessed_at"`
	ParentRevision    Decimal           `json:"parent_revision"`
}

AttemptBindingSettlement is a fresh exact-binding witness of continuing settlement.

type AttemptBindingSettlementRequest 

type AttemptBindingSettlementRequest struct {
	AttemptRequest

	ReservationID   id.ID  `json:"reservation_id"`
	FenceFactDigest string `json:"fence_fact_digest"`
}

AttemptBindingSettlementRequest cannot supply or rewrite the witness time.

func (AttemptBindingSettlementRequest) MarshalJSON 

func (v AttemptBindingSettlementRequest) MarshalJSON() ([]byte, error)

MarshalJSON projects AttemptBindingSettlementRequest parent counters into canonical decimal strings.

func (*AttemptBindingSettlementRequest) UnmarshalJSON 

func (v *AttemptBindingSettlementRequest) UnmarshalJSON(raw []byte) error

UnmarshalJSON validates the exact accepted AttemptBindingSettlementRequest encoding.

type AttemptCommandGrant 

type AttemptCommandGrant struct {
	Receipt     AttemptReceipt       `json:"receipt"`
	Command     AttemptCommandRecord `json:"command"`
	NewlyIssued bool                 `json:"newly_issued"`
}

AttemptCommandGrant permits only a newly accepted original native invocation.

type AttemptCommandKey 

type AttemptCommandKey struct {
	AttemptBindingKey

	Kind string `json:"kind"`
}

AttemptCommandKey identifies the one original command of each native kind.

type AttemptCommandRecord 

type AttemptCommandRecord struct {
	SchemaVersion         Decimal                 `json:"schema_version"`
	Key                   AttemptCommandKey       `json:"key"`
	DescriptorDigest      string                  `json:"descriptor_digest"`
	BindingReference      AttemptBindingReference `json:"binding_reference"`
	ExpectedNativeVersion Decimal                 `json:"expected_native_version"`
	NativeCommand         PortCommand             `json:"native_command"`
	AuthorizationID       id.ID                   `json:"authorization_id"`
	AuthorizationDigest   string                  `json:"authorization_digest"`
	IssuedAt              time.Time               `json:"issued_at"`
	CurrentBindingDigest  string                  `json:"current_binding_digest,omitempty"`
}

AttemptCommandRecord is immutable may-have-issued evidence, including before transport.

type AttemptCommandRequest 

type AttemptCommandRequest struct {
	AttemptRequest

	ReservationID         id.ID                             `json:"reservation_id"`
	Kind                  string                            `json:"kind"`
	ExpectedNativeVersion Decimal                           `json:"expected_native_version"`
	NativeCommand         PortCommand                       `json:"native_command"`
	CurrentBinding        *AttemptCurrentBindingObservation `json:"current_binding,omitempty"`
}

AttemptCommandRequest supplies exactly the original native request before send.

func (AttemptCommandRequest) MarshalJSON 

func (v AttemptCommandRequest) MarshalJSON() ([]byte, error)

MarshalJSON projects AttemptCommandRequest parent counters into canonical decimal strings.

func (*AttemptCommandRequest) UnmarshalJSON 

func (v *AttemptCommandRequest) UnmarshalJSON(raw []byte) error

UnmarshalJSON validates the exact accepted AttemptCommandRequest encoding.

type AttemptCurrentBindingObservation 

type AttemptCurrentBindingObservation struct {
	SchemaVersion    Decimal                 `json:"schema_version"`
	Key              AttemptBindingKey       `json:"key"`
	DescriptorDigest string                  `json:"descriptor_digest"`
	BindingReference AttemptBindingReference `json:"binding_reference"`
	BindingVersion   Decimal                 `json:"binding_version"`
	RemovalEpoch     Decimal                 `json:"removal_epoch"`
	State            string                  `json:"state"`
	ObservedAt       time.Time               `json:"observed_at"`
	ValidUntil       time.Time               `json:"valid_until"`
	VerifierID       string                  `json:"verifier_id"`
	Evidence         []byte                  `json:"evidence"`
	EvidenceDigest   string                  `json:"evidence_digest"`
}

AttemptCurrentBindingObservation is supplied by the trusted native producer. Store validation binds supplied facts; it does not authenticate live native provenance.

type AttemptDescriptor 

type AttemptDescriptor struct {
	SchemaVersion         Decimal     `json:"schema_version"`
	Key                   Key         `json:"key"`
	AttemptID             id.ID       `json:"attempt_id"`
	Generation            Decimal     `json:"generation"`
	Predecessor           *AttemptRef `json:"predecessor,omitempty"`
	ActionID              id.ID       `json:"action_id"`
	ProjectionActionID    id.ID       `json:"projection_action_id"`
	ProviderOperationID   id.ID       `json:"provider_operation_id"`
	IdentityDigest        string      `json:"identity_digest"`
	ManifestDigest        string      `json:"manifest_digest"`
	Seal                  Decimal     `json:"seal"`
	RegistrationSetDigest string      `json:"registration_set_digest"`
	ReservationIDs        []id.ID     `json:"reservation_ids"`
	ResourcesDigest       string      `json:"resources_digest"`
	VerifierID            string      `json:"verifier_id"`
	AcceptedAt            time.Time   `json:"accepted_at"`
}

AttemptDescriptor freezes the complete original target and resource associations.

type AttemptFenceRecord 

type AttemptFenceRecord struct {
	LocalOperationID id.ID             `json:"local_operation_id"`
	SchemaVersion    Decimal           `json:"schema_version"`
	Key              AttemptBindingKey `json:"key"`
	DescriptorDigest string            `json:"descriptor_digest"`
	CommandDigest    string            `json:"command_digest"`
	AttemptNativeAcceptance
	Fence WireFence `json:"fence"`
}

AttemptFenceRecord retains an accepted original Begin even after fence expiry.

type AttemptFenceRequest 

type AttemptFenceRequest struct {
	AttemptRequest

	ReservationID id.ID                   `json:"reservation_id"`
	Acceptance    AttemptNativeAcceptance `json:"acceptance"`
	Fence         WireFence               `json:"fence"`
}

AttemptFenceRequest records an authenticated original native acceptance.

func (AttemptFenceRequest) MarshalJSON 

func (v AttemptFenceRequest) MarshalJSON() ([]byte, error)

MarshalJSON projects AttemptFenceRequest parent counters into canonical decimal strings.

func (*AttemptFenceRequest) UnmarshalJSON 

func (v *AttemptFenceRequest) UnmarshalJSON(raw []byte) error

UnmarshalJSON validates the exact accepted AttemptFenceRequest encoding.

type AttemptFinishRequest 

type AttemptFinishRequest struct {
	AttemptRequest

	ReservationID id.ID                   `json:"reservation_id"`
	Acceptance    AttemptNativeAcceptance `json:"acceptance"`
}

AttemptFinishRequest records a completed original Finish without renewing an old fence.

func (AttemptFinishRequest) MarshalJSON 

func (v AttemptFinishRequest) MarshalJSON() ([]byte, error)

MarshalJSON projects AttemptFinishRequest parent counters into canonical decimal strings.

func (*AttemptFinishRequest) UnmarshalJSON 

func (v *AttemptFinishRequest) UnmarshalJSON(raw []byte) error

UnmarshalJSON validates the exact accepted AttemptFinishRequest encoding.

type AttemptHistoricalSettlement 

type AttemptHistoricalSettlement struct {
	Request         AttemptSettlementReadRequest `json:"request"`
	AttemptRef      AttemptRef                   `json:"attempt_ref"`
	Admission       *AttemptAdmission            `json:"admission,omitempty"`
	Revocation      *AttemptRevocation           `json:"revocation,omitempty"`
	Settlement      *AttemptSettlement           `json:"settlement,omitempty"`
	Witness         AttemptBindingSettlement     `json:"witness"`
	StepReferences  []string                     `json:"step_references"`
	ResourcesDigest string                       `json:"resources_digest"`
}

AttemptHistoricalSettlement supports partial, unadmitted original attempts.

type AttemptKey 

type AttemptKey struct {
	Key

	AttemptID  id.ID   `json:"attempt_id"`
	Generation Decimal `json:"generation"`
}

AttemptKey selects one immutable removal attempt in its original target.

type AttemptNativeAcceptance 

type AttemptNativeAcceptance struct {
	NativeAcceptance     AttemptNativeFacts `json:"native_acceptance"`
	NativeFenceDigest    string             `json:"native_fence_digest"`
	ReceiptID            string             `json:"receipt_id"`
	Receipt              []byte             `json:"receipt"`
	ReceiptDigest        string             `json:"receipt_digest"`
	OriginalBindingProof []byte             `json:"original_binding_proof"`
	ProofDigest          string             `json:"proof_digest"`
}

AttemptNativeAcceptance contains bounded producer facts, never a copied native schema.

type AttemptNativeFacts 

type AttemptNativeFacts struct {
	RequestID       string    `json:"request_id"`
	RequestDigest   string    `json:"request_digest"`
	CommandDigest   string    `json:"command_digest"`
	ResponseVersion Decimal   `json:"response_version"`
	BindingVersion  Decimal   `json:"binding_version"`
	RemovalEpoch    Decimal   `json:"removal_epoch"`
	AcceptedAt      time.Time `json:"accepted_at"`
}

AttemptNativeFacts keeps native request, command and binding version domains distinct.

type AttemptReceipt 

type AttemptReceipt struct {
	Receipt             Receipt `json:"receipt"`
	AttemptID           id.ID   `json:"attempt_id"`
	Generation          Decimal `json:"generation"`
	ProviderOperationID id.ID   `json:"provider_operation_id"`
	DescriptorDigest    string  `json:"descriptor_digest"`
}

AttemptReceipt associates a local transition with permanent removal identities.

func (AttemptReceipt) MarshalJSON 

func (v AttemptReceipt) MarshalJSON() ([]byte, error)

MarshalJSON preserves the existing receipt through an explicit decimal wire projection.

func (*AttemptReceipt) UnmarshalJSON 

func (v *AttemptReceipt) UnmarshalJSON(raw []byte) error

UnmarshalJSON requires canonical nested receipt counters.

type AttemptRecord 

type AttemptRecord struct {
	Descriptor AttemptDescriptor `json:"descriptor"`
	State      AttemptState      `json:"state"`
	Receipt    AttemptReceipt    `json:"receipt"`
}

AttemptRecord returns the selected immutable descriptor and bounded state.

type AttemptRecoveryGrant 

type AttemptRecoveryGrant struct {
	Receipt         AttemptReceipt       `json:"receipt"`
	Command         AttemptCommandRecord `json:"command"`
	NewlyAuthorized bool                 `json:"newly_authorized"`
}

AttemptRecoveryGrant cannot authorize a provider call or another native identity.

type AttemptRecoveryInvocation 

type AttemptRecoveryInvocation struct {
	Grant AttemptRecoveryGrant `json:"grant"`
}

AttemptRecoveryInvocation binds producer recovery to an exact stored command and grant.

type AttemptRecoveryRequest 

type AttemptRecoveryRequest struct {
	AttemptRequest

	ReservationID id.ID  `json:"reservation_id"`
	Kind          string `json:"kind"`
	CommandDigest string `json:"command_digest"`
}

AttemptRecoveryRequest requests fresh authority for an already retained command.

func (AttemptRecoveryRequest) MarshalJSON 

func (v AttemptRecoveryRequest) MarshalJSON() ([]byte, error)

MarshalJSON projects AttemptRecoveryRequest parent counters into canonical decimal strings.

func (*AttemptRecoveryRequest) UnmarshalJSON 

func (v *AttemptRecoveryRequest) UnmarshalJSON(raw []byte) error

UnmarshalJSON validates the exact accepted AttemptRecoveryRequest encoding.

type AttemptRef 

type AttemptRef = AttemptRootReference

AttemptRef identifies an immutable descriptor.

type AttemptRequest 

type AttemptRequest struct {
	Command

	AttemptID  id.ID   `json:"attempt_id"`
	Generation Decimal `json:"generation"`
}

AttemptRequest carries fresh parent authority for an existing attempt.

func (AttemptRequest) MarshalJSON 

func (v AttemptRequest) MarshalJSON() ([]byte, error)

MarshalJSON projects AttemptRequest parent counters into canonical decimal strings.

func (*AttemptRequest) UnmarshalJSON 

func (v *AttemptRequest) UnmarshalJSON(raw []byte) error

UnmarshalJSON validates the exact accepted AttemptRequest encoding.

type AttemptRevocation 

type AttemptRevocation struct {
	LocalOperationID    id.ID       `json:"local_operation_id"`
	SchemaVersion       Decimal     `json:"schema_version"`
	AttemptRef          AttemptRef  `json:"attempt_ref"`
	ProviderOperationID id.ID       `json:"provider_operation_id"`
	CoverageDigest      string      `json:"coverage_digest"`
	Disposition         Disposition `json:"disposition"`
	SettlementDigest    string      `json:"settlement_digest,omitempty"`
	RevokedAt           time.Time   `json:"revoked_at"`
	ParentRevision      Decimal     `json:"parent_revision"`
}

AttemptRevocation is a permanent cutoff of every remaining finite issue slot.

type AttemptRootReference 

type AttemptRootReference struct {
	AttemptID        id.ID   `json:"attempt_id"`
	Generation       Decimal `json:"generation"`
	DescriptorDigest string  `json:"descriptor_digest"`
}

AttemptRootReference anchors the original operation without granting permission.

type AttemptSettlement 

type AttemptSettlement struct {
	LocalOperationID    id.ID       `json:"local_operation_id"`
	SchemaVersion       Decimal     `json:"schema_version"`
	AttemptRef          AttemptRef  `json:"attempt_ref"`
	ProviderOperationID id.ID       `json:"provider_operation_id"`
	ResourcesDigest     string      `json:"resources_digest"`
	AdmissionDigest     string      `json:"admission_digest,omitempty"`
	RevocationDigest    string      `json:"revocation_digest,omitempty"`
	Disposition         Disposition `json:"disposition"`
	StepReferences      []string    `json:"step_references"`
	CoverageDigest      string      `json:"coverage_digest"`
	ProducerProfile     string      `json:"producer_profile"`
	VerifierID          string      `json:"verifier_id"`
	Evidence            []byte      `json:"evidence"`
	EvidenceDigest      string      `json:"evidence_digest"`
	SettledAt           time.Time   `json:"settled_at"`
}

AttemptSettlement records whole-operation disposition after complete slot coverage.

type AttemptSettlementReadRequest 

type AttemptSettlementReadRequest struct {
	AttemptBindingKey

	ProviderOperationID id.ID  `json:"provider_operation_id"`
	NativeFenceDigest   string `json:"native_fence_digest"`
}

AttemptSettlementReadRequest selects a native binding independently of aggregate A fences.

type AttemptSettlementRequest 

type AttemptSettlementRequest struct {
	AttemptRequest

	Disposition     Disposition `json:"disposition"`
	ProducerProfile string      `json:"producer_profile"`
	VerifierID      string      `json:"verifier_id"`
	Evidence        []byte      `json:"evidence"`
	SettledAt       time.Time   `json:"settled_at"`
}

AttemptSettlementRequest supplies a qualified producer fact, not caller-selected coverage.

func (AttemptSettlementRequest) MarshalJSON 

func (v AttemptSettlementRequest) MarshalJSON() ([]byte, error)

MarshalJSON projects AttemptSettlementRequest parent counters into canonical decimal strings.

func (*AttemptSettlementRequest) UnmarshalJSON 

func (v *AttemptSettlementRequest) UnmarshalJSON(raw []byte) error

UnmarshalJSON validates the exact accepted AttemptSettlementRequest encoding.

type AttemptStartRequest 

type AttemptStartRequest struct {
	Command

	ActionID            id.ID  `json:"action_id"`
	AttemptID           id.ID  `json:"attempt_id"`
	ProviderOperationID id.ID  `json:"provider_operation_id"`
	VerifierID          string `json:"verifier_id"`
}

AttemptStartRequest reserves both removal identities before the first native call.

func (AttemptStartRequest) MarshalJSON 

func (v AttemptStartRequest) MarshalJSON() ([]byte, error)

MarshalJSON projects AttemptStartRequest parent counters into canonical decimal strings.

func (*AttemptStartRequest) UnmarshalJSON 

func (v *AttemptStartRequest) UnmarshalJSON(raw []byte) error

UnmarshalJSON validates the exact accepted AttemptStartRequest encoding.

type AttemptState 

type AttemptState struct {
	BindingSlots     []byte      `json:"binding_slots"`
	ProviderSlots    []byte      `json:"provider_slots"`
	SchemaVersion    Decimal     `json:"schema_version"`
	AttemptRef       AttemptRef  `json:"attempt_ref"`
	Revision         Decimal     `json:"revision"`
	Phase            string      `json:"phase"`
	AdmissionDigest  string      `json:"admission_digest,omitempty"`
	ProviderIssuedAt *time.Time  `json:"provider_issued_at,omitempty"`
	RevocationDigest string      `json:"revocation_digest,omitempty"`
	SettlementDigest string      `json:"settlement_digest,omitempty"`
	TerminalDigest   string      `json:"terminal_digest,omitempty"`
	Successor        *AttemptRef `json:"successor,omitempty"`
	ClosureDigest    string      `json:"closure_digest,omitempty"`
}

AttemptState indexes immutable facts; its phase alone is never authority.

type AttemptTerminalRecord 

type AttemptTerminalRecord struct {
	LocalOperationID id.ID             `json:"local_operation_id"`
	SchemaVersion    Decimal           `json:"schema_version"`
	Key              AttemptBindingKey `json:"key"`
	DescriptorDigest string            `json:"descriptor_digest"`
	CommandDigest    string            `json:"command_digest"`
	FenceFactDigest  string            `json:"fence_fact_digest"`
	AttemptNativeAcceptance
	ProofVerifiedAt         time.Time `json:"proof_verified_at"`
	ProofValidUntil         time.Time `json:"proof_valid_until"`
	SettlementWitnessDigest string    `json:"settlement_witness_digest"`
}

AttemptTerminalRecord retains one exact accepted Abort or Finish command.

type AuditAcknowledgment 

type AuditAcknowledgment struct {
	Intent  AuditIntent      `json:"intent"`
	Receipt AuditSinkReceipt `json:"receipt"`
}

AuditAcknowledgment records a completely bound sink receipt.

type AuditActor 

type AuditActor struct {
	Subject         string `json:"subject"`
	Unauthenticated bool   `json:"unauthenticated"`
}

AuditActor contains only verified identity or an explicit unauthenticated marker.

type AuditDeliveryPort 

type AuditDeliveryPort interface {
	Deliver(ctx context.Context, request AuditIntent) (AuditSinkReceipt, error)
	Recover(ctx context.Context, request AuditIntent) (AuditSinkReceipt, error)
}

AuditDeliveryPort uses authorized exact idempotent delivery for both methods. Recover may create an absent sink event and is never a read-only lookup.

type AuditIntent 

type AuditIntent struct {
	ID             id.ID      `json:"id"`
	MappingVersion Decimal    `json:"mapping_version"`
	SourceKey      string     `json:"source_key"`
	Installation   string     `json:"installation"`
	Authority      string     `json:"authority"`
	ApplicationID  string     `json:"application_id"`
	OrganizationID string     `json:"organization_id"`
	Actor          AuditActor `json:"actor"`
	Scope          AuditScope `json:"scope"`
	Action         string     `json:"action"`
	ResourceKind   string     `json:"resource_kind"`
	ResourceID     string     `json:"resource_id"`
	Outcome        string     `json:"outcome"`
	Reason         string     `json:"reason"`
	SelectorDigest string     `json:"selector_digest,omitempty"`
	DecisionID     string     `json:"decision_id,omitempty"`
	CorrelationID  string     `json:"correlation_id,omitempty"`
	SourceDigest   string     `json:"source_digest"`
	OccurredAt     time.Time  `json:"occurred_at"`
	AcceptedAt     time.Time  `json:"accepted_at"`
}

AuditIntent is the frozen source content delivered by the independent publisher. MappingVersion and source identity cannot change during sink receipt recovery.

type AuditPage 

type AuditPage struct {
	Items      []AuditIntent `json:"items"`
	NextCursor string        `json:"next_cursor,omitempty"`
}

AuditPage contains bounded immutable intents and its scope-bound continuation.

type AuditPageRequest 

type AuditPageRequest struct {
	Installation string     `json:"installation"`
	Authority    string     `json:"authority"`
	Scope        AuditScope `json:"scope"`
	Cursor       string     `json:"cursor"`
	Limit        int        `json:"limit"`
}

AuditPageRequest selects pending sink delivery in one explicit audit scope.

type AuditScope 

type AuditScope struct {
	Kind        string `json:"kind"`
	TenantID    string `json:"tenant_id"`
	DenialScope string `json:"denial_scope"`
}

AuditScope identifies verified tenant, explicitly authorized global or denial scope.

type AuditSinkReceipt 

type AuditSinkReceipt struct {
	IntentID              id.ID     `json:"intent_id"`
	IntentDigest          string    `json:"intent_digest"`
	MappingVersion        Decimal   `json:"mapping_version"`
	SourceKey             string    `json:"source_key"`
	SourceDigest          string    `json:"source_digest"`
	Installation          string    `json:"installation"`
	Authority             string    `json:"authority"`
	ApplicationID         string    `json:"application_id"`
	OrganizationID        string    `json:"organization_id"`
	NormalizedFingerprint string    `json:"normalized_fingerprint"`
	SinkReceiptID         string    `json:"sink_receipt_id"`
	Receipt               []byte    `json:"receipt"`
	AcceptedAt            time.Time `json:"accepted_at"`
}

AuditSinkReceipt preserves the complete sink binding and normalized fingerprint.

type Command 

type Command struct {
	Key

	ID         id.ID  `json:"id"`
	Revision   uint64 `json:"revision"`
	LeaseEpoch uint64 `json:"lease_epoch"`
	Owner      string `json:"owner"`
}

Command fences local writes. Exact accepted replay returns its original receipt.

type Continuation 

type Continuation struct {
	Key        ControllerKey `json:"key"`
	Revision   uint64        `json:"revision"`
	LeaseOwner string        `json:"lease_owner"`
	LeaseEpoch uint64        `json:"lease_epoch"`
	LeaseUntil time.Time     `json:"lease_until"`
	Cursor     string        `json:"cursor"`
	Pending    []Key         `json:"pending"`
	InFlight   *Key          `json:"in_flight,omitempty"`
}

Continuation preserves the unprocessed page and in-flight slot across restart.

type ContinuationAdvance 

type ContinuationAdvance struct {
	Key              ControllerKey `json:"key"`
	ID               id.ID         `json:"id"`
	ExpectedRevision uint64        `json:"expected_revision"`
	LeaseEpoch       uint64        `json:"lease_epoch"`
	Owner            string        `json:"owner"`
	Duration         time.Duration `json:"duration"`
	Cursor           string        `json:"cursor"`
	Pending          []Key         `json:"pending"`
	InFlight         *Key          `json:"in_flight,omitempty"`
}

ContinuationAdvance replaces one bounded sweep snapshot under a fenced lease.

type ContinuationAssociation 

type ContinuationAssociation struct {
	MaterialID          id.ID      `json:"material_id"`
	MaterialDigest      string     `json:"material_digest"`
	Predecessor         AttemptRef `json:"predecessor"`
	Successor           AttemptRef `json:"successor"`
	ProviderOperationID id.ID      `json:"provider_operation_id"`
}

ContinuationAssociation binds a journal to its typed acceptance.

type ContinuationClosure 

type ContinuationClosure struct {
	SchemaVersion       Decimal             `json:"schema_version"`
	Key                 Key                 `json:"key"`
	ActionID            id.ID               `json:"action_id"`
	MaterialDigest      string              `json:"material_digest"`
	Predecessor         AttemptRef          `json:"predecessor"`
	Successor           AttemptRef          `json:"successor"`
	ProviderOperationID id.ID               `json:"provider_operation_id"`
	Lineage             ContinuationLineage `json:"lineage"`
	Disposition         Disposition         `json:"disposition"`
	RevocationDigest    string              `json:"revocation_digest"`
	SettlementDigest    string              `json:"settlement_digest"`
	CoverageDigest      string              `json:"coverage_digest"`
	PredecessorRevision Decimal             `json:"predecessor_revision"`
	PointerRevision     Decimal             `json:"pointer_revision"`
	ParentRevision      Decimal             `json:"parent_revision"`
	AcceptedAt          time.Time           `json:"accepted_at"`
}

ContinuationClosure commits a definitive nondeletion predecessor transition.

type ContinuationKey 

type ContinuationKey struct {
	Key      Key   `json:"key"`
	ActionID id.ID `json:"action_id"`
}

ContinuationKey selects an immutable typed acceptance.

type ContinuationLineage 

type ContinuationLineage struct {
	SchemaVersion          Decimal      `json:"schema_version"`
	Root                   AttemptRef   `json:"root"`
	RootInitialOperationID id.ID        `json:"root_initial_operation_id"`
	OriginalOperationKey   OperationKey `json:"original_operation_key"`
	FirstMaterialID        id.ID        `json:"first_material_id"`
	FirstMaterialDigest    string       `json:"first_material_digest"`
	FirstSuccessor         AttemptRef   `json:"first_successor"`
}

ContinuationLineage retains the fixed root and first accepted link.

type ContinuationMaterial 

type ContinuationMaterial struct {
	SchemaVersion       Decimal             `json:"schema_version"`
	Request             ContinuationRequest `json:"request"`
	SuccessorGeneration Decimal             `json:"successor_generation"`
	Digest              string              `json:"digest"`
}

ContinuationMaterial retains the exact request and independently derived generation.

type ContinuationReceipt 

type ContinuationReceipt struct {
	Receipt             Receipt       `json:"receipt"`
	ActionReceipt       ActionReceipt `json:"action_receipt"`
	Successor           AttemptRef    `json:"successor"`
	ProviderOperationID id.ID         `json:"provider_operation_id"`
}

ContinuationReceipt retains the original acceptance, never current authority.

func (ContinuationReceipt) MarshalJSON 

func (v ContinuationReceipt) MarshalJSON() ([]byte, error)

MarshalJSON retains receipt counters as canonical decimal strings.

func (*ContinuationReceipt) UnmarshalJSON 

func (v *ContinuationReceipt) UnmarshalJSON(raw []byte) error

UnmarshalJSON validates exact decimal receipt encodings.

type ContinuationRecord 

type ContinuationRecord struct {
	Material ContinuationMaterial `json:"material"`
	Closure  ContinuationClosure  `json:"closure"`
	Receipt  ContinuationReceipt  `json:"receipt"`
}

ContinuationRecord returns immutable historical acceptance material.

type ContinuationRequest 

type ContinuationRequest struct {
	Action              ActionSubmission `json:"action"`
	Predecessor         AttemptRef       `json:"predecessor"`
	SuccessorAttemptID  id.ID            `json:"successor_attempt_id"`
	ProviderOperationID id.ID            `json:"provider_operation_id"`
}

ContinuationRequest closes one settled predecessor without granting a send.

func (ContinuationRequest) MarshalJSON 

func (q ContinuationRequest) MarshalJSON() ([]byte, error)

MarshalJSON encodes all new request counters as canonical decimal strings.

func (*ContinuationRequest) UnmarshalJSON 

func (q *ContinuationRequest) UnmarshalJSON(raw []byte) error

UnmarshalJSON refuses noncanonical, unknown and unbound request fields.

type ControllerConfig 

type ControllerConfig struct {
	Installation     string        `json:"installation"`
	Authority        string        `json:"authority"`
	PageSize         int           `json:"page_size"`
	TargetBudget     int           `json:"target_budget"`
	RemoteCallBudget int           `json:"remote_call_budget"`
	CallTimeout      time.Duration `json:"call_timeout"`
}

ControllerConfig fixes trusted host authority and finite work budgets. Runtime roles are explicit in each accepted immutable manifest, never inferred here.

type ControllerKey 

type ControllerKey struct {
	Installation string     `json:"installation"`
	Authority    string     `json:"authority"`
	Name         string     `json:"name"`
	Scope        AuditScope `json:"scope"`
}

ControllerKey explicitly names a configured global or tenant sweep authority.

type ControllerPageRequest 

type ControllerPageRequest struct {
	Cursor string `json:"cursor,omitempty"`
	Limit  int    `json:"limit"`
}

ControllerPageRequest is reserved for an explicitly authorized independent controller. It enumerates persisted targets even when tenant metadata has been removed.

type ControllerStore 

type ControllerStore interface {
	Store
	RemovalAttemptStore
	RemovalContinuationStore
	ProviderStepFailureAuthority
	AcceptManagedQuiescence(ctx context.Context, request QuiescenceAcceptanceRequest) (Receipt, error)
	ReadManagedQuiescence(ctx context.Context, request QuiescenceKey) (QuiescenceRecord, error)
	AcceptManagedOriginalRegistration(ctx context.Context, request OriginalRegistrationAcceptanceRequest) (Receipt, error)
	RecordManagedOriginalDrain(ctx context.Context, request OriginalDrainAcceptanceRequest) (Receipt, error)
	ReadManagedOriginalLifecycle(ctx context.Context, request OriginalLifecycleKey) (OriginalLifecycleRecord, error)
	SubmitManagedAction(ctx context.Context, request ActionSubmission) (ActionReceipt, error)
	RecordManagedAccessAudit(ctx context.Context, request AccessAuditRequest) (AccessAuditReceipt, error)
	ReadManagedOperation(ctx context.Context, request OperationKey) (OperationState, error)
	AdvanceManagedOperation(ctx context.Context, request OperationAdvance) (OperationState, error)
	ReadManagedContinuation(ctx context.Context, request ControllerKey) (Continuation, error)
	AdvanceManagedContinuation(ctx context.Context, request ContinuationAdvance) (Continuation, error)
	BindManagedRelease(ctx context.Context, request ReleaseBindingRequest) (ReleaseBinding, error)
	ReadManagedRelease(ctx context.Context, request ReleaseKey) (ReleaseBinding, error)
	ListManagedAuditIntents(ctx context.Context, request AuditPageRequest) (AuditPage, error)
	AcknowledgeManagedAudit(ctx context.Context, request AuditAcknowledgment) error
	AuthorizeManagedProviderStep(ctx context.Context, request ProviderStepAuthorization) (ProviderStepGrant, error)
	RecordManagedProviderStepResult(ctx context.Context, request ProviderStepResult) error
	ReadManagedProviderStep(ctx context.Context, request ProviderStepKey) (ProviderStepRecord, error)
}

ControllerStore adds same-authority acceptance and persistence to the lifecycle store. No method performs a remote call or authenticates a caller on behalf of the host.

type Decimal 

type Decimal string

Decimal is the canonical wire encoding for a nonnegative integer. Consumers apply their own semantic bounds after decoding.

func (Decimal) Uint64 

func (d Decimal) Uint64() (uint64, error)

Uint64 rejects signs, leading zeroes, whitespace and overflow.

type Deletion 

type Deletion struct {
	IssuedAt    time.Time   `json:"issued_at"`
	OperationID id.ID       `json:"operation_id"`
	FenceDigest string      `json:"fence_digest"`
	Verifier    string      `json:"verifier"`
	Issued      bool        `json:"issued"`
	Settlement  *Settlement `json:"settlement,omitempty"`
}

Deletion retains a stable external operation identity and its full fence-set digest.

type DesiredMode 

type DesiredMode string

DesiredMode never cancels an outstanding issued operation. 

const (
	Active   DesiredMode = "active"
	Paused   DesiredMode = "paused"
	Retiring DesiredMode = "retiring"
)

type DesiredRequest 

type DesiredRequest struct {
	Command

	Mode DesiredMode `json:"mode"`
}

DesiredRequest changes durable desired state without reopening enrollment.

type Disposition 

type Disposition string

Disposition requires actual provider settlement except for atomic pre-issue revocation. 

const (
	NoResourcesCreated     Disposition = "no_resources_created"
	NotIssued              Disposition = "not_issued"
	Rejected               Disposition = "rejected"
	Cancelled              Disposition = "cancelled"
	Fenced                 Disposition = "fenced"
	SettledWithoutDeletion Disposition = "settled_without_deletion"
	Removed                Disposition = "deleted"
)

type Drain 

type Drain struct {
	OperationID string    `json:"operation_id"`
	Deadline    time.Time `json:"deadline"`
	Complete    bool      `json:"complete"`
	Quiescent   bool      `json:"quiescent"`
	CompletedAt time.Time `json:"completed_at"`
	Evidence    []byte    `json:"evidence"`
}

Drain identifies a single accepted process drain with an immutable deadline.

type DrainHandle 

type DrainHandle struct {
	OperationID   string    `json:"operation_id"`
	HandleID      string    `json:"handle_id"`
	RuntimeID     string    `json:"runtime_id"`
	InstanceID    string    `json:"instance_id"`
	HostID        string    `json:"host_id"`
	Deadline      time.Time `json:"deadline"`
	Receipt       []byte    `json:"receipt"`
	ReceiptDigest string    `json:"receipt_digest"`
}

DrainHandle permanently identifies the original process drain and deadline.

type DrainObservationRequest 

type DrainObservationRequest struct {
	LifecycleRequest

	Drain       DrainHandle `json:"drain"`
	ChallengeID string      `json:"challenge_id"`
}

DrainObservationRequest challenges the original handle on its configured host.

type DrainRequest 

type DrainRequest struct {
	ReservationRequest

	Drain Drain `json:"drain"`
}

DrainRequest captures the original drain identity/deadline or its terminal outcome.

type EffectiveProviderStep 

type EffectiveProviderStep struct {
	Disposition      EffectiveStepDisposition `json:"disposition"`
	StepDigest       string                   `json:"step_digest"`
	SelectionDigest  string                   `json:"selection_digest"`
	PermissionDigest string                   `json:"permission_digest"`
	TerminalDigest   string                   `json:"terminal_digest"`
	ClosureDigest    string                   `json:"closure_digest,omitempty"`
}

EffectiveProviderStep names one fixed logical step and its explicit disposition. A genuinely unissued step has no invocation or fabricated terminal digest.

type EffectiveRemovalBinding 

type EffectiveRemovalBinding struct {
	Binding RemovalRecoveryBinding `json:"binding"`
	Proof   RecoveryAssociation    `json:"proof"`
}

EffectiveRemovalBinding pins one original binding and an independently accepted native guard proof. The enclosing coverage commits the ordered leaf associations. Historical guard proof expiry does not fabricate current process liveness.

type EffectiveRemovalCoverage 

type EffectiveRemovalCoverage struct {
	Key                 AttemptKey              `json:"key"`
	AttemptRef          AttemptRef              `json:"attempt_ref"`
	ProviderOperationID id.ID                   `json:"provider_operation_id"`
	ResourcesDigest     string                  `json:"resources_digest"`
	AdmissionDigest     string                  `json:"admission_digest"`
	Cutoff              RecoveryAssociation     `json:"cutoff"`
	Disposition         Disposition             `json:"disposition"`
	Steps               []EffectiveProviderStep `json:"steps"`
	BindingCount        Decimal                 `json:"binding_count"`
	BindingSetDigest    string                  `json:"binding_set_digest"`
}

EffectiveRemovalCoverage contains the fixed finite step set, without retry history.

type EffectiveStepDisposition 

type EffectiveStepDisposition string

EffectiveStepDisposition distinguishes never-issued slots from resolved invocations. No unresolved or uncertain observation is a terminal coverage disposition. 

const (
	// EffectiveStepUnissued requires the original fixed selection to be unissued.
	EffectiveStepUnissued EffectiveStepDisposition = "unissued"
	// EffectiveStepRemoved requires the selected invocation's exact positive result.
	EffectiveStepRemoved EffectiveStepDisposition = "removed"
	// EffectiveStepClosed requires affirmative before-delegation custody closure.
	EffectiveStepClosed EffectiveStepDisposition = "closed_no_dispatch"
)

type Fence 

type Fence struct {
	CompatibilityEvidence []byte    `json:"compatibility_evidence"`
	Epoch                 uint64    `json:"epoch"`
	Evidence              []byte    `json:"evidence"`
	Digest                string    `json:"digest"`
	ValidUntil            time.Time `json:"valid_until"`
	Survivors             []string  `json:"survivors"`
}

Fence preserves the full opaque removal fence and its off-instance survivor set.

type FenceRequest 

type FenceRequest struct {
	ReservationRequest

	Fence Fence `json:"fence"`
}

FenceRequest captures one immutable binding fence.

type Guard 

type Guard struct {
	// contains filtered or unexported fields
}

Guard reads protection from the same object used for ordinary persistence.

func NewGuard 

func NewGuard(authority any) *Guard

NewGuard installs protection even when the authority cannot supply the capability.

func (*Guard) CheckInstance 

func (g *Guard) CheckInstance(ctx context.Context, key Key, action string) error

CheckInstance refuses generic writes to every retained managed identity.

func (*Guard) CheckOwner 

func (g *Guard) CheckOwner(ctx context.Context, key OwnerKey, action string) error

CheckOwner protects retained manifest ownership after mutable rows disappear.

func (*Guard) CheckTenant 

func (g *Guard) CheckTenant(ctx context.Context, tenantID string) error

CheckTenant refuses removal while the authority retains managed ownership.

func (*Guard) UsesAuthority 

func (g *Guard) UsesAuthority(candidate any) bool

UsesAuthority proves identity of the actual persistence object without exposing it. Value-shaped, nil and otherwise indeterminate authorities cannot prove identity.

type GuardedOriginalMaterializationRequest 

type GuardedOriginalMaterializationRequest struct {
	Command       RecoveryCommand `json:"command"`
	Step          ProviderStepKey `json:"step"`
	PendingDigest string          `json:"pending_digest"`
}

GuardedOriginalMaterializationRequest fixes the authenticated provider identity for the same pending permission and its original native guard proof set.

type GuardedOriginalPermission 

type GuardedOriginalPermission struct {
	Original      ProviderEffectOriginal `json:"original"`
	PendingDigest string                 `json:"pending_digest"`
}

GuardedOriginalPermission supplies evidence identity only. Callers must obtain the exact native binds and fresh one-shot marker before delegating transport.

type GuardedOriginalRequest 

type GuardedOriginalRequest struct {
	Command RecoveryCommand `json:"command"`
	Step    ProviderStepKey `json:"step"`
}

GuardedOriginalRequest accepts a nonissuing original permission for exact configured provider evidence retention. It never grants transport delegation.

type HistoricalSettlement 

type HistoricalSettlement struct {
	Request            HistoricalSettlementRequest `json:"request"`
	Physical           Physical                    `json:"physical"`
	Resources          map[string]string           `json:"resources"`
	Steps              []WireProviderStepRecord    `json:"steps"`
	Disposition        Disposition                 `json:"disposition"`
	RevokedBeforeIssue bool                        `json:"revoked_before_issue"`
	Settlement         Settlement                  `json:"settlement"`
	Receipt            WireReceipt                 `json:"receipt"`
}

HistoricalSettlement preserves full resource and step coverage for a trusted verifier. A missing record is unresolved and never proof that a command was not issued.

func (HistoricalSettlement) Validate 

func (q HistoricalSettlement) Validate() error

Validate preserves bounded historical evidence without fabricating terminal status.

type HistoricalSettlementReader 

type HistoricalSettlementReader interface {
	ReadManagedHistoricalSettlement(ctx context.Context, request HistoricalSettlementRequest) (HistoricalSettlement, error)
}

HistoricalSettlementReader reads accepted settlement without invoking reconciliation. It includes retained continuation settlements within the fixed removal profile.

type HistoricalSettlementRequest 

type HistoricalSettlementRequest struct {
	Key

	SchemaVersion Decimal `json:"schema_version"`

	Installation        string  `json:"installation"`
	Authority           string  `json:"authority"`
	ManifestDigest      string  `json:"manifest_digest"`
	Seal                Decimal `json:"seal"`
	AttemptID           id.ID   `json:"attempt_id"`
	AttemptGeneration   Decimal `json:"attempt_generation"`
	ProviderOperationID id.ID   `json:"provider_operation_id"`
	FenceDigest         string  `json:"fence_digest"`
}

HistoricalSettlementRequest selects an exact historical removal association.

func (HistoricalSettlementRequest) Validate 

func (q HistoricalSettlementRequest) Validate() error

Validate checks the historical request without accepting a caller-selected verifier.

type Identity 

type Identity struct {
	Key

	ProvisionOperationID id.ID    `json:"provision_operation_id"`
	Physical             Physical `json:"physical"`
	Manifest             Manifest `json:"manifest"`
}

Identity is allocated before any provisioning or registration call.

type Key 

type Key struct {
	TenantID   string `json:"tenant_id"`
	InstanceID id.ID  `json:"instance_id"`
}

Key names a tenant-owned physical instance. Instance IDs are never reused.

type LeaseRequest 

type LeaseRequest struct {
	Command

	Duration time.Duration `json:"duration"`
}

LeaseRequest acquires or renews a lease with a fresh fenced epoch.

type LifecycleAcceptance 

type LifecycleAcceptance struct {
	Outcome        PortOutcome `json:"outcome"`
	Command        PortCommand `json:"command"`
	Binding        RoleBinding `json:"binding"`
	ReceiptID      string      `json:"receipt_id"`
	ReceiptVersion Decimal     `json:"receipt_version"`
	Receipt        []byte      `json:"receipt"`
	ReceiptDigest  string      `json:"receipt_digest"`
	AcceptedAt     time.Time   `json:"accepted_at"`
}

LifecycleAcceptance preserves the complete native acceptance and its identity.

func (LifecycleAcceptance) Validate 

func (q LifecycleAcceptance) Validate() error

Validate preserves complete native acceptance, separate from a successful observation.

type LifecycleObservation 

type LifecycleObservation struct {
	Outcome         PortOutcome `json:"outcome"`
	Binding         RoleBinding `json:"binding"`
	Drain           DrainHandle `json:"drain"`
	AdmissionClosed bool        `json:"admission_closed"`
	ActiveClaims    Decimal     `json:"active_claims"`
	UnknownClaims   Decimal     `json:"unknown_claims"`
	Complete        bool        `json:"complete"`
	Quiescent       bool        `json:"quiescent"`
	CompletedAt     time.Time   `json:"completed_at"`
	ObservedAt      time.Time   `json:"observed_at"`
	ValidUntil      time.Time   `json:"valid_until"`
	ObservationID   string      `json:"observation_id"`
	ChallengeID     string      `json:"challenge_id"`
	VerifierID      string      `json:"verifier_id"`
	Evidence        []byte      `json:"evidence"`
}

LifecycleObservation separates immutable drain results from fresh observations.

func (LifecycleObservation) Validate 

func (q LifecycleObservation) Validate() error

Validate checks the original drain handle, permanent closure and fresh proof fields.

type LifecyclePort 

type LifecyclePort interface {
	Inspect(ctx context.Context, request LifecycleRequest) (LifecycleObservation, error)
	Register(ctx context.Context, request LifecycleRequest) (LifecycleAcceptance, error)
	LookupRegistration(ctx context.Context, request LifecycleRequest) (LifecycleAcceptance, error)
	BeginDrain(ctx context.Context, request DrainObservationRequest) (LifecycleAcceptance, error)
	ObserveDrain(ctx context.Context, request DrainObservationRequest) (LifecycleObservation, error)
	PrepareRemoval(ctx context.Context, request RemovalBinding) (RemovalAcceptance, error)
	VerifyFence(ctx context.Context, request RemovalBinding) (RemovalAcceptance, error)
	FinishRemoval(ctx context.Context, request RemovalBinding) (RemovalAcceptance, error)
	AbortRemoval(ctx context.Context, request RemovalBinding) (RemovalAcceptance, error)
}

LifecyclePort connects only to trusted, preconfigured lifecycle authorities. A missing result or expired proof never establishes nonissuance or settlement.

type LifecycleRequest 

type LifecycleRequest struct {
	Command PortCommand `json:"command"`
	Binding RoleBinding `json:"binding"`
}

LifecycleRequest addresses an accepted reservation and its original command.

func (LifecycleRequest) Validate 

func (q LifecycleRequest) Validate() error

Validate enforces the version and individual proof bounds before a lifecycle call.

type MachineContextFactory 

type MachineContextFactory interface {
	Context(ctx context.Context, request MachineScope) (context.Context, error)
}

MachineContextFactory supplies verified identities without synthesizing roles.

type MachineScope 

type MachineScope struct {
	GlobalEnumeration bool   `json:"global_enumeration"`
	Installation      string `json:"installation"`
	Application       string `json:"application"`
	Environment       string `json:"environment"`
	TenantID          string `json:"tenant_id"`
	Action            string `json:"action"`
	ResourceID        string `json:"resource_id"`
}

MachineScope distinguishes authenticated enumeration from tenant mutation. The host resolves credentials from configuration and authenticates on each use.

type ManagedPlan 

type ManagedPlan struct {
	SchemaVersion Decimal       `json:"schema_version"`
	Identity      WireIdentity  `json:"identity"`
	ActionID      id.ID         `json:"action_id"`
	Provision     ProvisionSpec `json:"provision"`
	CreateProfile string        `json:"create_profile"`
}

ManagedPlan freezes the exact first-profile service and resource set before execution.

func (ManagedPlan) Validate 

func (q ManagedPlan) Validate() error

Validate checks the bounded first profile without resolving private startup material.

type ManagedProvider 

type ManagedProvider interface {
	ValidatePlan(ctx context.Context, request ManagedPlan) error
	InspectResources(ctx context.Context, request ManagedPlan) (ResourceObservation, error)
	ExecuteProvision(ctx context.Context, request ManagedPlan) (ProviderExecutionResult, error)
	ExecuteRemoval(ctx context.Context, request RemovalPlan) (ProviderExecutionResult, error)
	SampleServices(ctx context.Context, request ManagedPlan) ([]ServiceSample, error)
}

ManagedProvider is separate from ordinary provider strategies and mutation retries. The implementation persists each typed permission before its one external send.

type ManagedSpec 

type ManagedSpec struct {
	Profile      string          `json:"profile"`
	RuntimeRoles []RuntimeRole   `json:"runtime_roles"`
	Provision    json.RawMessage `json:"provision"`
}

ManagedSpec preserves role order alongside the immutable provider configuration. Parsing this envelope does not validate provider execution or remote readiness.

func ParseManagedSpec 

func ParseManagedSpec(m Manifest) (ManagedSpec, error)

ParseManagedSpec validates the explicit controller profile without rewriting bytes. Legacy manifests remain readable through Store but cannot gain new issue permission.

type ManagedWriterFloorHistoryReader 

type ManagedWriterFloorHistoryReader interface {
	ReadManagedWriterFloorActivation(ctx context.Context, reference WriterFloorReference) (WriterFloor, error)
}

ManagedWriterFloorHistoryReader provides exact inspection without moving current. Runtime stores deliberately expose no floor activation or downgrade method here.

type ManagedWriterFloorReader 

type ManagedWriterFloorReader interface {
	ReadManagedWriterFloor(ctx context.Context) (WriterFloor, error)
}

ManagedWriterFloorReader reads the configured authority's protected current activation. Implementations validate its identical immutable history row in one read snapshot. Missing metadata refuses; historical target reads remain separate and nonissuing.

type Manifest 

type Manifest struct {
	Version    uint64   `json:"version"`
	Members    []Member `json:"members"`
	Spec       []byte   `json:"spec"`
	SpecDigest string   `json:"spec_digest"`
}

Manifest contains the immutable, non-secret provision specification and bindings.

type Member 

type Member struct {
	Name                string `json:"name"`
	Service             string `json:"service"`
	OwnerID             id.ID  `json:"owner_id,omitzero"`
	Installation        string `json:"installation"`
	Namespace           string `json:"namespace"`
	Queue               string `json:"queue"`
	Build               string `json:"build"`
	ArtifactDigest      string `json:"artifact_digest"`
	ConfigurationDigest string `json:"configuration_digest"`
}

Member freezes one permitted binding within the whole-instance manifest.

type OperationAdvance 

type OperationAdvance struct {
	Command

	ActionID                  id.ID                `json:"action_id"`
	ExpectedOperationRevision uint64               `json:"expected_operation_revision"`
	Observation               OperationObservation `json:"observation"`
}

OperationAdvance applies a parent-fenced journal CAS and retains the exact retry result.

type OperationKey 

type OperationKey struct {
	Key

	ActionID id.ID `json:"action_id"`
}

OperationKey selects one retained accepted action in its original tenant.

type OperationObservation 

type OperationObservation struct {
	Kind       string       `json:"kind"`
	Command    *PortCommand `json:"command,omitempty"`
	Evidence   []byte       `json:"evidence,omitempty"`
	RetryAt    time.Time    `json:"retry_at"`
	Diagnostic string       `json:"diagnostic,omitempty"`
	ObservedAt time.Time    `json:"observed_at"`
}

OperationObservation reports a finite progress fact and the original remote command. Neither phase nor a successful observation grants permission for a provider call.

type OperationState 

type OperationState struct {
	RemovalAttemptRoot      *AttemptRootReference    `json:"removal_attempt_root,omitempty"`
	ContinuationAssociation *ContinuationAssociation `json:"continuation_association,omitempty"`
	Key                     OperationKey             `json:"key"`
	Submission              ActionSubmission         `json:"submission"`
	Receipt                 ActionReceipt            `json:"receipt"`
	Revision                uint64                   `json:"revision"`
	Observation             OperationObservation     `json:"observation"`
}

OperationState retains original commands and bounded progress without issue authority.

type OriginalCommand 

type OriginalCommand struct {
	Key

	ID            id.ID   `json:"id"`
	Revision      Decimal `json:"revision"`
	LeaseEpoch    Decimal `json:"lease_epoch"`
	Owner         string  `json:"owner"`
	ReservationID id.ID   `json:"reservation_id"`
}

OriginalCommand retains the parent CAS using canonical decimal wire counters.

func (OriginalCommand) LocalCommand 

func (c OriginalCommand) LocalCommand() (Command, error)

LocalCommand validates the signed parent counter domain without changing A's codec.

type OriginalDrainAcceptanceRequest 

type OriginalDrainAcceptanceRequest struct {
	Command             OriginalCommand    `json:"command"`
	Facts               OriginalDrainFacts `json:"facts"`
	NativeReceipt       []byte             `json:"native_receipt"`
	NativeReceiptDigest string             `json:"native_receipt_digest"`
}

OriginalDrainAcceptanceRequest records acceptance only, without terminal outcome fields.

type OriginalDrainFacts 

type OriginalDrainFacts struct {
	Process         OriginalProcessFacts     `json:"process"`
	Native          OriginalNativeAcceptance `json:"native"`
	OperationID     string                   `json:"operation_id"`
	Deadline        time.Time                `json:"deadline"`
	ProcessAccepted bool                     `json:"process_accepted"`
	AdmissionClosed bool                     `json:"admission_closed"`
	ObservedAt      time.Time                `json:"observed_at"`
}

OriginalDrainFacts retains process acceptance and permanent admission closure. Native control identifies its handle solely by runtime, operation and deadline.

type OriginalLifecycleKey 

type OriginalLifecycleKey struct {
	Key

	Kind        string `json:"kind"`
	OperationID id.ID  `json:"operation_id"`
}

OriginalLifecycleKey selects an exact original operation in a canonical target scope.

type OriginalLifecycleMaterial 

type OriginalLifecycleMaterial struct {
	Command              OriginalCommand            `json:"command"`
	Kind                 string                     `json:"kind"`
	TargetIdentityDigest string                     `json:"target_identity_digest"`
	Registration         *OriginalRegistrationFacts `json:"registration,omitempty"`
	Drain                *OriginalDrainFacts        `json:"drain,omitempty"`
	NativeReceipt        []byte                     `json:"native_receipt"`
	NativeReceiptDigest  string                     `json:"native_receipt_digest"`
}

OriginalLifecycleMaterial is the sole immutable material snapshot in a retained row. Material hashing excludes the computed reference and local receipt.

func (OriginalLifecycleMaterial) Normalize 

func (m OriginalLifecycleMaterial) Normalize() (OriginalLifecycleMaterial, error)

Normalize validates leaf shape and normalizes the timestamp codec to UTC. It does not authenticate producers or interpret the native receipt schema.

type OriginalLifecycleRecord 

type OriginalLifecycleRecord struct {
	Material  OriginalLifecycleMaterial  `json:"material"`
	Reference OriginalLifecycleReference `json:"reference"`
	Receipt   OriginalLocalReceipt       `json:"receipt"`
}

OriginalLifecycleRecord retains material, its computed reference and the original local result.

func ParseOriginalLifecycleRecord 

func ParseOriginalLifecycleRecord(raw []byte) (OriginalLifecycleRecord, error)

ParseOriginalLifecycleRecord refuses noncanonical or internally inconsistent retained rows.

type OriginalLifecycleReference 

type OriginalLifecycleReference struct {
	Schema               string `json:"schema"`
	Kind                 string `json:"kind"`
	OperationID          id.ID  `json:"operation_id"`
	TargetIdentityDigest string `json:"target_identity_digest"`
	FactsDigest          string `json:"facts_digest"`
	NativeReceiptDigest  string `json:"native_receipt_digest"`
	MaterialDigest       string `json:"material_digest"`
}

OriginalLifecycleReference is the canonical compact association saved in A's evidence.

func OriginalReference 

func OriginalReference(m OriginalLifecycleMaterial) (OriginalLifecycleReference, error)

OriginalReference derives all compact associations from a normalized material snapshot.

func ParseOriginalReference 

func ParseOriginalReference(raw []byte) (OriginalLifecycleReference, error)

ParseOriginalReference accepts only byte-exact canonical typed JSON.

func (OriginalLifecycleReference) Bytes 

func (r OriginalLifecycleReference) Bytes() ([]byte, error)

Bytes returns the fixed typed reference JSON and enforces its actual byte bound.

type OriginalLocalReceipt 

type OriginalLocalReceipt struct {
	ID         id.ID     `json:"id"`
	Digest     string    `json:"digest"`
	Revision   Decimal   `json:"revision"`
	LeaseEpoch Decimal   `json:"lease_epoch"`
	AcceptedAt time.Time `json:"accepted_at"`
	LeaseUntil time.Time `json:"lease_until"`
}

OriginalLocalReceipt projects the unchanged A receipt into decimal adapter-facing counters.

func OriginalReceipt 

func OriginalReceipt(r Receipt) OriginalLocalReceipt

OriginalReceipt projects a saved local receipt without changing its timestamps or digest.

type OriginalNativeAcceptance 

type OriginalNativeAcceptance struct {
	Operation       string    `json:"operation"`
	RequestID       string    `json:"request_id"`
	RequestDigest   string    `json:"request_digest"`
	CommandDigest   string    `json:"command_digest"`
	ResponseVersion Decimal   `json:"response_version"`
	DeliveryID      string    `json:"delivery_id"`
	AcceptedAt      time.Time `json:"accepted_at"`
}

OriginalNativeAcceptance keeps the native request and operator digest domains distinct.

type OriginalProcessFacts 

type OriginalProcessFacts struct {
	Installation             string            `json:"installation"`
	Namespace                string            `json:"namespace"`
	Build                    string            `json:"build"`
	Queue                    string            `json:"queue"`
	RuntimeID                string            `json:"runtime_id"`
	InstanceID               string            `json:"instance_id"`
	HostID                   string            `json:"host_id"`
	IdentityVersion          Decimal           `json:"identity_version"`
	ArtifactDigest           string            `json:"artifact_digest"`
	ConfigurationDigest      string            `json:"configuration_digest"`
	ConfigurationVersion     string            `json:"configuration_version"`
	EnrollmentEvidenceDigest string            `json:"enrollment_evidence_digest"`
	ProbePolicyID            string            `json:"probe_policy_id"`
	ProbePolicyVersion       Decimal           `json:"probe_policy_version"`
	MaximumProofValidityNS   Decimal           `json:"maximum_proof_validity_ns"`
	VerifierID               string            `json:"verifier_id"`
	Descriptor               StartupBindingRef `json:"descriptor"`
	ProducerVerifier         string            `json:"producer_verifier"`
}

OriginalProcessFacts binds the native process to an immutable startup descriptor. ConfigurationVersion is an opaque native token, not a numeric counter.

type OriginalRegistrationAcceptanceRequest 

type OriginalRegistrationAcceptanceRequest struct {
	Command             OriginalCommand           `json:"command"`
	Facts               OriginalRegistrationFacts `json:"facts"`
	NativeReceipt       []byte                    `json:"native_receipt"`
	NativeReceiptDigest string                    `json:"native_receipt_digest"`
}

OriginalRegistrationAcceptanceRequest supplies validated leaf facts and opaque export bytes. The caller authenticates and validates the native export before using this capability.

type OriginalRegistrationFacts 

type OriginalRegistrationFacts struct {
	Process             OriginalProcessFacts     `json:"process"`
	Native              OriginalNativeAcceptance `json:"native"`
	Member              string                   `json:"member"`
	Role                RuntimeRole              `json:"role"`
	StoredCommandDigest string                   `json:"stored_command_digest"`
	BindingVersion      Decimal                  `json:"binding_version"`
	BindingState        string                   `json:"binding_state"`
	RemovalEpoch        Decimal                  `json:"removal_epoch"`
	CreatedAt           time.Time                `json:"created_at"`
	ChangedAt           time.Time                `json:"changed_at"`
}

OriginalRegistrationFacts describes only the originally accepted initial binding. The exact reservation is retained once in the material's OriginalCommand.

type OriginalRemovalRecoveryPort 

type OriginalRemovalRecoveryPort interface {
	RecoverOriginalRemoval(ctx context.Context, request AttemptRecoveryInvocation) (AttemptNativeAcceptance, error)
}

OriginalRemovalRecoveryPort invokes only the same authenticated native idempotent request.

type OwnerKey 

type OwnerKey struct {
	TenantID string `json:"tenant_id"`
	OwnerID  id.ID  `json:"owner_id"`
}

OwnerKey identifies the immutable workload owner within a tenant.

func (OwnerKey) Validate 

func (k OwnerKey) Validate() error

Validate refuses incomplete owner scopes before consulting persistence.

type OwnerProtectionStore 

type OwnerProtectionStore interface {
	InspectManagedOwnerProtection(ctx context.Context, key OwnerKey) (Protection, error)
}

OwnerProtectionStore derives ownership from retained immutable target manifests. Implementations must share the ordinary workload persistence authority.

type OwnerReservation 

type OwnerReservation struct {
	OwnerID id.ID `json:"owner_id"`
	Origin  Key   `json:"origin"`
}

OwnerReservation permanently binds a fresh owner to its original managed target.

type Page 

type Page struct {
	Items      []Summary `json:"items"`
	NextCursor string    `json:"next_cursor,omitempty"`
}

Page returns a bounded stable continuation independent of mutable instance rows.

type PageRequest 

type PageRequest struct {
	TenantID string `json:"tenant_id"`
	Cursor   string `json:"cursor,omitempty"`
	Limit    int    `json:"limit"`
}

PageRequest is tenant scoped. Controllers page each explicitly authorized tenant.

type Phase 

type Phase string

Phase closes enrollment independently of the desired mode. 

const (
	Open         Phase = "open"
	Sealed       Phase = "sealed_pending"
	Admitted     Phase = "removal_admitted"
	DeleteIssued Phase = "delete_may_have_issued"
	Deleted      Phase = "deleted"
)

type PhaseCommandGrant 

type PhaseCommandGrant struct {
	Record        PhaseCommandRecord `json:"record"`
	NewlyRetained bool               `json:"newly_retained"`
}

PhaseCommandGrant distinguishes fresh retention from exact historical recovery. Every remote call still needs current host authorization and its native recovery semantics.

type PhaseCommandRecord 

type PhaseCommandRecord struct {
	Schema        string               `json:"schema"`
	Request       PhaseCommandRequest  `json:"request"`
	RequestDigest string               `json:"request_digest"`
	Acceptance    OriginalLocalReceipt `json:"acceptance"`
	AuditReceipt  AccessAuditReceipt   `json:"audit_receipt"`
	Work          WorkReference        `json:"work"`
}

PhaseCommandRecord is immutable may-have-issued accounting, never remote acceptance. Acceptance binds the full request through the independent parent receipt history.

func DecodePhaseCommandRecord 

func DecodePhaseCommandRecord(raw []byte) (PhaseCommandRecord, error)

DecodePhaseCommandRecord refuses any alternate JSON representation of retained commands.

type PhaseCommandRequest 

type PhaseCommandRequest struct {
	Schema   string               `json:"schema"`
	Parent   PhaseParent          `json:"parent"`
	ActionID id.ID                `json:"action_id"`
	Kind     string               `json:"kind"`
	Process  *ProcessPhaseCommand `json:"process,omitempty"`
	Route    *RoutingRequest      `json:"route,omitempty"`
	Audit    AccessAuditRequest   `json:"audit"`
}

PhaseCommandRequest retains one original request and required fresh access decision. Kind is registration, drain, route or activation. Removal attempt commands remain B2.3.

func ClonePhaseCommandRequest 

func ClonePhaseCommandRequest(q PhaseCommandRequest) (PhaseCommandRequest, error)

ClonePhaseCommandRequest freezes caller-owned commands and proof bytes before locking.

type PhaseCommandStore 

type PhaseCommandStore interface {
	RetainManagedPhaseCommand(ctx context.Context, request PhaseCommandRequest) (PhaseCommandGrant, error)
	ReadManagedPhaseCommand(ctx context.Context, reference WorkReference) (PhaseCommandRecord, error)
}

PhaseCommandStore retains original commands in the same authority transaction as issuance. Result/closure attachment remains separately owned by exact native/recovery protocols.

type PhaseNativeIdentity 

type PhaseNativeIdentity struct {
	Operation     string `json:"operation"`
	RequestID     string `json:"request_id"`
	RequestDigest string `json:"request_digest"`
	CommandDigest string `json:"command_digest"`
}

PhaseNativeIdentity preserves the native canonical digest domains independently of byte hashes. Configured C verifies translation before retention; storage never derives these from byte SHA.

type PhaseOriginalResult 

type PhaseOriginalResult struct {
	Schema          string                     `json:"schema"`
	Request         PhaseOriginalResultRequest `json:"request"`
	Original        OriginalLifecycleReference `json:"original"`
	OriginalReceipt OriginalLocalReceipt       `json:"original_receipt"`
	Acceptance      OriginalLocalReceipt       `json:"acceptance"`
	AuditReceipt    AccessAuditReceipt         `json:"audit_receipt"`
}

PhaseOriginalResult records accepted native progress while keeping the work unresolved. The original reference and receipt are independently re-read, never caller attestations.

func DecodePhaseOriginalResult 

func DecodePhaseOriginalResult(raw []byte) (PhaseOriginalResult, error)

DecodePhaseOriginalResult refuses noncanonical, ambiguous or oversized result links.

type PhaseOriginalResultRequest 

type PhaseOriginalResultRequest struct {
	Schema   string               `json:"schema"`
	Parent   PhaseParent          `json:"parent"`
	Work     WorkReference        `json:"work"`
	Original OriginalLifecycleKey `json:"original"`
	Audit    AccessAuditRequest   `json:"audit"`
}

PhaseOriginalResultRequest links a retained phase to independently accepted B2.2 material. It cannot create native facts, mark work resolved, or replace the original command.

func (PhaseOriginalResultRequest) Validate 

func (q PhaseOriginalResultRequest) Validate() error

Validate checks a closed original-result request without granting remote authority.

type PhaseOriginalResultStore 

type PhaseOriginalResultStore interface {
	AttachManagedPhaseOriginalResult(ctx context.Context, request PhaseOriginalResultRequest) (PhaseOriginalResult, error)
	ReadManagedPhaseOriginalResult(ctx context.Context, reference WorkReference) (PhaseOriginalResult, error)
}

PhaseOriginalResultStore attaches exact accepted registration/drain progress only. Provider terminal coverage, route and host activation results use their own authority.

type PhaseParent 

type PhaseParent struct {
	Key

	ID         id.ID   `json:"id"`
	Revision   Decimal `json:"revision"`
	LeaseEpoch Decimal `json:"lease_epoch"`
	Owner      string  `json:"owner"`
}

PhaseParent preserves parent CAS in canonical decimal adapter-facing counters.

func (PhaseParent) LocalCommand 

func (p PhaseParent) LocalCommand() (Command, error)

LocalCommand validates signed authority counters without changing their stored digest.

type Physical 

type Physical struct {
	Provider   string `json:"provider"`
	Placement  string `json:"placement"`
	Project    string `json:"project"`
	Generation string `json:"generation"`
}

Physical identifies the provider namespace and permanently reserved resource name.

type PortCommand 

type PortCommand struct {
	SchemaVersion  Decimal `json:"schema_version"`
	OperationID    id.ID   `json:"operation_id"`
	RequestID      string  `json:"request_id"`
	Original       []byte  `json:"original"`
	OriginalDigest string  `json:"original_digest"`
	Native         []byte  `json:"native"`
	NativeDigest   string  `json:"native_digest"`
}

PortCommand retains both digest domains and the original immutable commands. Endpoints, verifier selection and credentials are trusted host configuration. Schema 1 bounds each payload to 4096 bytes. Schema 2 keeps the same combined 8192-byte budget, allowing larger native requests while original stays <=4096.

func (PortCommand) Validate 

func (c PortCommand) Validate() error

Validate checks the frozen command envelopes without translating their digest domains.

type PortOutcome 

type PortOutcome string

PortOutcome keeps absence distinct from acceptance and definitive settlement. 

const (
	PortAbsent      PortOutcome = "absent"
	PortDenied      PortOutcome = "denied"
	PortUnavailable PortOutcome = "unavailable"
	PortConflict    PortOutcome = "conflict"
	PortAccepted    PortOutcome = "accepted"
	PortTerminal    PortOutcome = "terminal"
)

type Ports 

type Ports struct {
	Machine   MachineContextFactory
	Lifecycle LifecyclePort
	Routing   RoutingPort
	Provider  ManagedProvider
	Audit     AuditDeliveryPort
}

Ports contains host capabilities required before later managed consumers start.

type ProcessPhaseCommand 

type ProcessPhaseCommand struct {
	Native         PhaseNativeIdentity  `json:"native"`
	Request        LifecycleRequest     `json:"request"`
	Process        OriginalProcessFacts `json:"process"`
	DrainOperation string               `json:"drain_operation"`
	Deadline       time.Time            `json:"deadline"`
	Scope          MachineScope         `json:"scope"`
}

ProcessPhaseCommand binds registration, drain or activation to the exact startup mapping. DrainOperation/Deadline exist only for a drain; an observed handle cannot replace them.

type ProjectionReceipt 

type ProjectionReceipt struct {
	Receipt

	ActionID   id.ID           `json:"action_id"`
	Target     Key             `json:"target"`
	OwnerID    id.ID           `json:"owner_id,omitzero"`
	ReleaseID  id.ID           `json:"release_id"`
	SpecDigest string          `json:"spec_digest"`
	Stage      ProjectionStage `json:"stage"`
}

ProjectionReceipt is the immutable result of atomic row and release association writes.

type ProjectionRequest 

type ProjectionRequest struct {
	Command

	ActionID id.ID           `json:"action_id"`
	Stage    ProjectionStage `json:"stage"`
}

ProjectionRequest selects persisted acceptance and parent CAS, never arbitrary rows.

type ProjectionStage 

type ProjectionStage string

ProjectionStage selects a supported authoritative ordinary-row projection. 

const ProjectionPending ProjectionStage = "pending"

ProjectionPending exposes reserved identities without asserting provider completion.

type Protection 

type Protection struct {
	Protected bool   `json:"protected"`
	Phase     Phase  `json:"phase,omitempty"`
	Revision  uint64 `json:"revision"`
}

Protection distinguishes authoritative absence from unavailable capability or failed reads.

func InspectOwnerTarget 

func InspectOwnerTarget(t *Target, stored Key, owner OwnerKey) (Protection, error)

InspectOwnerTarget validates a retained row before deriving immutable ownership. You must pass the row key separately so malformed documents cannot hide ownership.

type ProtectionStore 

type ProtectionStore interface {
	InspectManagedProtection(ctx context.Context, request Key) (Protection, error)
	HasManagedObligations(ctx context.Context, request string) (bool, error)
}

ProtectionStore is independent of controller startup and optional lifecycle ports. Implementations must read the same authority as instance persistence, including tombstones.

func RequireProtection 

func RequireProtection(s any) (ProtectionStore, error)

RequireProtection refuses a wrapper or backend which cannot supply authoritative protection.

type ProviderEffectBindingFacts 

type ProviderEffectBindingFacts struct {
	Original              ProviderEffectOriginal   `json:"original"`
	Producer              RecoveryProducerIdentity `json:"producer"`
	Command               []byte                   `json:"command"`
	ProviderCommandDigest string                   `json:"provider_command_digest"`
	Attestation           []byte                   `json:"attestation"`
}

ProviderEffectBindingFacts carry authenticated command and resource custody evidence. Command contains canonical non-secret JSON; Attestation must also be safe to retain.

type ProviderEffectBindingHost 

type ProviderEffectBindingHost struct {
	Producer         ProviderEffectBindingProducer
	Verifier         ProviderEffectBindingVerifier
	Identity         RecoveryProducerIdentity
	Provider         string
	BackendAuthority string
}

ProviderEffectBindingHost is trusted composition, independent of complete recovery. Provider and BackendAuthority are fixed by host configuration, never request fields.

type ProviderEffectBindingKey 

type ProviderEffectBindingKey struct {
	AttemptKey

	Step              ProviderStepKey `json:"step"`
	OriginalCommandID id.ID           `json:"original_command_id"`
}

ProviderEffectBindingKey selects the original invocation within one immutable attempt.

type ProviderEffectBindingProducer 

type ProviderEffectBindingProducer interface {
	RecoverProviderEffectBinding(ctx context.Context, original ProviderEffectOriginal) (ProviderEffectBindingFacts, error)
}

ProviderEffectBindingProducer recovers independently retained evidence for this exact original. Missing historical evidence returns ErrUnsupported or ErrUnavailable. It must never issue transport, inspect current state to infer custody, or treat a missing binding as an unissued invocation. Production Docker has no qualified producer yet.

type ProviderEffectBindingRecord 

type ProviderEffectBindingRecord struct {
	SchemaVersion Decimal                    `json:"schema_version"`
	Kind          string                     `json:"kind"`
	Facts         ProviderEffectBindingFacts `json:"facts"`
	Digest        string                     `json:"digest"`
	RequestDigest string                     `json:"request_digest"`
	Acceptance    RecoveryAcceptance         `json:"acceptance"`
}

ProviderEffectBindingRecord adds its own acceptance without rewriting permission bytes.

func DecodeProviderEffectBinding 

func DecodeProviderEffectBinding(raw []byte) (ProviderEffectBindingRecord, error)

DecodeProviderEffectBinding returns only canonical bounded records.

type ProviderEffectBindingRequest 

type ProviderEffectBindingRequest struct {
	Command  Command                  `json:"command"`
	Original ProviderEffectBindingKey `json:"original"`
}

ProviderEffectBindingRequest selects accepted inputs; callers cannot supply a resolver.

type ProviderEffectBindingVerifier 

type ProviderEffectBindingVerifier interface {
	VerifyProviderEffectBinding(ctx context.Context, original ProviderEffectOriginal, facts ProviderEffectBindingFacts) error
}

ProviderEffectBindingVerifier authenticates the producer profile, canonical transport semantics and exact backend/resource creation custody against the accepted original. Core shape validation alone cannot authenticate these claims or detect secret options.

type ProviderEffectCommand 

type ProviderEffectCommand struct {
	SchemaVersion    Decimal                `json:"schema_version"`
	Profile          string                 `json:"profile"`
	BackendAuthority string                 `json:"backend_authority"`
	ResourceKind     string                 `json:"resource_kind"`
	ResourceID       string                 `json:"resource_id"`
	Incarnation      string                 `json:"incarnation"`
	Method           string                 `json:"method"`
	Options          []ProviderEffectOption `json:"options"`
}

ProviderEffectCommand is the normalized transport command, independent of local retry IDs. The configured producer defines Method and Options through its authenticated profile. BackendAuthority and Incarnation come from custody evidence, never a resource name, Physical.Generation, current inspection, or a core-synthesized provider identity.

func DecodeProviderEffectCommand 

func DecodeProviderEffectCommand(raw []byte) (ProviderEffectCommand, error)

DecodeProviderEffectCommand refuses alternate encodings, unknown fields and trailing data.

type ProviderEffectOption 

type ProviderEffectOption struct {
	Name  string `json:"name"`
	Value string `json:"value"`
}

ProviderEffectOption is a non-secret transport option in strict name order.

type ProviderEffectOriginal 

type ProviderEffectOriginal struct {
	Key        ProviderEffectBindingKey   `json:"key"`
	AttemptRef AttemptRef                 `json:"attempt_ref"`
	Permission WireProviderStepPermission `json:"permission"`
	Receipt    WireReceipt                `json:"receipt"`
}

ProviderEffectOriginal is the exact locally accepted input supplied to host code.

type ProviderExecutionAuthority 

type ProviderExecutionAuthority interface {
	AuthorizeManagedProviderStep(ctx context.Context, request ProviderStepAuthorization) (ProviderStepGrant, error)
	RecordManagedProviderStepResult(ctx context.Context, request ProviderStepResult) error
	ReadManagedProviderStep(ctx context.Context, request ProviderStepKey) (ProviderStepRecord, error)
}

ProviderExecutionAuthority is the exact store used by the managed provider capability.

type ProviderExecutionResult 

type ProviderExecutionResult struct {
	SchemaVersion Decimal                  `json:"schema_version"`
	Outcome       PortOutcome              `json:"outcome"`
	OperationID   id.ID                    `json:"operation_id"`
	Resources     map[string]string        `json:"resources"`
	Steps         []WireProviderStepRecord `json:"steps"`
	Settlement    *Settlement              `json:"settlement,omitempty"`
}

ProviderExecutionResult retains every issued step and its exact resource association.

func (ProviderExecutionResult) Validate 

func (q ProviderExecutionResult) Validate() error

Validate bounds every retained step and optional settlement proof. Full service coverage and trusted verifier acceptance are separate predicates.

type ProviderGuardedOriginalStore 

type ProviderGuardedOriginalStore interface {
	PrepareManagedGuardedOriginal(ctx context.Context, request GuardedOriginalRequest) (GuardedOriginalPermission, error)
	MaterializeManagedGuardedOriginal(ctx context.Context, request GuardedOriginalMaterializationRequest) (RecoveryAssociation, error)
}

ProviderGuardedOriginalStore completes first issuance after profile activation. Neither pending acceptance nor root materialization grants provider transport.

type ProviderInvocationCloseRequest 

type ProviderInvocationCloseRequest struct {
	Command RecoveryCommand           `json:"command"`
	Failure ProviderInvocationFailure `json:"failure"`
}

ProviderInvocationCloseRequest accepts an affirmative configured before-delegation witness.

type ProviderInvocationClosure 

type ProviderInvocationClosure struct {
	Key              ProviderInvocationKey `json:"key"`
	RootDigest       string                `json:"root_digest"`
	PermissionDigest string                `json:"permission_digest"`
	FailureDigest    string                `json:"failure_digest"`
	ProducerProfile  string                `json:"producer_profile"`
	VerifierID       string                `json:"verifier_id"`
	ClosedAt         time.Time             `json:"closed_at"`
}

ProviderInvocationClosure permanently rules out delegation of the exact local invocation. The failure and closure are accepted in the same authority transaction.

type ProviderInvocationClosureProducer 

type ProviderInvocationClosureProducer interface {
	WitnessManagedProviderNoDispatch(ctx context.Context, key ProviderInvocationKey) (ProviderInvocationFailure, error)
}

ProviderInvocationClosureProducer supplies affirmative evidence from before its transport boundary.

type ProviderInvocationCommitRequest 

type ProviderInvocationCommitRequest struct {
	Command               RecoveryCommand       `json:"command"`
	Invocation            ProviderInvocationKey `json:"invocation"`
	ExpectedCurrentDigest string                `json:"expected_current_digest"`
}

ProviderInvocationCommitRequest names a permission; the store derives complete binding coverage.

type ProviderInvocationCommitsStore 

type ProviderInvocationCommitsStore interface {
	ReadManagedProviderInvocationCommits(ctx context.Context, key ProviderInvocationKey) ([]RecoveryRecord[ProviderNativeCommitFacts], error)
}

ProviderInvocationCommitsStore reads the complete immutable native commit set selected by an accepted invocation marker, in descriptor order. Missing marker, member, original request, event or receipt refuses the entire response. These historical records confer no fresh delegation or native freshness authority.

type ProviderInvocationCurrentStore 

type ProviderInvocationCurrentStore interface {
	ReadManagedProviderInvocationCurrent(ctx context.Context, key ProviderInvocationKey) (ProviderStepRetryCurrent, error)
}

ProviderInvocationCurrentStore reads the authenticated current selection for an exact invocation. A superseded invocation refuses. This read supplies a CAS digest, never a delegation grant; mutations recheck it under their own lock.

type ProviderInvocationFailure 

type ProviderInvocationFailure struct {
	Key              ProviderInvocationKey `json:"key"`
	RootDigest       string                `json:"root_digest"`
	PermissionDigest string                `json:"permission_digest"`
	Failure          ProviderStepFailure   `json:"failure"`
}

ProviderInvocationFailure retains the qualified witness for one exact permission.

type ProviderInvocationGrant 

type ProviderInvocationGrant struct {
	Marker      RecoveryRecord[ProviderInvocationMarker] `json:"marker"`
	MayDelegate bool                                     `json:"may_delegate"`
}

ProviderInvocationGrant permits one delegation only when the unique marker was newly accepted. Receipt recovery, lookup and historical permission replay always leave MayDelegate false.

type ProviderInvocationKey 

type ProviderInvocationKey struct {
	AttemptKey AttemptKey      `json:"attempt_key"`
	Step       ProviderStepKey `json:"step"`
	CommandID  id.ID           `json:"command_id"`
}

ProviderInvocationKey addresses an immutable invocation of one original logical step.

type ProviderInvocationMarker 

type ProviderInvocationMarker struct {
	Key                   ProviderInvocationKey `json:"key"`
	RootDigest            string                `json:"root_digest"`
	PermissionDigest      string                `json:"permission_digest"`
	SelectionDigest       string                `json:"selection_digest"`
	NativeCommitSetDigest string                `json:"native_commit_set_digest"`
	CurrentProofSetDigest string                `json:"current_proof_set_digest"`
	BindingCount          Decimal               `json:"binding_count"`
	AcceptedAt            time.Time             `json:"accepted_at"`
}

ProviderInvocationMarker commits a finite ordered set of per-binding native acceptances. Native commits remain in individual rows; the marker never embeds all 64 exports.

type ProviderInvocationObservationRequest 

type ProviderInvocationObservationRequest struct {
	Command               RecoveryCommand          `json:"command"`
	ExpectedCurrentDigest string                   `json:"expected_current_digest"`
	Result                ProviderInvocationResult `json:"result"`
}

ProviderInvocationObservationRequest gives each observation a stable caller operation ID. Reuse the complete request after a lost response; receipt replay never issues transport.

type ProviderInvocationPermission 

type ProviderInvocationPermission struct {
	Key                      ProviderInvocationKey      `json:"key"`
	RootDigest               string                     `json:"root_digest"`
	Ordinal                  Decimal                    `json:"ordinal"`
	Permission               WireProviderStepPermission `json:"permission"`
	ProviderCommandDigest    string                     `json:"provider_command_digest"`
	PermissionProofSetDigest string                     `json:"permission_proof_set_digest"`
	PermissionProofCount     Decimal                    `json:"permission_proof_count"`
}

ProviderInvocationPermission retains original command bytes with a new local identity only.

type ProviderInvocationRecord 

type ProviderInvocationRecord struct {
	Permission    RecoveryRecord[ProviderInvocationPermission]    `json:"permission"`
	Authorization *RecoveryRecord[ProviderStepRetryAuthorization] `json:"authorization,omitempty"`
	Marker        *RecoveryRecord[ProviderInvocationMarker]       `json:"marker,omitempty"`
	Closure       *RecoveryRecord[ProviderInvocationClosure]      `json:"closure,omitempty"`
	Failure       *RecoveryRecord[ProviderInvocationFailure]      `json:"failure,omitempty"`
	Result        *RecoveryRecord[ProviderInvocationResult]       `json:"result,omitempty"`
}

ProviderInvocationRecord is inspection only and cannot recreate a lost delegation grant.

type ProviderInvocationResult 

type ProviderInvocationResult struct {
	Key              ProviderInvocationKey  `json:"key"`
	RootDigest       string                 `json:"root_digest"`
	PermissionDigest string                 `json:"permission_digest"`
	Result           WireProviderStepResult `json:"result"`
}

ProviderInvocationResult retains positive or uncertain facts without replacing earlier facts.

type ProviderInvocationSources 

type ProviderInvocationSources struct {
	Root             RecoveryRecord[ProviderStepRetryRoot]     `json:"root"`
	PermissionProofs []RecoveryRecord[ProviderPermissionProof] `json:"permission_proofs"`
}

ProviderInvocationSources retains the original root and the complete permission proof set in descriptor order. Legacy ordinal-zero originals have no proof set. These are historical observations, never a reconstructed delegation grant.

type ProviderInvocationSourcesStore 

type ProviderInvocationSourcesStore interface {
	ReadManagedProviderInvocationSources(ctx context.Context, key ProviderInvocationKey) (ProviderInvocationSources, error)
}

ProviderInvocationSourcesStore reads exact sources under one checked snapshot. Missing members or receipts refuse the whole response; no newer proof substitutes.

type ProviderInvocationStore 

type ProviderInvocationStore interface {
	RecordManagedProviderNativeCommit(ctx context.Context, request ProviderNativeCommitRequest) (RecoveryRecord[ProviderNativeCommitFacts], error)
	ReadManagedProviderNativeCommit(ctx context.Context, request RecoveryExactRequest) (RecoveryRecord[ProviderNativeCommitFacts], error)
	CommitManagedProviderInvocation(ctx context.Context, request ProviderInvocationCommitRequest) (ProviderInvocationGrant, error)
	CloseManagedProviderInvocation(ctx context.Context, request ProviderInvocationCloseRequest) (RecoveryRecord[ProviderInvocationClosure], error)
	RecordManagedProviderInvocationResult(ctx context.Context, result ProviderInvocationObservationRequest) error
	ReadManagedProviderInvocation(ctx context.Context, key ProviderInvocationKey) (ProviderInvocationRecord, error)
}

ProviderInvocationStore owns the unique delegation marker and permanent invocation closure.

type ProviderNativeCommitFacts 

type ProviderNativeCommitFacts struct {
	Binding               RemovalRecoveryBinding `json:"binding"`
	Invocation            ProviderInvocationKey  `json:"invocation"`
	Intent                RecoveryAssociation    `json:"intent"`
	PermissionDigest      string                 `json:"permission_digest"`
	PermissionProof       RecoveryAssociation    `json:"permission_proof"`
	CurrentProof          RecoveryAssociation    `json:"current_proof"`
	PermissionProofDigest string                 `json:"permission_proof_digest"`
	CurrentProofDigest    string                 `json:"current_proof_digest"`
	GuardID               string                 `json:"guard_id"`
	GuardRootDigest       string                 `json:"guard_root_digest"`
	NativeRequestID       string                 `json:"native_request_id"`
	NativeRequestDigest   string                 `json:"native_request_digest"`
	NativeReceiptDigest   string                 `json:"native_receipt_digest"`
	NativeAcceptedAt      time.Time              `json:"native_accepted_at"`
	Export                RecoveryNativeExport   `json:"export"`
}

ProviderNativeCommitFacts binds exact original permission and independently fresh current proof.

type ProviderNativeCommitRequest 

type ProviderNativeCommitRequest struct {
	Command RecoveryCommand           `json:"command"`
	Facts   ProviderNativeCommitFacts `json:"facts"`
}

ProviderNativeCommitRequest retains authenticated native acceptance without issuing a send.

type ProviderPermissionProof 

type ProviderPermissionProof struct {
	Invocation           ProviderInvocationKey `json:"invocation"`
	BindingDigest        string                `json:"binding_digest"`
	PermissionDigest     string                `json:"permission_digest"`
	Proof                RecoveryAssociation   `json:"proof"`
	NativeMaterialDigest string                `json:"native_material_digest"`
}

ProviderPermissionProof preserves the exact native proof accepted with this permission.

type ProviderStepAcceptance 

type ProviderStepAcceptance struct {
	Permission ProviderStepPermission `json:"permission"`
	Receipt    Receipt                `json:"receipt"`
}

ProviderStepAcceptance preserves a provision permission and its independent local command receipt. It is historical evidence and never grants a transport send. Receipt and permission digests and timestamps belong to different contracts.

type ProviderStepAcceptanceStore 

type ProviderStepAcceptanceStore interface {
	ReadManagedProviderStepAcceptance(ctx context.Context, request ProviderStepAuthorization) (ProviderStepAcceptance, error)
}

ProviderStepAcceptanceStore authenticates create-network, create-container and start-container acceptance using the exact original authorization request. Current lease/revision changes do not turn this reader into new authorization. Removal originals use their separately authenticated attempt associations.

type ProviderStepAuthorization 

type ProviderStepAuthorization struct {
	Command

	Step ProviderStepKey `json:"step"`
}

ProviderStepAuthorization selects only an accepted finite step under the parent CAS.

type ProviderStepFailure 

type ProviderStepFailure struct {
	SchemaVersion   Decimal                `json:"schema_version"`
	Permission      ProviderStepPermission `json:"permission"`
	AttemptRef      AttemptRef             `json:"attempt_ref"`
	InvocationID    id.ID                  `json:"invocation_id"`
	ProducerProfile string                 `json:"producer_profile"`
	VerifierID      string                 `json:"verifier_id"`
	Class           string                 `json:"class"`
	Phase           string                 `json:"phase"`
	Reason          string                 `json:"reason"`
	ObservedAt      time.Time              `json:"observed_at"`
	Witness         []byte                 `json:"witness"`
	WitnessDigest   string                 `json:"witness_digest"`
}

ProviderStepFailure proves only that this exact invocation never reached its transport.

func (ProviderStepFailure) MarshalJSON 

func (v ProviderStepFailure) MarshalJSON() ([]byte, error)

MarshalJSON preserves positive permission semantics in a new decimal failure envelope.

func (*ProviderStepFailure) UnmarshalJSON 

func (v *ProviderStepFailure) UnmarshalJSON(raw []byte) error

UnmarshalJSON refuses noncanonical or changed permission identity.

type ProviderStepFailureAuthority 

type ProviderStepFailureAuthority interface {
	RecordManagedProviderStepFailure(ctx context.Context, request ProviderStepFailure) error
	ReadManagedProviderStepFailure(ctx context.Context, request ProviderStepKey) (ProviderStepFailure, error)
}

ProviderStepFailureAuthority is required by a qualified unsuccessful-step producer.

type ProviderStepGrant 

type ProviderStepGrant struct {
	Permission  ProviderStepPermission `json:"permission"`
	NewlyIssued bool                   `json:"newly_issued"`
}

ProviderStepGrant separates a newly committed permission from inspect-only recovery.

type ProviderStepKey 

type ProviderStepKey struct {
	OperationKey

	ProviderOperationID id.ID            `json:"provider_operation_id"`
	Kind                ProviderStepKind `json:"kind"`
	Service             string           `json:"service"`
}

ProviderStepKey binds a call to the immutable provider operation and resource slot.

type ProviderStepKind 

type ProviderStepKind string

ProviderStepKind names finite calls derived from the accepted service set. 

const (
	StepCreateNetwork   ProviderStepKind = "create_network"
	StepCreateContainer ProviderStepKind = "create_container"
	StepStartContainer  ProviderStepKind = "start_container"
	StepRemoveContainer ProviderStepKind = "remove_container"
	StepRemoveNetwork   ProviderStepKind = "remove_network"
)

type ProviderStepPermission 

type ProviderStepPermission struct {
	Step          ProviderStepKey `json:"step"`
	CommandID     id.ID           `json:"command_id"`
	Digest        string          `json:"digest"`
	SpecDigest    string          `json:"spec_digest"`
	CreateProfile string          `json:"create_profile"`
	Physical      Physical        `json:"physical"`
	Seal          uint64          `json:"seal"`
	FenceDigest   string          `json:"fence_digest"`
	ResourceID    string          `json:"resource_id"`
	IssuedAt      time.Time       `json:"issued_at"`
	Revision      uint64          `json:"revision"`
}

ProviderStepPermission is persisted before send; replay never permits another send.

type ProviderStepRecord 

type ProviderStepRecord struct {
	Permission ProviderStepPermission `json:"permission"`
	Result     *ProviderStepResult    `json:"result,omitempty"`
}

ProviderStepRecord is a retained permission with its optional definitive result.

type ProviderStepResult 

type ProviderStepResult struct {
	Permission ProviderStepPermission `json:"permission"`
	Outcome    PortOutcome            `json:"outcome"`
	ResourceID string                 `json:"resource_id"`
	Evidence   []byte                 `json:"evidence"`
	ObservedAt time.Time              `json:"observed_at"`
	Diagnostic string                 `json:"diagnostic,omitempty"`
}

ProviderStepResult retains definitive responses or uncertainty for the same permission.

type ProviderStepRetryAuthorization 

type ProviderStepRetryAuthorization struct {
	Key                   ProviderInvocationKey     `json:"key"`
	RootDigest            string                    `json:"root_digest"`
	Ordinal               Decimal                   `json:"ordinal"`
	Permission            RecoveryAssociation       `json:"permission"`
	Previous              ProviderStepRetryPrevious `json:"previous"`
	ExpectedCurrentDigest string                    `json:"expected_current_digest"`
	ParentRevision        Decimal                   `json:"parent_revision"`
	AttemptRevision       Decimal                   `json:"attempt_revision"`
	AuthorizedAt          time.Time                 `json:"authorized_at"`
}

ProviderStepRetryAuthorization certifies predecessor checks made in the selecting transaction.

type ProviderStepRetryCurrent 

type ProviderStepRetryCurrent struct {
	SchemaVersion  Decimal             `json:"schema_version"`
	RootDigest     string              `json:"root_digest"`
	CommandID      id.ID               `json:"command_id"`
	Ordinal        Decimal             `json:"ordinal"`
	Permission     RecoveryAssociation `json:"permission"`
	Authority      RecoveryAssociation `json:"authority"`
	PreviousDigest string              `json:"previous_digest"`
	MarkerKey      string              `json:"marker_key,omitempty"`
	ClosureKey     string              `json:"closure_key,omitempty"`
	FailureKey     string              `json:"failure_key,omitempty"`
	ResultKey      string              `json:"result_key,omitempty"`
	Digest         string              `json:"digest"`
}

ProviderStepRetryCurrent holds one selected invocation, including explicit ordinal zero.

type ProviderStepRetryPrevious 

type ProviderStepRetryPrevious struct {
	SchemaVersion    Decimal             `json:"schema_version"`
	RootDigest       string              `json:"root_digest"`
	CommandID        id.ID               `json:"command_id"`
	Ordinal          Decimal             `json:"ordinal"`
	PermissionDigest string              `json:"permission_digest"`
	Failure          RecoveryAssociation `json:"failure"`
	Closure          RecoveryAssociation `json:"closure"`
	Authority        RecoveryAssociation `json:"authority"`
	Digest           string              `json:"digest"`
}

ProviderStepRetryPrevious is one accepted predecessor association, never a history chain.

type ProviderStepRetryRequest 

type ProviderStepRetryRequest struct {
	Command               RecoveryCommand `json:"command"`
	Step                  ProviderStepKey `json:"step"`
	ExpectedCurrentDigest string          `json:"expected_current_digest"`
	CommandID             id.ID           `json:"command_id"`
}

ProviderStepRetryRequest selects only the current closed non-dispatched invocation.

type ProviderStepRetryRoot 

type ProviderStepRetryRoot struct {
	AttemptRef                AttemptRef                 `json:"attempt_ref"`
	Step                      ProviderStepKey            `json:"step"`
	Profile                   string                     `json:"profile"`
	SpecDigest                string                     `json:"spec_digest"`
	ResourceID                string                     `json:"resource_id"`
	Incarnation               string                     `json:"incarnation"`
	ProviderCommandDigest     string                     `json:"provider_command_digest"`
	OriginalPermission        WireProviderStepPermission `json:"original_permission"`
	OriginalPermissionReceipt WireReceipt                `json:"original_permission_receipt"`
}

ProviderStepRetryRoot anchors the original accepted permission and resource identity.

type ProviderStepRetryStore 

type ProviderStepRetryStore interface {
	AuthorizeManagedProviderStepRetry(ctx context.Context, request ProviderStepRetryRequest) (RecoveryRecord[ProviderStepRetryAuthorization], error)
	ReadManagedProviderStepRetry(ctx context.Context, key ProviderInvocationKey) (RecoveryRecord[ProviderStepRetryAuthorization], error)
	ReadManagedEffectiveRemovalCoverage(ctx context.Context, key AttemptKey) (RecoveryRecord[EffectiveRemovalCoverage], error)
}

ProviderStepRetryStore selects same-step retry authority without widening ControllerStore.

type Provision 

type Provision struct {
	Issued   bool   `json:"issued"`
	Complete bool   `json:"complete"`
	Revoked  bool   `json:"revoked"`
	Receipt  []byte `json:"receipt,omitempty"`
}

Provision retains creation uncertainty until the exact provider operation settles.

type ProvisionService 

type ProvisionService struct {
	Name      string            `json:"name"`
	Image     string            `json:"image"`
	Role      string            `json:"role"`
	CPUMillis Decimal           `json:"cpu_millis"`
	MemoryMiB Decimal           `json:"memory_mib"`
	PIDLimit  Decimal           `json:"pid_limit"`
	Startup   StartupBindingRef `json:"startup"`
}

ProvisionService freezes the public portion of a single provider service. StartupBindingRef supplies private configuration through a later trusted resolver.

type ProvisionSpec 

type ProvisionSpec struct {
	Version  Decimal            `json:"version"`
	Services []ProvisionService `json:"services"`
}

ProvisionSpec is the closed first profile with no caller env or additional effects.

func ParseProvisionSpec 

func ParseProvisionSpec(m Manifest) (ProvisionSpec, error)

ParseProvisionSpec validates syntax and safe conversion, never host capabilities.

type QuiescenceAcceptanceRequest 

type QuiescenceAcceptanceRequest struct {
	Command     OriginalCommand       `json:"command"`
	Observation QuiescenceObservation `json:"observation"`
}

QuiescenceAcceptanceRequest binds an immutable observation to the parent CAS.

type QuiescenceBatchAcceptanceRequest 

type QuiescenceBatchAcceptanceRequest struct {
	Schema  string                 `json:"schema"`
	Command QuiescenceBatchCommand `json:"command"`
	Attempt AttemptRef             `json:"attempt"`
	Entries []QuiescenceBatchEntry `json:"entries"`
}

QuiescenceBatchAcceptanceRequest preserves descriptor order and each original observation.

func ParseQuiescenceBatchAcceptanceRequest 

func ParseQuiescenceBatchAcceptanceRequest(raw []byte) (QuiescenceBatchAcceptanceRequest, error)

ParseQuiescenceBatchAcceptanceRequest refuses noncanonical nested values.

func (QuiescenceBatchAcceptanceRequest) Bytes 

func (q QuiescenceBatchAcceptanceRequest) Bytes() ([]byte, error)

Bytes produces the strict canonical request representation.

func (QuiescenceBatchAcceptanceRequest) Normalize 

func (q QuiescenceBatchAcceptanceRequest) Normalize() (QuiescenceBatchAcceptanceRequest, error)

Normalize bounds and owns the complete request without selecting authority.

type QuiescenceBatchCommand 

type QuiescenceBatchCommand struct {
	Key        Key     `json:"key"`
	ID         id.ID   `json:"id"`
	Revision   Decimal `json:"revision"`
	LeaseEpoch Decimal `json:"lease_epoch"`
	Owner      string  `json:"owner"`
}

QuiescenceBatchCommand binds the aggregate to fresh parent authority.

type QuiescenceBatchEntry 

type QuiescenceBatchEntry struct {
	OperationID id.ID                 `json:"operation_id"`
	Observation QuiescenceObservation `json:"observation"`
}

QuiescenceBatchEntry selects one ordinary observation operation.

type QuiescenceBatchKey 

type QuiescenceBatchKey struct {
	Key     Key   `json:"key"`
	BatchID id.ID `json:"batch_id"`
}

QuiescenceBatchKey selects one immutable aggregate in its original parent.

type QuiescenceBatchReceipt 

type QuiescenceBatchReceipt struct {
	Schema  string               `json:"schema"`
	Key     Key                  `json:"key"`
	BatchID id.ID                `json:"batch_id"`
	Attempt AttemptRef           `json:"attempt"`
	Count   Decimal              `json:"count"`
	Receipt OriginalLocalReceipt `json:"receipt"`
}

QuiescenceBatchReceipt is retained acceptance, never send permission.

func ParseQuiescenceBatchReceipt 

func ParseQuiescenceBatchReceipt(raw []byte) (QuiescenceBatchReceipt, error)

ParseQuiescenceBatchReceipt refuses noncanonical aggregate results.

func (QuiescenceBatchReceipt) Bytes 

func (q QuiescenceBatchReceipt) Bytes() ([]byte, error)

Bytes validates and encodes the complete aggregate receipt.

type QuiescenceBatchStore 

type QuiescenceBatchStore interface {
	AcceptManagedQuiescenceBatch(ctx context.Context, request QuiescenceBatchAcceptanceRequest) (QuiescenceBatchReceipt, error)
	ReadManagedQuiescenceBatch(ctx context.Context, key QuiescenceBatchKey) (QuiescenceBatchReceipt, error)
}

QuiescenceBatchStore optionally retains observations as one atomic non-issuing batch.

type QuiescenceIndex 

type QuiescenceIndex struct {
	Schema        string    `json:"schema"`
	ReservationID id.ID     `json:"reservation_id"`
	OperationID   id.ID     `json:"operation_id"`
	ObservedAt    time.Time `json:"observed_at"`
	RecordDigest  string    `json:"record_digest"`
}

QuiescenceIndex binds the current source time to the exact immutable record bytes.

func ParseQuiescenceIndex 

func ParseQuiescenceIndex(raw []byte) (QuiescenceIndex, error)

ParseQuiescenceIndex refuses ambiguous or noncanonical current pointers.

func (QuiescenceIndex) Bytes 

func (i QuiescenceIndex) Bytes() ([]byte, error)

Bytes returns the bounded canonical current-index encoding.

type QuiescenceKey 

type QuiescenceKey struct {
	Key

	ReservationID id.ID `json:"reservation_id"`
	OperationID   id.ID `json:"operation_id"`
}

QuiescenceKey selects immutable history in one exact reservation scope.

type QuiescenceLeaf 

type QuiescenceLeaf struct {
	Reference       QuiescenceReference `json:"reference"`
	ObservedAt      time.Time           `json:"observed_at"`
	ValidUntil      time.Time           `json:"valid_until"`
	AdmissionClosed bool                `json:"admission_closed"`
	Quiescent       bool                `json:"quiescent"`
	Complete        bool                `json:"complete"`
	DeadlineExpired bool                `json:"deadline_expired"`
	ErrorClass      string              `json:"error_class"`
	ActiveClaims    Decimal             `json:"active_claims"`
	UnknownClaims   Decimal             `json:"unknown_claims"`
	ObservationID   string              `json:"observation_id"`
	ChallengeID     string              `json:"challenge_id"`
	VerifierID      string              `json:"verifier_id"`
}

QuiescenceLeaf is the complete value covered by the producer's authenticated challenge. Native completion has no timestamp; ObservedAt remains the exact source observation time.

type QuiescenceObservation 

type QuiescenceObservation struct {
	QuiescenceLeaf

	ChallengeDigest string `json:"challenge_digest"`
	Attestation     []byte `json:"attestation"`
}

QuiescenceObservation carries opaque authenticated attestation over the whole leaf. The configured adapter authenticates this value before storage admission.

func (QuiescenceObservation) Normalize 

func (o QuiescenceObservation) Normalize() (QuiescenceObservation, error)

Normalize checks finite terminal outcomes and the fixed UTC timestamp profile.

type QuiescenceObservationPort 

type QuiescenceObservationPort interface {
	ObserveQuiescence(ctx context.Context, request QuiescenceObservationRequest) (QuiescenceObservation, error)
}

QuiescenceObservationPort is an optional authenticated native observation producer. Call it before entering any store authority transaction.

type QuiescenceObservationRequest 

type QuiescenceObservationRequest struct {
	Reference   QuiescenceReference `json:"reference"`
	ChallengeID string              `json:"challenge_id"`
}

QuiescenceObservationRequest challenges an exact original association.

type QuiescenceRecord 

type QuiescenceRecord struct {
	Request    QuiescenceAcceptanceRequest `json:"request"`
	VerifiedAt time.Time                   `json:"verified_at"`
	Receipt    OriginalLocalReceipt        `json:"receipt"`
}

QuiescenceRecord retains one request snapshot and its original local acceptance.

func ParseQuiescenceRecord 

func ParseQuiescenceRecord(raw []byte) (QuiescenceRecord, error)

ParseQuiescenceRecord requires strict typed decoding and an accepted-byte round trip.

func (QuiescenceRecord) Bytes 

func (r QuiescenceRecord) Bytes() ([]byte, error)

Bytes validates a retained record and bounds its actual JSON encoding.

type QuiescenceReference 

type QuiescenceReference struct {
	Schema                      string               `json:"schema"`
	TargetIdentityDigest        string               `json:"target_identity_digest"`
	ReservationID               id.ID                `json:"reservation_id"`
	Member                      string               `json:"member"`
	Role                        RuntimeRole          `json:"role"`
	RegistrationOperationID     id.ID                `json:"registration_operation_id"`
	RegistrationReferenceDigest string               `json:"registration_reference_digest"`
	RegistrationMaterialDigest  string               `json:"registration_material_digest"`
	DrainOperationID            id.ID                `json:"drain_operation_id"`
	DrainReferenceDigest        string               `json:"drain_reference_digest"`
	DrainMaterialDigest         string               `json:"drain_material_digest"`
	Process                     OriginalProcessFacts `json:"process"`
	OperationID                 string               `json:"operation_id"`
	Deadline                    time.Time            `json:"deadline"`
	HandleDigest                string               `json:"handle_digest"`
}

QuiescenceReference selects exact original evidence and its immutable process scope.

func NewQuiescenceReference 

func NewQuiescenceReference(registration, drain OriginalLifecycleRecord) (QuiescenceReference, error)

NewQuiescenceReference derives a leaf reference from previously retained originals. The store independently resolves both rows and verifies authoritative associations.

type Receipt 

type Receipt struct {
	ID         id.ID     `json:"id"`
	Digest     string    `json:"digest"`
	Revision   uint64    `json:"revision"`
	LeaseEpoch uint64    `json:"lease_epoch"`
	AcceptedAt time.Time `json:"accepted_at"`
	LeaseUntil time.Time `json:"lease_until"`
}

Receipt is the immutable result of a local conditional command.

type RecoveryAcceptance 

type RecoveryAcceptance struct {
	OperationID   id.ID       `json:"operation_id"`
	RequestDigest string      `json:"request_digest"`
	Receipt       WireReceipt `json:"receipt"`
}

RecoveryAcceptance links a fact to the immutable local request that accepted it.

type RecoveryAssociation 

type RecoveryAssociation struct {
	Kind          RecoveryRecordKind `json:"kind"`
	Key           string             `json:"key"`
	Digest        string             `json:"digest"`
	OperationID   id.ID              `json:"operation_id"`
	ReceiptDigest string             `json:"receipt_digest"`
}

RecoveryAssociation names one immutable local fact and its accepted authority receipt.

func RecoveryAssociationFor 

func RecoveryAssociationFor[T any](key string, record RecoveryRecord[T]) (RecoveryAssociation, error)

RecoveryAssociationFor derives an exact reference from a validated retained record.

func RecoveryRecordAssociation 

func RecoveryRecordAssociation[T any](key AttemptKey, record RecoveryRecord[T]) (RecoveryAssociation, error)

RecoveryRecordAssociation derives the canonical address of a validated record belonging to the supplied attempt. It does not authenticate retained acceptance or grant delegation; callers must reread the exact association through the store.

type RecoveryCommand 

type RecoveryCommand struct {
	Key        Key        `json:"key"`
	ID         id.ID      `json:"id"`
	Revision   Decimal    `json:"revision"`
	LeaseEpoch Decimal    `json:"lease_epoch"`
	Owner      string     `json:"owner"`
	AttemptRef AttemptRef `json:"attempt_ref"`
	Profile    string     `json:"profile"`
}

RecoveryCommand preserves the parent and attempt identity with signed wire counters.

func (RecoveryCommand) LocalCommand 

func (command RecoveryCommand) LocalCommand() (Command, error)

LocalCommand validates recovery's signed counters without changing legacy command codecs. Counter headroom depends on staged remaining obligations and is checked by the transition.

type RecoveryEffectComplete 

type RecoveryEffectComplete struct {
	Invocation            ProviderInvocationKey      `json:"invocation"`
	PermissionDigest      string                     `json:"permission_digest"`
	Result                RecoveryAssociation        `json:"result"`
	ResourceID            string                     `json:"resource_id"`
	Incarnation           string                     `json:"incarnation"`
	OriginalProcessDigest string                     `json:"original_process_digest"`
	PreEffectProofDigest  string                     `json:"pre_effect_proof_digest"`
	OriginalPreEffect     *RecoveryOriginalPreEffect `json:"original_pre_effect,omitempty"`
	RetryPreEffect        *RecoveryAssociation       `json:"retry_pre_effect,omitempty"`
}

RecoveryEffectComplete discharges one original process using an exact positive deletion. A missing process, expired lease or empty lookup cannot populate this fact.

type RecoveryExactRequest 

type RecoveryExactRequest struct {
	Key         AttemptKey          `json:"key"`
	Association RecoveryAssociation `json:"association"`
}

RecoveryExactRequest addresses history independently of the current proof or invocation.

type RecoveryNativeCloseFacts 

type RecoveryNativeCloseFacts struct {
	Binding             RemovalRecoveryBinding `json:"binding"`
	Intent              RecoveryAssociation    `json:"intent"`
	Cutoff              RecoveryAssociation    `json:"cutoff"`
	Coverage            RecoveryAssociation    `json:"coverage"`
	GuardID             string                 `json:"guard_id"`
	GuardRootDigest     string                 `json:"guard_root_digest"`
	NativeRequestID     string                 `json:"native_request_id"`
	NativeRequestDigest string                 `json:"native_request_digest"`
	NativeReceiptDigest string                 `json:"native_receipt_digest"`
	NativeAcceptedAt    time.Time              `json:"native_accepted_at"`
	Export              RecoveryNativeExport   `json:"export"`
}

RecoveryNativeCloseFacts retains exact native closure after permanent cutoff and full coverage.

type RecoveryNativeCloseRequest 

type RecoveryNativeCloseRequest struct {
	Command RecoveryCommand          `json:"command"`
	Facts   RecoveryNativeCloseFacts `json:"facts"`
}

RecoveryNativeCloseRequest records the configured producer's authenticated compact acceptance.

type RecoveryNativeExport 

type RecoveryNativeExport struct {
	Raw               []byte  `json:"raw"`
	RawDigest         string  `json:"raw_digest"`
	Attestation       []byte  `json:"attestation"`
	AttestationDigest string  `json:"attestation_digest"`
	ProducerID        string  `json:"producer_id"`
	ProducerProfile   string  `json:"producer_profile"`
	ProducerVersion   Decimal `json:"producer_version"`
	VerifierID        string  `json:"verifier_id"`
}

RecoveryNativeExport holds bounded compact bytes and a separately authenticated attestation. Native material and native receipt digests have their own domains and are never raw hashes.

type RecoveryNativeIntent 

type RecoveryNativeIntent struct {
	Binding       RemovalRecoveryBinding `json:"binding"`
	Profile       string                 `json:"profile"`
	Operation     string                 `json:"operation"`
	RequestID     string                 `json:"request_id"`
	RequestDigest string                 `json:"request_digest"`
	Command       []byte                 `json:"command"`
	CommandDigest string                 `json:"command_digest"`
	Permission    *RecoveryAssociation   `json:"permission,omitempty"`
	Proof         *RecoveryAssociation   `json:"proof,omitempty"`
	Cutoff        *RecoveryAssociation   `json:"cutoff,omitempty"`
	Coverage      *RecoveryAssociation   `json:"coverage,omitempty"`
}

RecoveryNativeIntent preserves the exact opaque native request before a producer call.

type RecoveryNativeIntentRequest 

type RecoveryNativeIntentRequest struct {
	Command RecoveryCommand      `json:"command"`
	Intent  RecoveryNativeIntent `json:"intent"`
}

RecoveryNativeIntentRequest records native request identity before invoking the configured producer.

type RecoveryOriginalPreEffect 

type RecoveryOriginalPreEffect struct {
	Key         AttemptBindingKey `json:"key"`
	OperationID id.ID             `json:"operation_id"`
	FactDigest  string            `json:"fact_digest"`
}

RecoveryOriginalPreEffect names the original Begin proof retained before ordinal zero permission. FactDigest uses the original removal_fence fact domain; the enclosing PreEffectProofDigest uses AttemptNativeAcceptance.ProofDigest. RetryPreEffect instead names the exact permission-time ProviderPermissionProof.

type RecoveryProducerContext 

type RecoveryProducerContext struct {
	Profile string                               `json:"profile"`
	Key     AttemptKey                           `json:"key"`
	Intent  RecoveryRecord[RecoveryNativeIntent] `json:"intent"`
}

RecoveryProducerContext carries only accepted local identities to a configured producer. Hosts supply authenticated machine context through ctx; callers cannot inject a proof resolver.

type RecoveryProducerIdentity 

type RecoveryProducerIdentity struct {
	ProducerID string  `json:"producer_id"`
	Profile    string  `json:"profile"`
	Version    Decimal `json:"version"`
	VerifierID string  `json:"verifier_id"`
}

RecoveryProducerIdentity fixes the producer identity authenticated by host configuration.

type RecoveryRecord 

type RecoveryRecord[T any] struct {
	SchemaVersion Decimal            `json:"schema_version"`
	Kind          RecoveryRecordKind `json:"kind"`
	Facts         T                  `json:"facts"`
	Digest        string             `json:"digest"`
	Acceptance    RecoveryAcceptance `json:"acceptance"`
}

RecoveryRecord retains normalized facts independently of raw native wire schemas. Its digest excludes Acceptance and Digest; the retained event binds both to the request.

func DecodeRecoveryRecord 

func DecodeRecoveryRecord[T any](raw []byte) (RecoveryRecord[T], error)

DecodeRecoveryRecord refuses noncanonical, truncated, unknown-field and oversized JSON.

type RecoveryRecordKind 

type RecoveryRecordKind string

RecoveryRecordKind is a finite retained-record kind, never a caller-defined storage key. 

const (
	RecoveryActivationRecord      RecoveryRecordKind = "removal_recovery_profile"
	RecoveryProofRecord           RecoveryRecordKind = "removal_revalidation"
	RecoveryIntentRecord          RecoveryRecordKind = "removal_recovery_intent"
	RecoveryCommitRecord          RecoveryRecordKind = "removal_native_commit"
	RecoveryCloseRecord           RecoveryRecordKind = "removal_native_close"
	RecoveryMarkerRecord          RecoveryRecordKind = "provider_invocation_marker"
	RecoveryClosureRecord         RecoveryRecordKind = "provider_invocation_closure"
	RecoveryCutoffRecord          RecoveryRecordKind = "removal_recovery_cutoff"
	RecoveryRootRecord            RecoveryRecordKind = "step_retry_root"
	RecoveryAuthorizationRecord   RecoveryRecordKind = "step_retry_authorization"
	RecoveryPermissionRecord      RecoveryRecordKind = "step_retry_permission"
	RecoveryPermissionProofRecord RecoveryRecordKind = "removal_permission_proof"
	RecoveryFailureRecord         RecoveryRecordKind = "step_retry_failure"
	RecoveryResultRecord          RecoveryRecordKind = "step_retry_result"
	RecoveryCoverageRecord        RecoveryRecordKind = "removal_effective_coverage"
	RecoveryCoverageBindingRecord RecoveryRecordKind = "removal_effective_binding"
)

Recovery record kinds have independent domain hashes and actual encoded-byte ceilings.

type RefusalError 

type RefusalError struct {
	Action    string
	Operation string
	Cause     error
}

RefusalError identifies the managed operation required before a generic mutation.

func (*RefusalError) Error 

func (r *RefusalError) Error() string

func (*RefusalError) Unwrap 

func (r *RefusalError) Unwrap() error

Unwrap preserves the protection failure for callers.

type Registration 

type Registration struct {
	ID            id.ID  `json:"id"`
	Member        string `json:"member"`
	RuntimeID     string `json:"runtime_id"`
	InstanceID    string `json:"instance_id"`
	HostID        string `json:"host_id"`
	RequestID     string `json:"request_id"`
	Command       []byte `json:"command"`
	CommandDigest string `json:"command_digest"`
}

Registration freezes the exact command sent to a trusted remote worker host.

type ReleaseBinding 

type ReleaseBinding struct {
	Key        ReleaseKey `json:"key"`
	Target     Key        `json:"target"`
	ActionID   id.ID      `json:"action_id"`
	Manifest   Manifest   `json:"manifest"`
	Version    uint64     `json:"version"`
	AcceptedAt time.Time  `json:"accepted_at"`
}

ReleaseBinding preserves the accepted manifest association and release identity.

type ReleaseBindingRequest 

type ReleaseBindingRequest struct {
	Command

	ActionID  id.ID `json:"action_id"`
	ReleaseID id.ID `json:"release_id"`
}

ReleaseBindingRequest selects persisted acceptance; callers supply no snapshot rows.

type ReleaseKey 

type ReleaseKey struct {
	TenantID  string `json:"tenant_id"`
	ReleaseID id.ID  `json:"release_id"`
}

ReleaseKey identifies a tenant-owned immutable release snapshot.

type RemovalAcceptance 

type RemovalAcceptance struct {
	Outcome              PortOutcome    `json:"outcome"`
	Binding              RemovalBinding `json:"binding"`
	ReceiptID            string         `json:"receipt_id"`
	Receipt              []byte         `json:"receipt"`
	ReceiptDigest        string         `json:"receipt_digest"`
	AcceptedAt           time.Time      `json:"accepted_at"`
	OriginalBindingProof []byte         `json:"original_binding_proof"`
}

RemovalAcceptance retains full accepted fence, abort or finish evidence.

func (RemovalAcceptance) Validate 

func (q RemovalAcceptance) Validate() error

Validate retains accepted abort/finish evidence and the original binding proof separately.

type RemovalAttemptStore 

type RemovalAttemptStore interface {
	BeginManagedRemovalAttempt(ctx context.Context, request AttemptStartRequest) (AttemptReceipt, error)
	AuthorizeManagedAttemptCommand(ctx context.Context, request AttemptCommandRequest) (AttemptCommandGrant, error)
	AuthorizeManagedAttemptRecovery(ctx context.Context, request AttemptRecoveryRequest) (AttemptRecoveryGrant, error)
	RecordManagedAttemptFence(ctx context.Context, request AttemptFenceRequest) (Receipt, error)
	AdmitManagedRemovalAttempt(ctx context.Context, request AttemptAdmissionRequest) (Receipt, error)
	RevokeManagedRemovalAttempt(ctx context.Context, request AttemptRequest) (Receipt, error)
	SettleManagedRemovalAttempt(ctx context.Context, request AttemptSettlementRequest) (Receipt, error)
	RecordManagedAttemptBindingSettlement(ctx context.Context, request AttemptBindingSettlementRequest) (Receipt, error)
	RecordManagedAttemptAbort(ctx context.Context, request AttemptAbortRequest) (Receipt, error)
	RecordManagedAttemptFinish(ctx context.Context, request AttemptFinishRequest) (Receipt, error)
	TombstoneManagedRemovalAttempt(ctx context.Context, request AttemptRequest) (Receipt, error)
	ReadManagedRemovalAttempt(ctx context.Context, request AttemptKey) (AttemptRecord, error)
	ReadManagedAttemptCommand(ctx context.Context, request AttemptCommandKey) (AttemptCommandRecord, error)
	ReadManagedAttemptBinding(ctx context.Context, request AttemptBindingKey) (AttemptBindingRecord, error)
	ReadManagedAttemptHistoricalSettlement(ctx context.Context, request AttemptSettlementReadRequest) (AttemptHistoricalSettlement, error)
}

RemovalAttemptStore is the optional complete generation-one removal capability.

type RemovalBinding 

type RemovalBinding struct {
	LifecycleRequest

	AttemptID           id.ID     `json:"attempt_id"`
	AttemptGeneration   Decimal   `json:"attempt_generation"`
	ProviderOperationID id.ID     `json:"provider_operation_id"`
	Seal                Decimal   `json:"seal"`
	Fence               WireFence `json:"fence"`
	SurvivorProof       []byte    `json:"survivor_proof"`
}

RemovalBinding preserves historical attempt identity and the full original fence.

func (RemovalBinding) Validate 

func (q RemovalBinding) Validate() error

Validate checks the entire original removal binding before any remote operation.

type RemovalCommitProducer 

type RemovalCommitProducer interface {
	BindManagedRemovalCommit(ctx context.Context, producer RecoveryProducerContext) (ProviderNativeCommitFacts, error)
	CheckManagedRemovalCommit(ctx context.Context, producer RecoveryProducerContext) (ProviderNativeCommitFacts, error)
	RecoverManagedRemovalCommit(ctx context.Context, producer RecoveryProducerContext) (ProviderNativeCommitFacts, error)
}

RemovalCommitProducer binds, checks or recovers the immutable native permission request.

type RemovalContinuationStore 

type RemovalContinuationStore interface {
	BeginManagedRemovalContinuation(ctx context.Context, request ContinuationRequest) (ContinuationReceipt, error)
	ReadManagedRemovalContinuation(ctx context.Context, key ContinuationKey) (ContinuationRecord, error)
}

RemovalContinuationStore provides typed acceptance and exact historical reads.

type RemovalCoverageSealer 

type RemovalCoverageSealer interface {
	SealManagedEffectiveRemovalCoverage(ctx context.Context, command RecoveryCommand) (RecoveryRecord[EffectiveRemovalCoverage], error)
}

RemovalCoverageSealer retains complete post-cutoff coverage before constructing a native close request. The seal is an immutable observation, not permission to send, close a native guard, or declare the attempt terminal. Exact replay returns the original acceptance without consuming another receipt or counter reserve.

type RemovalCutoffFacts 

type RemovalCutoffFacts struct {
	Key                 AttemptKey  `json:"key"`
	AttemptRef          AttemptRef  `json:"attempt_ref"`
	ProviderOperationID id.ID       `json:"provider_operation_id"`
	RevocationDigest    string      `json:"revocation_digest"`
	RevocationReceipt   WireReceipt `json:"revocation_receipt"`
	CutoffAt            time.Time   `json:"cutoff_at"`
}

RemovalCutoffFacts binds permanent attempt revocation before native protection closes.

type RemovalCutoffReader 

type RemovalCutoffReader interface {
	ReadManagedRemovalCutoffExact(ctx context.Context, request RecoveryExactRequest) (RecoveryRecord[RemovalCutoffFacts], error)
}

RemovalCutoffReader inspects the exact permanent cutoff, including its original receipt. Reading cutoff alone proves neither effect completion nor native closure.

type RemovalGuardCloseProducer 

type RemovalGuardCloseProducer interface {
	CloseManagedRemovalGuard(ctx context.Context, producer RecoveryProducerContext) (RecoveryNativeCloseFacts, error)
	RecoverManagedRemovalGuardClose(ctx context.Context, producer RecoveryProducerContext) (RecoveryNativeCloseFacts, error)
}

RemovalGuardCloseProducer closes or recovers a retained native close request.

type RemovalPlan 

type RemovalPlan struct {
	SchemaVersion       Decimal           `json:"schema_version"`
	Identity            WireIdentity      `json:"identity"`
	ActionID            id.ID             `json:"action_id"`
	AttemptID           id.ID             `json:"attempt_id"`
	AttemptGeneration   Decimal           `json:"attempt_generation"`
	ProviderOperationID id.ID             `json:"provider_operation_id"`
	FenceDigest         string            `json:"fence_digest"`
	Resources           map[string]string `json:"resources"`
}

RemovalPlan binds exact persisted resources and the admitted historical attempt.

func (RemovalPlan) Validate 

func (q RemovalPlan) Validate() error

Validate checks the exact resource association before a removal executor starts.

type RemovalRecoveryActivation 

type RemovalRecoveryActivation struct {
	Key                     AttemptKey `json:"key"`
	AttemptRef              AttemptRef `json:"attempt_ref"`
	Profile                 string     `json:"profile"`
	RetryProfile            string     `json:"retry_profile"`
	ProviderOperationID     id.ID      `json:"provider_operation_id"`
	AdmissionDigest         string     `json:"admission_digest"`
	BindingCount            Decimal    `json:"binding_count"`
	StepCount               Decimal    `json:"step_count"`
	OriginalSelectionDigest string     `json:"original_selection_digest"`
	ActivatedAt             time.Time  `json:"activated_at"`
}

RemovalRecoveryActivation fixes the adopted original selections without granting send authority.

type RemovalRecoveryActivationRequest 

type RemovalRecoveryActivationRequest struct {
	Command RecoveryCommand `json:"command"`
}

RemovalRecoveryActivationRequest selects persisted original facts inside the authority transaction.

type RemovalRecoveryBinding 

type RemovalRecoveryBinding struct {
	Key                        AttemptBindingKey `json:"key"`
	DescriptorDigest           string            `json:"descriptor_digest"`
	ProviderOperationID        id.ID             `json:"provider_operation_id"`
	OriginalRegistrationDigest string            `json:"original_registration_digest"`
	OriginalDrainDigest        string            `json:"original_drain_digest"`
	OriginalCommandDigest      string            `json:"original_command_digest"`
	OriginalBeginRequestID     string            `json:"original_begin_request_id"`
	OriginalBeginRequestDigest string            `json:"original_begin_request_digest"`
	NativeFenceDigest          string            `json:"native_fence_digest"`
	OriginalProcessDigest      string            `json:"original_process_digest"`
	AdmissionDigest            string            `json:"admission_digest"`
}

RemovalRecoveryBinding freezes the original process and native Begin associations.

type RemovalRecoveryHost 

type RemovalRecoveryHost struct {
	Revalidation         RemovalRevalidationProducer
	Commit               RemovalCommitProducer
	Close                RemovalGuardCloseProducer
	Closure              ProviderInvocationClosureProducer
	Verifier             RemovalRecoveryVerifier
	RevalidationIdentity RecoveryProducerIdentity
	CommitIdentity       RecoveryProducerIdentity
	CloseIdentity        RecoveryProducerIdentity
	ClosureVerifierID    string
}

RemovalRecoveryHost is a complete configured host capability, never a request DTO. A configured repository view shares the existing backend and its authority locks.

type RemovalRecoveryLifecycleStore 

type RemovalRecoveryLifecycleStore interface {
	ProviderGuardedOriginalStore
	ReadManagedEffectiveRemovalCoverageExact(ctx context.Context, request RecoveryExactRequest) (RecoveryRecord[EffectiveRemovalCoverage], error)
	SettleManagedRemovalRecovery(ctx context.Context, request AttemptSettlementRequest) (Receipt, error)
	RecordManagedRemovalRecoveryCommand(ctx context.Context, request AttemptCommandRequest) (AttemptCommandGrant, error)
	RecordManagedRemovalRecoveryBindingSettlement(ctx context.Context, request AttemptBindingSettlementRequest) (Receipt, error)
	RecordManagedRemovalRecoveryFinish(ctx context.Context, request AttemptFinishRequest) (Receipt, error)
	RecordManagedRemovalRecoveryAbort(ctx context.Context, request AttemptAbortRequest) (Receipt, error)
	TombstoneManagedRemovalRecovery(ctx context.Context, request AttemptRequest) (Receipt, error)
}

RemovalRecoveryLifecycleStore supplies the terminal half of the optional recovery profile. It preserves original command and terminal fact codecs while resolving their authority through exact effective invocation coverage and retained guard closure. Implementing only revalidation, invocation and retry stores is incomplete.

func RequireRemovalRecoveryLifecycle 

func RequireRemovalRecoveryLifecycle(authority any) (RemovalRecoveryLifecycleStore, error)

RequireRemovalRecoveryLifecycle returns the separately complete terminal capability. Recovery cutoff may retain a Fenced revocation while effects remain unresolved. Fenced revokes authority only. It supplies neither NotIssued nor settlement or coverage proof; terminal operations require independently complete effective coverage.

type RemovalRecoveryVerifier 

type RemovalRecoveryVerifier interface {
	VerifyRemovalRevalidation(ctx context.Context, intent RecoveryRecord[RecoveryNativeIntent], facts RemovalRevalidationFacts) error
	VerifyRemovalCommit(ctx context.Context, intent RecoveryRecord[RecoveryNativeIntent], facts ProviderNativeCommitFacts) error
	VerifyRemovalClose(ctx context.Context, intent RecoveryRecord[RecoveryNativeIntent], facts RecoveryNativeCloseFacts) error
	VerifyProviderNoDispatch(ctx context.Context, permission RecoveryRecord[ProviderInvocationPermission], marker *RecoveryRecord[ProviderInvocationMarker], failure ProviderInvocationFailure) error
}

RemovalRecoveryVerifier authenticates normalized facts and their exact retained inputs. Implementations are trusted host configuration. A request cannot replace this verifier. Methods run before authority locks; stores still recheck time and local state at commit.

type RemovalRevalidationCurrent 

type RemovalRevalidationCurrent struct {
	SchemaVersion    Decimal             `json:"schema_version"`
	BindingDigest    string              `json:"binding_digest"`
	Proof            RecoveryAssociation `json:"proof"`
	SourceObservedAt time.Time           `json:"source_observed_at"`
	Digest           string              `json:"digest"`
}

RemovalRevalidationCurrent selects an exact immutable observation by CAS.

type RemovalRevalidationFacts 

type RemovalRevalidationFacts struct {
	Binding              RemovalRecoveryBinding  `json:"binding"`
	Intent               RecoveryAssociation     `json:"intent"`
	GuardID              string                  `json:"guard_id"`
	GuardRootDigest      string                  `json:"guard_root_digest"`
	NativeRequestID      string                  `json:"native_request_id"`
	NativeRequestDigest  string                  `json:"native_request_digest"`
	NativeMaterialDigest string                  `json:"native_material_digest"`
	NativeReceiptDigest  string                  `json:"native_receipt_digest"`
	NativeCurrentDigest  string                  `json:"native_current_digest"`
	NativeScopeDigest    string                  `json:"native_scope_digest"`
	CandidateVersion     Decimal                 `json:"candidate_version"`
	RemovalEpoch         Decimal                 `json:"removal_epoch"`
	CandidateDigest      string                  `json:"candidate_digest"`
	BuildDigest          string                  `json:"build_digest"`
	SurvivorDigest       string                  `json:"survivor_digest"`
	ExclusionDigest      string                  `json:"exclusion_digest"`
	CoverageDigest       string                  `json:"coverage_digest"`
	ProcessDisposition   string                  `json:"process_disposition"`
	EffectComplete       *RecoveryEffectComplete `json:"effect_complete,omitempty"`
	SourceObservedAt     time.Time               `json:"source_observed_at"`
	NativeAcceptedAt     time.Time               `json:"native_accepted_at"`
	ValidUntil           time.Time               `json:"valid_until"`
	Export               RecoveryNativeExport    `json:"export"`
}

RemovalRevalidationFacts describe one accepted observation of the same original native guard.

type RemovalRevalidationProducer 

type RemovalRevalidationProducer interface {
	RevalidateManagedRemoval(ctx context.Context, producer RecoveryProducerContext) (RemovalRevalidationFacts, error)
	RecoverManagedRemovalRevalidation(ctx context.Context, producer RecoveryProducerContext) (RemovalRevalidationFacts, error)
}

RemovalRevalidationProducer revalidates or recovers the retained same-original native request.

type RemovalRevalidationRequest 

type RemovalRevalidationRequest struct {
	Command               RecoveryCommand          `json:"command"`
	ExpectedCurrentDigest string                   `json:"expected_current_digest"`
	Facts                 RemovalRevalidationFacts `json:"facts"`
}

RemovalRevalidationRequest accepts authenticated producer facts with expected-current CAS.

type RemovalRevalidationSet 

type RemovalRevalidationSet struct {
	AttemptRef AttemptRef                                 `json:"attempt_ref"`
	Proofs     []RecoveryRecord[RemovalRevalidationFacts] `json:"proofs"`
	Current    []RemovalRevalidationCurrent               `json:"current"`
}

RemovalRevalidationSet is a complete descriptor-ordered response, never a page.

type RemovalRevalidationStore 

type RemovalRevalidationStore interface {
	ActivateManagedRemovalRecovery(ctx context.Context, request RemovalRecoveryActivationRequest) (RecoveryRecord[RemovalRecoveryActivation], error)
	RecordManagedRecoveryNativeIntent(ctx context.Context, request RecoveryNativeIntentRequest) (RecoveryRecord[RecoveryNativeIntent], error)
	ReadManagedRecoveryNativeIntent(ctx context.Context, request RecoveryExactRequest) (RecoveryRecord[RecoveryNativeIntent], error)
	AcceptManagedRemovalRevalidation(ctx context.Context, request RemovalRevalidationRequest) (RecoveryRecord[RemovalRevalidationFacts], error)
	ReadManagedRemovalRevalidation(ctx context.Context, request RecoveryExactRequest) (RecoveryRecord[RemovalRevalidationFacts], error)
	ReadManagedRemovalRevalidationSet(ctx context.Context, key AttemptKey) (RemovalRevalidationSet, error)
	CutoffManagedRemovalRecovery(ctx context.Context, command RecoveryCommand) (RecoveryRecord[RemovalCutoffFacts], error)
	RecordManagedRemovalGuardClose(ctx context.Context, request RecoveryNativeCloseRequest) (RecoveryRecord[RecoveryNativeCloseFacts], error)
	ReadManagedRemovalGuardClose(ctx context.Context, request RecoveryExactRequest) (RecoveryRecord[RecoveryNativeCloseFacts], error)
}

RemovalRevalidationStore is an optional complete local recovery capability. Evidence verification belongs to configured host producers; store calls never perform transport.

type ReplacementRequest 

type ReplacementRequest struct {
	Command

	Replacement Identity `json:"replacement"`
}

ReplacementRequest freezes the next instance identity before provisioning.

type Reservation 

type Reservation struct {
	Registration

	Phase    ReservationPhase `json:"phase"`
	Receipt  []byte           `json:"receipt"`
	Unknown  bool             `json:"unknown"`
	Fence    *Fence           `json:"fence,omitempty"`
	Drain    *Drain           `json:"drain,omitempty"`
	Finished []byte           `json:"finished,omitempty"`
	Abort    *AbortProof      `json:"abort,omitempty"`
}

Reservation retains accepted, revoked and unresolved incarnation obligations.

type ReservationPhase 

type ReservationPhase string

ReservationPhase preserves uncertainty after permission to issue was committed. 

const (
	Reserved      ReservationPhase = "reserved"
	MayHaveIssued ReservationPhase = "may_have_issued"
	Accepted      ReservationPhase = "accepted"
	Revoked       ReservationPhase = "revoked_before_issue"
)

type ReservationRequest 

type ReservationRequest struct {
	Command

	ReservationID id.ID `json:"reservation_id"`
}

ReservationRequest selects an exact persisted reservation.

type ReserveRequest 

type ReserveRequest struct {
	Command

	Registration Registration `json:"registration"`
}

ReserveRequest records a permitted incarnation before any remote issue.

type ResourceObservation 

type ResourceObservation struct {
	SchemaVersion Decimal           `json:"schema_version"`
	Outcome       PortOutcome       `json:"outcome"`
	Identity      WireIdentity      `json:"identity"`
	Resources     map[string]string `json:"resources"`
	ObservedAt    time.Time         `json:"observed_at"`
}

ResourceObservation reports inspection without asserting terminal settlement.

func (ResourceObservation) Validate 

func (q ResourceObservation) Validate() error

Validate bounds inspection without treating existence as settlement.

type ResourcesRequest 

type ResourcesRequest struct {
	Command

	OperationID id.ID             `json:"operation_id"`
	Receipt     []byte            `json:"receipt"`
	Resources   map[string]string `json:"resources"`
}

ResourcesRequest binds observed exact provider resource IDs once.

type RoleBinding 

type RoleBinding struct {
	Target              WireIdentity `json:"target"`
	MemberIndex         Decimal      `json:"member_index"`
	MemberName          string       `json:"member_name"`
	Role                RuntimeRole  `json:"role"`
	ReservationID       id.ID        `json:"reservation_id"`
	ReservationVersion  Decimal      `json:"reservation_version"`
	RuntimeID           string       `json:"runtime_id"`
	InstanceID          string       `json:"instance_id"`
	HostID              string       `json:"host_id"`
	NativeBuild         string       `json:"native_build"`
	ConfigurationDigest string       `json:"configuration_digest"`
	EnrollmentEvidence  []byte       `json:"enrollment_evidence"`
}

RoleBinding binds configured runtime behavior to an exact native incarnation.

func (RoleBinding) Validate 

func (b RoleBinding) Validate() error

Validate checks bounded enrollment values; the caller still needs authenticated attestation.

type RootDispatchReservation 

type RootDispatchReservation struct {
	OriginalCommand  PortCommand   `json:"original_command"`
	Route            RouteIdentity `json:"route"`
	RouteRevision    Decimal       `json:"route_revision"`
	DispatchCommand  PortCommand   `json:"dispatch_command"`
	MayHaveForwarded bool          `json:"may_have_forwarded"`
}

RootDispatchReservation freezes the original root selection across route changes. Existing executions and continuations keep their native persisted build semantics.

type RouteIdentity 

type RouteIdentity struct {
	Key

	Installation        string  `json:"installation"`
	Namespace           string  `json:"namespace"`
	Route               string  `json:"route"`
	Queue               string  `json:"queue"`
	ReleaseID           id.ID   `json:"release_id"`
	ManifestDigest      string  `json:"manifest_digest"`
	Build               string  `json:"build"`
	ArtifactDigest      string  `json:"artifact_digest"`
	ConfigurationDigest string  `json:"configuration_digest"`
	WriterFloor         Decimal `json:"writer_floor"`
	SchemaFloor         Decimal `json:"schema_floor"`
}

RouteIdentity names the complete compatible route selection and monotonic floors.

type RoutingPort 

type RoutingPort interface {
	CheckCompatibility(ctx context.Context, request RoutingRequest) (RoutingReceipt, error)
	SetActiveBuild(ctx context.Context, request RoutingRequest) (RoutingReceipt, error)
	LookupRouting(ctx context.Context, request RoutingRequest) (RoutingReceipt, error)
}

RoutingPort delegates compatible root selection to the host route authority.

type RoutingReceipt 

type RoutingReceipt struct {
	Outcome    PortOutcome    `json:"outcome"`
	Request    RoutingRequest `json:"request"`
	Revision   Decimal        `json:"revision"`
	ReceiptID  string         `json:"receipt_id"`
	AuditID    string         `json:"audit_id"`
	Receipt    []byte         `json:"receipt"`
	AcceptedAt time.Time      `json:"accepted_at"`
}

RoutingReceipt certifies a host selection, never cross-database workflow commit.

func (RoutingReceipt) Validate 

func (q RoutingReceipt) Validate() error

Validate checks a host selection receipt without treating it as workflow commit.

type RoutingRequest 

type RoutingRequest struct {
	Command          PortCommand   `json:"command"`
	Route            RouteIdentity `json:"route"`
	ExpectedRevision Decimal       `json:"expected_revision"`
	Compatibility    []byte        `json:"compatibility"`
	Readiness        []byte        `json:"readiness"`
}

RoutingRequest selects a host-owned route with a stable exact command and CAS.

func (RoutingRequest) Validate 

func (q RoutingRequest) Validate() error

Validate checks exact route identity and bounded compatibility/readiness proofs.

type RuntimeRole 

type RuntimeRole string

RuntimeRole fixes the permitted startup behavior of an immutable member. 

const (
	// Polling permits enrollment followed by separately authorized worker startup.
	Polling RuntimeRole = "polling"
	// RetainedQuery permits historical queries with permanently closed admission.
	RetainedQuery RuntimeRole = "retained_query"
)

type ServiceSample 

type ServiceSample struct {
	Service      string      `json:"service"`
	ResourceID   string      `json:"resource_id"`
	Outcome      PortOutcome `json:"outcome"`
	ObservedAt   time.Time   `json:"observed_at"`
	CPUTimeNanos Decimal     `json:"cpu_time_nanos"`
	MemoryBytes  Decimal     `json:"memory_bytes"`
	PIDCount     Decimal     `json:"pid_count"`
}

ServiceSample preserves present, unavailable and failed observations per container.

type Settlement 

type Settlement struct {
	OperationID id.ID       `json:"operation_id"`
	FenceDigest string      `json:"fence_digest"`
	Disposition Disposition `json:"disposition"`
	Verifier    string      `json:"verifier"`
	Evidence    []byte      `json:"evidence"`
	SettledAt   time.Time   `json:"settled_at"`
}

Settlement is trusted host evidence, not a claim inferred from an existence probe.

type SettlementRequest 

type SettlementRequest struct {
	Command

	Settlement Settlement `json:"settlement"`
}

SettlementRequest records definitive evidence for the allocated deletion.

type StartupBindingRef 

type StartupBindingRef struct {
	BindingID         string  `json:"binding_id"`
	BindingGeneration Decimal `json:"binding_generation"`
	BindingDigest     string  `json:"binding_digest"`
}

StartupBindingRef pins a non-secret trusted configuration descriptor generation. It never contains an endpoint, credential, DSN or a digest of secret bytes.

type Store 

type Store interface {
	ProtectionStore
	CreateManagedTarget(ctx context.Context, request Identity) (*Target, error)
	ReadManagedTarget(ctx context.Context, request Key) (*Target, error)
	ListManagedTargets(ctx context.Context, request PageRequest) (Page, error)
	ListManagedControllerTargets(ctx context.Context, request ControllerPageRequest) (Page, error)
	ClaimManagedLease(ctx context.Context, request LeaseRequest) (Receipt, error)
	SetManagedDesired(ctx context.Context, request DesiredRequest) (Receipt, error)
	IssueManagedProvision(ctx context.Context, request Command) (Receipt, error)
	BindManagedResources(ctx context.Context, request ResourcesRequest) (Receipt, error)
	AllocateManagedReplacement(ctx context.Context, request ReplacementRequest) (Receipt, error)
	ReserveManagedRegistration(ctx context.Context, request ReserveRequest) (Receipt, error)
	IssueManagedRegistration(ctx context.Context, request ReservationRequest) (Receipt, error)
	ObserveManagedUnknown(ctx context.Context, request ReservationRequest) (Receipt, error)
	AcceptManagedRegistration(ctx context.Context, request AcceptanceRequest) (Receipt, error)
	SealManagedTarget(ctx context.Context, request Command) (Receipt, error)
	RecordManagedFence(ctx context.Context, request FenceRequest) (Receipt, error)
	RecordManagedDrain(ctx context.Context, request DrainRequest) (Receipt, error)
	AdmitManagedRemoval(ctx context.Context, request AdmissionRequest) (Receipt, error)
	IssueManagedDeletion(ctx context.Context, request Command) (Receipt, error)
	RevokeManagedDeletion(ctx context.Context, request Command) (Receipt, error)
	SettleManagedDeletion(ctx context.Context, request SettlementRequest) (Receipt, error)
	AbortManagedBinding(ctx context.Context, request AbortRequest) (Receipt, error)
	FinishManagedBinding(ctx context.Context, request AcceptanceRequest) (Receipt, error)
	TombstoneManagedTarget(ctx context.Context, request Command) (Receipt, error)
	TombstoneManagedUnissuedTarget(ctx context.Context, request Command) (Receipt, error)
}

Store owns the physical-instance CAS. These methods do not authorize external actions. Hosts must authenticate, authorize and verify evidence before invoking the capability.

type Summary 

type Summary struct {
	Key

	Phase            Phase       `json:"phase"`
	Desired          DesiredMode `json:"desired"`
	Revision         uint64      `json:"revision"`
	ReservationCount int         `json:"reservation_count"`
}

Summary omits incarnation commands, receipts and proof material from enumeration.

type Target 

type Target struct {
	Identity

	TerminalDisposition    Disposition       `json:"terminal_disposition,omitempty"`
	Provision              Provision         `json:"provision"`
	ReplacementOperationID id.ID             `json:"replacement_operation_id,omitzero"`
	CreatedAt              time.Time         `json:"created_at"`
	Revision               uint64            `json:"revision"`
	Desired                DesiredMode       `json:"desired"`
	DesiredRevision        uint64            `json:"desired_revision"`
	Phase                  Phase             `json:"phase"`
	Seal                   uint64            `json:"seal"`
	LeaseOwner             string            `json:"lease_owner"`
	LeaseEpoch             uint64            `json:"lease_epoch"`
	LeaseUntil             time.Time         `json:"lease_until"`
	Resources              map[string]string `json:"resources,omitempty"`
	Reservations           []Reservation     `json:"reservations"`
	Deletion               *Deletion         `json:"deletion,omitempty"`
	Replacement            *Identity         `json:"replacement,omitempty"`
}

Target is the complete bounded obligation set, updated under one physical-instance lock.

type WireFence 

type WireFence struct {
	CompatibilityEvidence []byte    `json:"compatibility_evidence"`
	Epoch                 Decimal   `json:"epoch"`
	Evidence              []byte    `json:"evidence"`
	Digest                string    `json:"digest"`
	ValidUntil            time.Time `json:"valid_until"`
	Survivors             []string  `json:"survivors"`
}

WireFence preserves the original opaque fence and its decimal epoch.

func FenceWire 

func FenceWire(v Fence) WireFence

FenceWire copies the complete original fence without replacing its evidence.

func (WireFence) Value 

func (w WireFence) Value() (Fence, error)

Value refuses malformed epochs and oversized individual proofs.

type WireIdentity 

type WireIdentity struct {
	Key

	ProvisionOperationID id.ID        `json:"provision_operation_id"`
	Physical             Physical     `json:"physical"`
	Manifest             WireManifest `json:"manifest"`
}

WireIdentity is the transport form of an authoritative identity. Conversion preserves Spec bytes and all stored digest domains.

func IdentityWire 

func IdentityWire(v Identity) WireIdentity

IdentityWire copies the immutable value without recomputing any digest.

func (WireIdentity) Value 

func (w WireIdentity) Value() (Identity, error)

Value checks the wire version before restoring its exact internal representation.

type WireManifest 

type WireManifest struct {
	Version    Decimal  `json:"version"`
	Members    []Member `json:"members"`
	Spec       []byte   `json:"spec"`
	SpecDigest string   `json:"spec_digest"`
}

WireManifest carries the unchanged manifest bytes with a lossless decimal version.

type WireProviderStepPermission 

type WireProviderStepPermission struct {
	Step          ProviderStepKey `json:"step"`
	CommandID     id.ID           `json:"command_id"`
	Digest        string          `json:"digest"`
	SpecDigest    string          `json:"spec_digest"`
	CreateProfile string          `json:"create_profile"`
	Physical      Physical        `json:"physical"`
	Seal          Decimal         `json:"seal"`
	FenceDigest   string          `json:"fence_digest"`
	ResourceID    string          `json:"resource_id"`
	IssuedAt      time.Time       `json:"issued_at"`
	Revision      Decimal         `json:"revision"`
}

WireProviderStepPermission is the transport form of a retained step permission.

func ProviderPermissionWire 

func ProviderPermissionWire(v ProviderStepPermission) WireProviderStepPermission

ProviderPermissionWire preserves the stored permission digest rather than rehashing it.

func (WireProviderStepPermission) Value 

func (w WireProviderStepPermission) Value() (ProviderStepPermission, error)

Value checks the complete bounded permission before restoring its stored value.

type WireProviderStepRecord 

type WireProviderStepRecord struct {
	Permission WireProviderStepPermission `json:"permission"`
	Result     *WireProviderStepResult    `json:"result,omitempty"`
}

WireProviderStepRecord keeps permission and result counters canonical on the wire.

func ProviderStepWire 

func ProviderStepWire(v ProviderStepRecord) WireProviderStepRecord

ProviderStepWire copies the exact evidence and both copies of its permission.

func (WireProviderStepRecord) Value 

func (w WireProviderStepRecord) Value() (ProviderStepRecord, error)

Value validates matching permission copies and the complete encoded step bound.

type WireProviderStepResult 

type WireProviderStepResult struct {
	Permission WireProviderStepPermission `json:"permission"`
	Outcome    PortOutcome                `json:"outcome"`
	ResourceID string                     `json:"resource_id"`
	Evidence   []byte                     `json:"evidence"`
	ObservedAt time.Time                  `json:"observed_at"`
	Diagnostic string                     `json:"diagnostic,omitempty"`
}

WireProviderStepResult preserves the complete definitive or uncertain response.

type WireReceipt 

type WireReceipt struct {
	ID         id.ID     `json:"id"`
	Digest     string    `json:"digest"`
	Revision   Decimal   `json:"revision"`
	LeaseEpoch Decimal   `json:"lease_epoch"`
	AcceptedAt time.Time `json:"accepted_at"`
	LeaseUntil time.Time `json:"lease_until"`
}

WireReceipt carries the historical receipt unchanged except for integer encoding.

func ReceiptWire 

func ReceiptWire(v Receipt) WireReceipt

ReceiptWire preserves historical identity and acceptance times.

func (WireReceipt) Value 

func (w WireReceipt) Value() (Receipt, error)

Value checks both canonical counters before restoring a receipt.

type WorkDiscoveryStore 

type WorkDiscoveryStore interface {
	ReadManagedWorkHead(ctx context.Context, key Key) (WorkHead, error)
	ListManagedUnresolvedWork(ctx context.Context, request WorkPageRequest) (WorkPage, error)
	ReadManagedWork(ctx context.Context, reference WorkReference) (WorkReference, error)
}

WorkDiscoveryStore adds authoritative discovery over the existing retained record store. Legacy actions without acceptance-time associations remain unavailable, with no backfill.

type WorkHead 

type WorkHead struct {
	Schema       string        `json:"schema"`
	Key          Key           `json:"key"`
	LastOrdinal  Decimal       `json:"last_ordinal"`
	Provisioning WorkReference `json:"provisioning"`
	Desired      WorkReference `json:"desired"`
}

WorkHead separates current desired selection from all retained unresolved work. LastOrdinal is an authority-assigned append sequence, unrelated to command ID ordering.

func DecodeWorkHead 

func DecodeWorkHead(raw []byte) (WorkHead, error)

DecodeWorkHead requires exact canonical bytes for both authoritative pointers.

type WorkPage 

type WorkPage struct {
	Schema     string          `json:"schema"`
	Key        Key             `json:"key"`
	Items      []WorkReference `json:"items"`
	NextCursor string          `json:"next_cursor"`
}

WorkPage retains compact exact references; full commands use the exact readers. An empty NextCursor finishes this window and allows the next visit to start a new sweep.

type WorkPageRequest 

type WorkPageRequest struct {
	Key    Key    `json:"key"`
	Cursor string `json:"cursor"`
	Limit  int    `json:"limit"`
}

WorkPageRequest selects a bounded stable window for scheduling, never physical closure.

type WorkReference 

type WorkReference struct {
	Schema    string       `json:"schema"`
	Key       Key          `json:"key"`
	Ordinal   Decimal      `json:"ordinal"`
	Operation OperationKey `json:"operation"`
	Kind      string       `json:"kind"`
	ID        id.ID        `json:"id"`
	Digest    string       `json:"digest"`
}

WorkReference addresses accepted work without embedding a target or remote command. Membership means unresolved accounting. It never establishes permission or closure.

func DecodeWorkReference 

func DecodeWorkReference(raw []byte) (WorkReference, error)

DecodeWorkReference refuses duplicate fields, unknown fields and noncanonical encodings.

func (WorkReference) Validate 

func (r WorkReference) Validate() error

Validate requires canonical signed sequence counters and bounded immutable identities.

type WriterFloor 

type WriterFloor struct {
	Schema           string    `json:"schema"`
	AuthorityID      string    `json:"authority_id"`
	MinimumProtocol  Decimal   `json:"minimum_protocol"`
	Epoch            Decimal   `json:"epoch"`
	ActivationID     id.ID     `json:"activation_id"`
	PreviousDigest   string    `json:"previous_digest"`
	ActivationDigest string    `json:"activation_digest"`
	ActivatedAt      time.Time `json:"activated_at"`
	Digest           string    `json:"digest"`
}

WriterFloor is one protected marker and its identical immutable activation history row. ActivatedAt is assigned at the administrative transaction callback, never by its request. Digest commits the entire record except itself. ActivationDigest commits its request.

func DecodeWriterFloor 

func DecodeWriterFloor(raw []byte) (WriterFloor, error)

DecodeWriterFloor refuses unknown fields, duplicate keys, trailing data and noncanonical bytes.

func NewWriterFloor 

func NewWriterFloor(request WriterFloorActivation, now time.Time) (WriterFloor, error)

NewWriterFloor seals a request at an authority callback time; it grants no activation. The protected store must separately check current CAS, monotonicity and administration.

func (WriterFloor) Activation 

func (floor WriterFloor) Activation() WriterFloorActivation

Activation returns the exact request retained by this marker.

func (WriterFloor) Reference 

func (floor WriterFloor) Reference() WriterFloorReference

Reference returns an inspection identity, never a delegation capability.

type WriterFloorActivation 

type WriterFloorActivation struct {
	Schema          string  `json:"schema"`
	AuthorityID     string  `json:"authority_id"`
	MinimumProtocol Decimal `json:"minimum_protocol"`
	Epoch           Decimal `json:"epoch"`
	ActivationID    id.ID   `json:"activation_id"`
	ExpectedDigest  string  `json:"expected_digest"`
}

WriterFloorActivation is deployment administration input, never a runtime permission. ExpectedDigest names the exact previous marker; only initial installation leaves it empty.

func DecodeWriterFloorActivation 

func DecodeWriterFloorActivation(raw []byte) (WriterFloorActivation, error)

DecodeWriterFloorActivation refuses noncanonical or oversized administration input.

type WriterFloorReference 

type WriterFloorReference struct {
	AuthorityID  string `json:"authority_id"`
	ActivationID id.ID  `json:"activation_id"`
	Digest       string `json:"digest"`
}

WriterFloorReference names an exact activation for inspection or external equality checks. Possession proves neither admission nor permission to invoke a provider or native command.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.