managedstate

package
v1.8.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 20, 2026 License: Apache-2.0 Imports: 19 Imported by: 0

Documentation

Overview

Package managedstate shares transition rules between the qualified stores.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ActivateWriterFloor 

func ActivateWriterFloor(ctx context.Context, backend WriterFloorAdminBackend, authority string, request managed.WriterFloorActivation) (managed.WriterFloor, error)

ActivateWriterFloor stages one monotone administrative activation or returns exact history. It is not attached to Repository and is never a runtime mutation bypass. The backend must use separate administrative credentials and the external deployment barrier must be closed. The returned record is historical metadata, not permission to reopen or delegate.

func CheckWriterFloorMutation 

func CheckWriterFloorMutation(ctx context.Context, snapshot WriterFloorSnapshot, authority string) error

CheckWriterFloorMutation validates exact current/history metadata before comparing the protected floor with the compiled ceiling. Callers hold their original mutation lock through commit/rollback. No request supplies a protocol or cached allow value.

func Clone 

func Clone(t *managed.Target) (*managed.Target, error)

Clone makes a defensive copy and bounds serialized storage.

func EqualIdentity 

func EqualIdentity(a, b managed.Identity) bool

EqualIdentity supports exact idempotent target creation.

func EqualProjectedInstance 

func EqualProjectedInstance(a, b *instance.Instance) bool

EqualProjectedInstance checks immutable identity without overwriting later visible state.

func EqualProjectedOwner 

func EqualProjectedOwner(a, b *workload.Workload) bool

EqualProjectedOwner checks immutable owner provenance and original service snapshot.

func EqualProjectedRelease 

func EqualProjectedRelease(a, b *deploy.Release) bool

EqualProjectedRelease checks the immutable ordinary release snapshot and tenant/instance.

func HeldRecordLimit 

func HeldRecordLimit(kind string) int

HeldRecordLimit preserves the existing reader caps for provider transport. Step and history readers use the physical controller row bound.

func ImmutableRecordLimit 

func ImmutableRecordLimit(kind string) int

ImmutableRecordLimit returns the existing cap for the finite batch allowlist.

func PhysicalKey 

func PhysicalKey(p managed.Physical) string

PhysicalKey reserves a project permanently across all target generations.

func ProjectionEntities 

func ProjectionEntities(target managed.Identity, receipt managed.ActionReceipt, ownerOrigin managed.Identity) (*instance.Instance, *workload.Workload, *deploy.Release, error)

ProjectionEntities derives ordinary snapshots exclusively from accepted manifest facts.

func ProjectionOwnerOrigin 

func ProjectionOwnerOrigin(ctx context.Context, tx ControllerTransaction, target managed.Identity) (managed.Identity, error)

ProjectionOwnerOrigin reads provenance from retained authority, never mutable labels.

func ReserveProjectionOwner 

func ReserveProjectionOwner(ctx context.Context, tx ControllerTransaction, target managed.Identity, previous *managed.Identity, ordinaryOwnerExists bool) error

ReserveProjectionOwner verifies the permanent origin when a replacement reuses an owner.

func RunHeldQuiescenceObservationBatch 

func RunHeldQuiescenceObservationBatch(ctx context.Context, tx ControllerTransaction, q managed.QuiescenceBatchAcceptanceRequest, hooks QuiescenceBatchHooks) (managed.QuiescenceBatchReceipt, error)

RunHeldQuiescenceObservationBatch performs shared validation with purpose-specific persistence.

func ValidateHeldRecordKeys 

func ValidateHeldRecordKeys(keys []ControllerRecordKey) error

ValidateHeldRecordKeys bounds provider selection within one no-write interval.

func ValidateImmutableReceiptKeys 

func ValidateImmutableReceiptKeys(k managed.Key, operations []id.ID) error

ValidateImmutableReceiptKeys bounds exact parent and receipt identities.

func ValidateImmutableRecordKeys 

func ValidateImmutableRecordKeys(keys []ControllerRecordKey) error

ValidateImmutableRecordKeys bounds exact transport selection without granting authority.

Types

type Backend 

type Backend interface {
	Create(ctx context.Context, target *managed.Target) (*managed.Target, error)
	Read(ctx context.Context, key managed.Key) (*managed.Target, error)
	List(ctx context.Context, request managed.PageRequest, after string) ([]managed.Summary, error)
	Obligations(ctx context.Context, tenant string) (bool, error)
	Atomic(ctx context.Context, key managed.Key, operation id.ID, digest string, change func(*managed.Target, time.Time) (managed.Receipt, error)) (managed.Receipt, error)
}

Backend executes callbacks against an isolated clone under the physical-instance lock. A failed callback or persistence write must commit no changes.

type ControllerBackend 

type ControllerBackend interface {
	ControllerAtomic(ctx context.Context, serial string, keys []managed.Key, change func(ControllerTransaction) error) error
}

ControllerBackend opens a single authority transaction for retained controller rows. Implementations lock the serial key and all target IDs in stable order before Now.

type ControllerReceiptResult 

type ControllerReceiptResult struct {
	OperationID id.ID
	Found       bool
	Receipt     managed.Receipt
}

ControllerReceiptResult selects one unchanged A receipt in its supplied parent.

type ControllerRecord 

type ControllerRecord struct {
	Key  string
	Data []byte
}

ControllerRecord is an internal retained row, separate from A's target document.

type ControllerRecordKey 

type ControllerRecordKey struct{ Kind, Scope, Key string }

ControllerRecordKey selects one exact retained row.

type ControllerRecordResult 

type ControllerRecordResult struct {
	ControllerRecordKey

	Found bool
	Size  int
	Data  []byte
}

ControllerRecordResult preserves existence independently of payload length.

type ControllerTransaction 

type ControllerTransaction interface {
	Backend
	Now() time.Time
	// ReadReceipt reads exact immutable history after the caller validates the held target.
	ReadReceipt(ctx context.Context, key managed.Key, operation id.ID, digest string) (managed.Receipt, error)
	ReadHeldRecords(ctx context.Context, keys []ControllerRecordKey) ([]ControllerRecordResult, error)
	ReadImmutableRecords(ctx context.Context, keys []ControllerRecordKey) ([]ControllerRecordResult, error)
	ReadImmutableReceipts(ctx context.Context, key managed.Key, operations []id.ID) ([]ControllerReceiptResult, error)
	ReadRecord(ctx context.Context, kind, scope, key string) ([]byte, error)
	WriteRecord(ctx context.Context, kind, scope, key string, raw []byte, insert bool) error
	ListRecords(ctx context.Context, kind, scope, after string, limit int) ([]ControllerRecord, error)
	ReserveRows(ctx context.Context, target managed.Identity, previous *managed.Identity) error
	ProjectRows(ctx context.Context, target managed.Identity, receipt managed.ActionReceipt, replay bool) error
}

ControllerTransaction supplies A's backend without opening or committing another transaction. It stages all writes and exposes no remote callbacks or caller-controlled row patches.

type DiscoveryPageTransaction 

type DiscoveryPageTransaction interface {
	ListDiscoveryWork(ctx context.Context, scope string, cursor string, limit int) ([]DiscoveryWorkRow, error)
}

DiscoveryPageTransaction is a bounded indexed read on the existing held transaction. It is not a second authority/backend and cannot issue or settle work.

type DiscoveryWorkRow 

type DiscoveryWorkRow struct {
	Key  string
	Size int
	Data []byte
}

DiscoveryWorkRow reports the stored size independently of the bounded payload.

type ProviderEffectBindingRepository 

type ProviderEffectBindingRepository struct {
	// contains filtered or unexported fields
}

ProviderEffectBindingRepository exposes evidence retention without issuing capability. It shares the repository backend and cannot satisfy complete removal recovery.

func (*ProviderEffectBindingRepository) RetainProviderEffectBinding 

func (r *ProviderEffectBindingRepository) RetainProviderEffectBinding(ctx context.Context, q managed.ProviderEffectBindingRequest) (managed.ProviderEffectBindingRecord, error)

RetainProviderEffectBinding authenticates outside locks, then inserts one immutable evidence row and its parent receipt atomically. Parent and attempt counters stay fixed. It issues no permission, transport, marker, retry selection, or activation.

type QuiescenceBatchCandidate 

type QuiescenceBatchCandidate struct {
	// contains filtered or unexported fields
}

QuiescenceBatchCandidate has no public constructor or mutable authority fields.

func (*QuiescenceBatchCandidate) StageTarget 

func (c *QuiescenceBatchCandidate) StageTarget(t *managed.Target) (*managed.Target, error)

StageTarget preserves all authoritative fields except the validated revision delta.

func (*QuiescenceBatchCandidate) Take 

func (c *QuiescenceBatchCandidate) Take(k managed.Key, batch id.ID, revision uint64) (QuiescenceBatchStage, error)

Take validates exact hook binding and returns owned artifacts once.

type QuiescenceBatchChildStage 

type QuiescenceBatchChildStage struct {
	Scope       string
	OperationID id.ID
	History     []byte
	Current     []byte
	First       bool
	Receipt     managed.Receipt
}

QuiescenceBatchChildStage carries fixed history/current artifacts, never arbitrary row kinds.

type QuiescenceBatchHooks 

type QuiescenceBatchHooks interface {
	FreshQuiescenceBatchTime(ctx context.Context) (time.Time, error)
	StageQuiescenceBatch(ctx context.Context, candidate *QuiescenceBatchCandidate) error
}

QuiescenceBatchHooks is implemented only by a private, bound held-backend adapter.

type QuiescenceBatchStage 

type QuiescenceBatchStage struct {
	Children []QuiescenceBatchChildStage
	Scope    string
	Manifest []byte
	Receipt  managed.Receipt
}

QuiescenceBatchStage contains only internally derived observation artifacts.

type QuiescenceBatchTransaction 

type QuiescenceBatchTransaction interface {
	ApplyQuiescenceObservationBatch(ctx context.Context, request managed.QuiescenceBatchAcceptanceRequest) (managed.QuiescenceBatchReceipt, error)
}

QuiescenceBatchTransaction optionally stages a complete observation batch under held authority.

type Repository 

type Repository struct {
	// contains filtered or unexported fields
}

Repository exposes only typed consumer transitions through its store methods.

func New 

func New(b Backend) *Repository

New binds the typed repository to one persistence authority.

func (*Repository) AbortManagedBinding 

func (r *Repository) AbortManagedBinding(ctx context.Context, q managed.AbortRequest) (managed.Receipt, error)

AbortManagedBinding records fresh post-settlement proof; enrollment stays sealed.

func (*Repository) AcceptManagedOriginalRegistration 

func (r *Repository) AcceptManagedOriginalRegistration(ctx context.Context, q managed.OriginalRegistrationAcceptanceRequest) (managed.Receipt, error)

AcceptManagedOriginalRegistration atomically retains the original native export and A receipt.

func (*Repository) AcceptManagedQuiescence 

func (r *Repository) AcceptManagedQuiescence(ctx context.Context, q managed.QuiescenceAcceptanceRequest) (managed.Receipt, error)

AcceptManagedQuiescence retains a fresh terminal observation without changing the original drain.

func (*Repository) AcceptManagedQuiescenceBatch 

func (r *Repository) AcceptManagedQuiescenceBatch(ctx context.Context, q managed.QuiescenceBatchAcceptanceRequest) (managed.QuiescenceBatchReceipt, error)

AcceptManagedQuiescenceBatch commits the complete batch or returns no successful receipt.

func (*Repository) AcceptManagedRegistration 

func (r *Repository) AcceptManagedRegistration(ctx context.Context, q managed.AcceptanceRequest) (managed.Receipt, error)

AcceptManagedRegistration records an exact accepted receipt even after sealing.

func (*Repository) AcceptManagedRemovalRevalidation 

func (r *Repository) AcceptManagedRemovalRevalidation(ctx context.Context, request managed.RemovalRevalidationRequest) (managed.RecoveryRecord[managed.RemovalRevalidationFacts], error)

AcceptManagedRemovalRevalidation verifies configured evidence outside authority locks, then repeats exact dependency, freshness and current-proof CAS checks.

func (*Repository) AcknowledgeManagedAudit 

func (r *Repository) AcknowledgeManagedAudit(ctx context.Context, q managed.AuditAcknowledgment) error

AcknowledgeManagedAudit accepts only exact intent-bound complete sink receipts.

func (*Repository) ActivateManagedRemovalRecovery 

func (r *Repository) ActivateManagedRemovalRecovery(ctx context.Context, request managed.RemovalRecoveryActivationRequest) (managed.RecoveryRecord[managed.RemovalRecoveryActivation], error)

ActivateManagedRemovalRecovery preserves exact replay but refuses fresh activation until the complete recovery interfaces and configured host are implemented.

func (*Repository) AdmitManagedRemoval 

func (r *Repository) AdmitManagedRemoval(ctx context.Context, q managed.AdmissionRequest) (managed.Receipt, error)

AdmitManagedRemoval checks the entire frozen set under the parent lock.

func (*Repository) AdmitManagedRemovalAttempt 

func (r *Repository) AdmitManagedRemovalAttempt(ctx context.Context, q managed.AttemptAdmissionRequest) (managed.Receipt, error)

AdmitManagedRemovalAttempt validates every native binding and live closure together.

func (*Repository) AdvanceManagedContinuation 

func (r *Repository) AdvanceManagedContinuation(ctx context.Context, q managed.ContinuationAdvance) (managed.Continuation, error)

AdvanceManagedContinuation retains a bounded pending page and independent in-flight slot.

func (*Repository) AdvanceManagedOperation 

func (r *Repository) AdvanceManagedOperation(ctx context.Context, q managed.OperationAdvance) (managed.OperationState, error)

AdvanceManagedOperation persists explicit bounded observations under the parent lease.

func (*Repository) AllocateManagedReplacement 

func (r *Repository) AllocateManagedReplacement(ctx context.Context, q managed.ReplacementRequest) (managed.Receipt, error)

AllocateManagedReplacement persists a distinct identity before provisioning.

func (*Repository) AttachManagedPhaseOriginalResult 

func (r *Repository) AttachManagedPhaseOriginalResult(ctx context.Context, q managed.PhaseOriginalResultRequest) (managed.PhaseOriginalResult, error)

AttachManagedPhaseOriginalResult persists exact accepted progress and audit atomically. It retains unresolved membership and cannot synthesize an original result or terminal closure.

func (*Repository) AuthorizeManagedAttemptCommand 

func (r *Repository) AuthorizeManagedAttemptCommand(ctx context.Context, q managed.AttemptCommandRequest) (managed.AttemptCommandGrant, error)

AuthorizeManagedAttemptCommand retains a finite original command before native issue.

func (*Repository) AuthorizeManagedAttemptRecovery 

func (r *Repository) AuthorizeManagedAttemptRecovery(ctx context.Context, q managed.AttemptRecoveryRequest) (managed.AttemptRecoveryGrant, error)

AuthorizeManagedAttemptRecovery grants only the exact retained native request.

func (*Repository) AuthorizeManagedProviderStep 

func (r *Repository) AuthorizeManagedProviderStep(ctx context.Context, q managed.ProviderStepAuthorization) (managed.ProviderStepGrant, error)

AuthorizeManagedProviderStep persists may-have-issued only after complete parent validation. A recovered permission is inspect-only; a provider must never resend it after replay.

func (*Repository) AuthorizeManagedProviderStepRetry 

func (r *Repository) AuthorizeManagedProviderStepRetry(ctx context.Context, request managed.ProviderStepRetryRequest) (managed.RecoveryRecord[managed.ProviderStepRetryAuthorization], error)

AuthorizeManagedProviderStepRetry retains one guarded retry without delegating transport.

func (*Repository) BeginManagedRemovalAttempt 

func (r *Repository) BeginManagedRemovalAttempt(ctx context.Context, q managed.AttemptStartRequest) (managed.AttemptReceipt, error)

BeginManagedRemovalAttempt atomically anchors the complete original attempt before send.

func (*Repository) BeginManagedRemovalContinuation 

func (r *Repository) BeginManagedRemovalContinuation(ctx context.Context, q managed.ContinuationRequest) (managed.ContinuationReceipt, error)

BeginManagedRemovalContinuation atomically closes one predecessor and allocates its successor.

func (*Repository) BindManagedRelease 

func (r *Repository) BindManagedRelease(ctx context.Context, q managed.ReleaseBindingRequest) (managed.ReleaseBinding, error)

BindManagedRelease verifies the association created by atomic reserved projection. It cannot adopt or attach an ordinary generic release to a managed target.

func (*Repository) BindManagedResources 

func (r *Repository) BindManagedResources(ctx context.Context, q managed.ResourcesRequest) (managed.Receipt, error)

BindManagedResources records exact resources only after the creation operation has settled. A lost acknowledgment remains issued; sealing cannot discard that late result.

func (*Repository) ClaimManagedLease 

func (r *Repository) ClaimManagedLease(ctx context.Context, q managed.LeaseRequest) (managed.Receipt, error)

ClaimManagedLease fences stale local writers; it never settles outstanding calls.

func (*Repository) CloseManagedProviderInvocation 

func (r *Repository) CloseManagedProviderInvocation(ctx context.Context, request managed.ProviderInvocationCloseRequest) (managed.RecoveryRecord[managed.ProviderInvocationClosure], error)

CloseManagedProviderInvocation authenticates exact before-delegation custody outside locks.

func (*Repository) CommitManagedProviderInvocation 

func (r *Repository) CommitManagedProviderInvocation(ctx context.Context, request managed.ProviderInvocationCommitRequest) (managed.ProviderInvocationGrant, error)

CommitManagedProviderInvocation returns delegation only from a newly committed marker.

func (*Repository) CreateManagedTarget 

func (r *Repository) CreateManagedTarget(ctx context.Context, i managed.Identity) (*managed.Target, error)

CreateManagedTarget persists immutable membership before any external operation.

func (*Repository) CutoffManagedRemovalRecovery 

func (r *Repository) CutoffManagedRemovalRecovery(ctx context.Context, request managed.RecoveryCommand) (managed.RecoveryRecord[managed.RemovalCutoffFacts], error)

CutoffManagedRemovalRecovery permanently refuses further issuance. Existing effects remain unresolved until separately retained complete coverage proves their disposition.

func (*Repository) FinishManagedBinding 

func (r *Repository) FinishManagedBinding(ctx context.Context, q managed.AcceptanceRequest) (managed.Receipt, error)

FinishManagedBinding saves the accepted removal receipt after definitive provider deletion.

func (*Repository) HasManagedObligations 

func (r *Repository) HasManagedObligations(ctx context.Context, tenant string) (bool, error)

HasManagedObligations checks independently of tenant metadata and ordinary instance rows.

func (*Repository) InspectManagedProtection 

func (r *Repository) InspectManagedProtection(ctx context.Context, k managed.Key) (managed.Protection, error)

InspectManagedProtection never treats a read error as absence.

func (*Repository) IssueManagedDeletion 

func (r *Repository) IssueManagedDeletion(ctx context.Context, q managed.Command) (managed.Receipt, error)

IssueManagedDeletion records potential issue; callers must also recheck remote current fences.

func (*Repository) IssueManagedProvision 

func (r *Repository) IssueManagedProvision(ctx context.Context, q managed.Command) (managed.Receipt, error)

IssueManagedProvision records potential provider creation before the call.

func (*Repository) IssueManagedRegistration 

func (r *Repository) IssueManagedRegistration(ctx context.Context, q managed.ReservationRequest) (managed.Receipt, error)

IssueManagedRegistration commits potential issuance before a caller may send.

func (*Repository) ListManagedAuditIntents 

func (r *Repository) ListManagedAuditIntents(ctx context.Context, q managed.AuditPageRequest) (managed.AuditPage, error)

ListManagedAuditIntents enumerates pending intents with a scope-bound stable cursor.

func (*Repository) ListManagedControllerTargets 

func (r *Repository) ListManagedControllerTargets(ctx context.Context, q managed.ControllerPageRequest) (managed.Page, error)

ListManagedControllerTargets enumerates orphaned targets without relying on tenant metadata.

func (*Repository) ListManagedTargets 

func (r *Repository) ListManagedTargets(ctx context.Context, q managed.PageRequest) (managed.Page, error)

ListManagedTargets binds continuation to tenant scope and uses permanent instance ordering.

func (*Repository) ListManagedUnresolvedWork 

func (r *Repository) ListManagedUnresolvedWork(ctx context.Context, q managed.WorkPageRequest) (managed.WorkPage, error)

ListManagedUnresolvedWork uses stable authority ordinals with a frozen window ceiling. Every item is retained until an independently reviewed closure transition exists. Completion of a window proves neither physical closure nor absence of later acceptance.

func (*Repository) MaterializeManagedGuardedOriginal 

func (r *Repository) MaterializeManagedGuardedOriginal(ctx context.Context, request managed.GuardedOriginalMaterializationRequest) (managed.RecoveryAssociation, error)

MaterializeManagedGuardedOriginal retains authenticated effect identity without advancing authority counters. Fresh CAS, lease and full remaining reserve apply.

func (*Repository) ObserveManagedUnknown 

func (r *Repository) ObserveManagedUnknown(ctx context.Context, q managed.ReservationRequest) (managed.Receipt, error)

ObserveManagedUnknown retains the issued command without manufacturing refusal.

func (*Repository) PrepareManagedGuardedOriginal 

func (r *Repository) PrepareManagedGuardedOriginal(ctx context.Context, request managed.GuardedOriginalRequest) (managed.GuardedOriginalPermission, error)

PrepareManagedGuardedOriginal returns nonissuing evidence custody. Exact replay precedes fresh authority checks and never asks a provider to perform transport.

func (*Repository) ProjectManagedRows 

func (r *Repository) ProjectManagedRows(ctx context.Context, q managed.ProjectionRequest) (managed.ProjectionReceipt, error)

ProjectManagedRows derives reserved pending rows under the same authority transaction.

func (*Repository) ReadManagedAttemptBinding 

func (r *Repository) ReadManagedAttemptBinding(ctx context.Context, k managed.AttemptBindingKey) (managed.AttemptBindingRecord, error)

ReadManagedAttemptBinding returns bounded full evidence for one exact binding.

func (*Repository) ReadManagedAttemptCommand 

func (r *Repository) ReadManagedAttemptCommand(ctx context.Context, k managed.AttemptCommandKey) (managed.AttemptCommandRecord, error)

ReadManagedAttemptCommand recovers one exact immutable original command.

func (*Repository) ReadManagedAttemptHistoricalSettlement 

func (r *Repository) ReadManagedAttemptHistoricalSettlement(ctx context.Context, q managed.AttemptSettlementReadRequest) (managed.AttemptHistoricalSettlement, error)

ReadManagedAttemptHistoricalSettlement separates partial native binding facts from A admission.

func (*Repository) ReadManagedContinuation 

func (r *Repository) ReadManagedContinuation(ctx context.Context, q managed.ControllerKey) (managed.Continuation, error)

ReadManagedContinuation recovers the exact persisted sweep without advancing it.

func (*Repository) ReadManagedEffectiveRemovalCoverage 

func (r *Repository) ReadManagedEffectiveRemovalCoverage(ctx context.Context, key managed.AttemptKey) (managed.RecoveryRecord[managed.EffectiveRemovalCoverage], error)

ReadManagedEffectiveRemovalCoverage returns the fixed complete retained coverage. Unknown effects remain unresolved and never create a record through this read.

func (*Repository) ReadManagedEffectiveRemovalCoverageExact 

func (r *Repository) ReadManagedEffectiveRemovalCoverageExact(ctx context.Context, request managed.RecoveryExactRequest) (managed.RecoveryRecord[managed.EffectiveRemovalCoverage], error)

ReadManagedEffectiveRemovalCoverageExact requires the named lifecycle acceptance.

func (*Repository) ReadManagedHistoricalSettlement 

func (r *Repository) ReadManagedHistoricalSettlement(ctx context.Context, q managed.HistoricalSettlementRequest) (managed.HistoricalSettlement, error)

ReadManagedHistoricalSettlement preserves the original admitted aggregate fence meaning.

func (*Repository) ReadManagedOperation 

func (r *Repository) ReadManagedOperation(ctx context.Context, q managed.OperationKey) (managed.OperationState, error)

ReadManagedOperation recovers accepted commands independently of current desired state.

func (*Repository) ReadManagedOriginalLifecycle 

func (r *Repository) ReadManagedOriginalLifecycle(ctx context.Context, k managed.OriginalLifecycleKey) (managed.OriginalLifecycleRecord, error)

ReadManagedOriginalLifecycle resolves exact retained material, A association and local receipt.

func (*Repository) ReadManagedPhaseCommand 

func (r *Repository) ReadManagedPhaseCommand(ctx context.Context, ref managed.WorkReference) (managed.PhaseCommandRecord, error)

ReadManagedPhaseCommand validates the immutable command, original parent receipt and audit. No result, progress label or missing response can rewrite it or remove its work reference.

func (*Repository) ReadManagedPhaseOriginalResult 

func (r *Repository) ReadManagedPhaseOriginalResult(ctx context.Context, work managed.WorkReference) (managed.PhaseOriginalResult, error)

ReadManagedPhaseOriginalResult verifies accepted progress without closing discovery work.

func (*Repository) ReadManagedProviderInvocation 

func (r *Repository) ReadManagedProviderInvocation(ctx context.Context, key managed.ProviderInvocationKey) (managed.ProviderInvocationRecord, error)

ReadManagedProviderInvocation inspects accepted history and cannot restore a grant.

func (*Repository) ReadManagedProviderInvocationCommits 

func (r *Repository) ReadManagedProviderInvocationCommits(ctx context.Context, key managed.ProviderInvocationKey) ([]managed.RecoveryRecord[managed.ProviderNativeCommitFacts], error)

ReadManagedProviderInvocationCommits authenticates the marker-selected set and each exact native acceptance under one held snapshot, without native callbacks.

func (*Repository) ReadManagedProviderInvocationCurrent 

func (r *Repository) ReadManagedProviderInvocationCurrent(ctx context.Context, key managed.ProviderInvocationKey) (managed.ProviderStepRetryCurrent, error)

ReadManagedProviderInvocationCurrent binds the requested invocation to its complete current pointer, receipts and status within one authority snapshot.

func (*Repository) ReadManagedProviderInvocationSources 

func (r *Repository) ReadManagedProviderInvocationSources(ctx context.Context, key managed.ProviderInvocationKey) (managed.ProviderInvocationSources, error)

ReadManagedProviderInvocationSources returns retained sources without checking current lease ownership or issuing callbacks, writes, or delegation authority.

func (*Repository) ReadManagedProviderNativeCommit 

func (r *Repository) ReadManagedProviderNativeCommit(ctx context.Context, q managed.RecoveryExactRequest) (managed.RecoveryRecord[managed.ProviderNativeCommitFacts], error)

ReadManagedProviderNativeCommit returns the exact per-binding acceptance and original receipt only after its complete retained invocation associations validate.

func (*Repository) ReadManagedProviderStep 

func (r *Repository) ReadManagedProviderStep(ctx context.Context, q managed.ProviderStepKey) (managed.ProviderStepRecord, error)

ReadManagedProviderStep returns the original permission and retained current result.

func (*Repository) ReadManagedProviderStepAcceptance 

func (r *Repository) ReadManagedProviderStepAcceptance(ctx context.Context, q managed.ProviderStepAuthorization) (managed.ProviderStepAcceptance, error)

ReadManagedProviderStepAcceptance reads independent retained command history. It does not authorize, call a provider, refresh a lease or synthesize a receipt.

func (*Repository) ReadManagedProviderStepFailure 

func (r *Repository) ReadManagedProviderStepFailure(ctx context.Context, q managed.ProviderStepKey) (managed.ProviderStepFailure, error)

ReadManagedProviderStepFailure validates the same original permission and attempt.

func (*Repository) ReadManagedProviderStepRetry 

func (r *Repository) ReadManagedProviderStepRetry(ctx context.Context, key managed.ProviderInvocationKey) (managed.RecoveryRecord[managed.ProviderStepRetryAuthorization], error)

ReadManagedProviderStepRetry returns one exact accepted certificate without selecting it.

func (*Repository) ReadManagedQuiescence 

func (r *Repository) ReadManagedQuiescence(ctx context.Context, k managed.QuiescenceKey) (managed.QuiescenceRecord, error)

ReadManagedQuiescence resolves exact history and checks its current association without expiry checks.

func (*Repository) ReadManagedQuiescenceBatch 

func (r *Repository) ReadManagedQuiescenceBatch(ctx context.Context, k managed.QuiescenceBatchKey) (managed.QuiescenceBatchReceipt, error)

ReadManagedQuiescenceBatch resolves the complete retained aggregate and attempt graph.

func (*Repository) ReadManagedRecoveryActivation 

func (r *Repository) ReadManagedRecoveryActivation(ctx context.Context, key managed.AttemptKey) (managed.RecoveryRecord[managed.RemovalRecoveryActivation], error)

ReadManagedRecoveryActivation validates the full fixed set without restoring authority.

func (*Repository) ReadManagedRecoveryNativeIntent 

func (r *Repository) ReadManagedRecoveryNativeIntent(ctx context.Context, q managed.RecoveryExactRequest) (managed.RecoveryRecord[managed.RecoveryNativeIntent], error)

ReadManagedRecoveryNativeIntent returns one immutable native request for inspection. It supplies no delegation grant and never selects a newer request or repairs an absent leaf.

func (*Repository) ReadManagedRelease 

func (r *Repository) ReadManagedRelease(ctx context.Context, q managed.ReleaseKey) (managed.ReleaseBinding, error)

ReadManagedRelease reads an immutable accepted manifest association in tenant scope.

func (*Repository) ReadManagedRemovalAttempt 

func (r *Repository) ReadManagedRemovalAttempt(ctx context.Context, k managed.AttemptKey) (managed.AttemptRecord, error)

ReadManagedRemovalAttempt resolves exact retained authority without invoking producers.

func (*Repository) ReadManagedRemovalContinuation 

func (r *Repository) ReadManagedRemovalContinuation(ctx context.Context, k managed.ContinuationKey) (managed.ContinuationRecord, error)

ReadManagedRemovalContinuation validates exact saved acceptance without current issue authority.

func (*Repository) ReadManagedRemovalCutoffExact 

func (r *Repository) ReadManagedRemovalCutoffExact(ctx context.Context, request managed.RecoveryExactRequest) (managed.RecoveryRecord[managed.RemovalCutoffFacts], error)

ReadManagedRemovalCutoffExact validates permanent revocation and its original event/receipt before comparing the complete caller-supplied association.

func (*Repository) ReadManagedRemovalGuardClose 

func (r *Repository) ReadManagedRemovalGuardClose(ctx context.Context, request managed.RecoveryExactRequest) (managed.RecoveryRecord[managed.RecoveryNativeCloseFacts], error)

ReadManagedRemovalGuardClose requires the original accepted request, local dependencies and selected native result. It performs no external verification.

func (*Repository) ReadManagedRemovalRevalidation 

func (r *Repository) ReadManagedRemovalRevalidation(ctx context.Context, request managed.RecoveryExactRequest) (managed.RecoveryRecord[managed.RemovalRevalidationFacts], error)

ReadManagedRemovalRevalidation inspects the exact accepted proof and request witness.

func (*Repository) ReadManagedRemovalRevalidationSet 

func (r *Repository) ReadManagedRemovalRevalidationSet(ctx context.Context, key managed.AttemptKey) (managed.RemovalRevalidationSet, error)

ReadManagedRemovalRevalidationSet returns the complete descriptor-ordered set.

func (*Repository) ReadManagedTarget 

func (r *Repository) ReadManagedTarget(ctx context.Context, k managed.Key) (*managed.Target, error)

ReadManagedTarget reads the authoritative complete record.

func (*Repository) ReadManagedWork 

func (r *Repository) ReadManagedWork(ctx context.Context, ref managed.WorkReference) (managed.WorkReference, error)

ReadManagedWork validates the exact immutable index and acceptance/audit associations.

func (*Repository) ReadManagedWorkHead 

func (r *Repository) ReadManagedWorkHead(ctx context.Context, k managed.Key) (managed.WorkHead, error)

ReadManagedWorkHead resolves both desired/provisioning references against retained acceptance.

func (*Repository) ReadProviderEffectBinding 

func (r *Repository) ReadProviderEffectBinding(ctx context.Context, key managed.ProviderEffectBindingKey) (managed.ProviderEffectBindingRecord, error)

ReadProviderEffectBinding inspects retained evidence and returns no provider grant.

func (*Repository) RecordManagedAccessAudit 

func (r *Repository) RecordManagedAccessAudit(ctx context.Context, q managed.AccessAuditRequest) (managed.AccessAuditReceipt, error)

RecordManagedAccessAudit atomically retains one exact attempt receipt and audit intent.

func (*Repository) RecordManagedAttemptAbort 

func (r *Repository) RecordManagedAttemptAbort(ctx context.Context, q managed.AttemptAbortRequest) (managed.Receipt, error)

RecordManagedAttemptAbort retains the accepted exact original Abort.

func (*Repository) RecordManagedAttemptBindingSettlement 

func (r *Repository) RecordManagedAttemptBindingSettlement(ctx context.Context, q managed.AttemptBindingSettlementRequest) (managed.Receipt, error)

RecordManagedAttemptBindingSettlement witnesses continuing nondeletion after late Begin.

func (*Repository) RecordManagedAttemptFence 

func (r *Repository) RecordManagedAttemptFence(ctx context.Context, q managed.AttemptFenceRequest) (managed.Receipt, error)

RecordManagedAttemptFence retains an exact accepted Begin without inventing admission.

func (*Repository) RecordManagedAttemptFinish 

func (r *Repository) RecordManagedAttemptFinish(ctx context.Context, q managed.AttemptFinishRequest) (managed.Receipt, error)

RecordManagedAttemptFinish retains the accepted exact original Finish after Removed.

func (*Repository) RecordManagedDrain 

func (r *Repository) RecordManagedDrain(ctx context.Context, q managed.DrainRequest) (managed.Receipt, error)

RecordManagedDrain retains the original deadline and one immutable terminal result.

func (*Repository) RecordManagedFence 

func (r *Repository) RecordManagedFence(ctx context.Context, q managed.FenceRequest) (managed.Receipt, error)

RecordManagedFence freezes trusted query-retention evidence for one accepted binding.

func (*Repository) RecordManagedOriginalDrain 

func (r *Repository) RecordManagedOriginalDrain(ctx context.Context, q managed.OriginalDrainAcceptanceRequest) (managed.Receipt, error)

RecordManagedOriginalDrain retains process acceptance without asserting terminal success.

func (*Repository) RecordManagedProviderInvocationResult 

func (r *Repository) RecordManagedProviderInvocationResult(ctx context.Context, request managed.ProviderInvocationObservationRequest) error

RecordManagedProviderInvocationResult accepts the caller's stable observation operation. Replaying that complete request keeps its identity and never allocates a replacement ID.

func (*Repository) RecordManagedProviderNativeCommit 

func (r *Repository) RecordManagedProviderNativeCommit(ctx context.Context, request managed.ProviderNativeCommitRequest) (managed.RecoveryRecord[managed.ProviderNativeCommitFacts], error)

RecordManagedProviderNativeCommit verifies configured native acceptance outside the authority transaction, then reloads exact intent, proof and permission before retention.

func (*Repository) RecordManagedProviderStepFailure 

func (r *Repository) RecordManagedProviderStepFailure(ctx context.Context, q managed.ProviderStepFailure) error

RecordManagedProviderStepFailure retains only exact positively witnessed nondelegation.

func (*Repository) RecordManagedProviderStepResult 

func (r *Repository) RecordManagedProviderStepResult(ctx context.Context, q managed.ProviderStepResult) error

RecordManagedProviderStepResult retains late exact results without granting another send.

func (*Repository) RecordManagedRecoveryNativeIntent 

func (r *Repository) RecordManagedRecoveryNativeIntent(ctx context.Context, request managed.RecoveryNativeIntentRequest) (managed.RecoveryRecord[managed.RecoveryNativeIntent], error)

RecordManagedRecoveryNativeIntent retains the exact producer request before external work. Replaying it returns custody, never a transport grant.

func (*Repository) RecordManagedRemovalGuardClose 

func (r *Repository) RecordManagedRemovalGuardClose(ctx context.Context, request managed.RecoveryNativeCloseRequest) (managed.RecoveryRecord[managed.RecoveryNativeCloseFacts], error)

RecordManagedRemovalGuardClose authenticates outside the controller lock, then atomically retains the exact result, selector, event, state and parent receipt.

func (*Repository) RecordManagedRemovalRecoveryAbort 

func (r *Repository) RecordManagedRemovalRecoveryAbort(ctx context.Context, request managed.AttemptAbortRequest) (managed.Receipt, error)

RecordManagedRemovalRecoveryAbort retains the original Abort and fresh binding proof.

func (*Repository) RecordManagedRemovalRecoveryBindingSettlement 

func (r *Repository) RecordManagedRemovalRecoveryBindingSettlement(ctx context.Context, request managed.AttemptBindingSettlementRequest) (managed.Receipt, error)

RecordManagedRemovalRecoveryBindingSettlement retains a fresh Abort witness after independently closed custody and accepted nondeletion settlement.

func (*Repository) RecordManagedRemovalRecoveryCommand 

func (r *Repository) RecordManagedRemovalRecoveryCommand(ctx context.Context, request managed.AttemptCommandRequest) (managed.AttemptCommandGrant, error)

RecordManagedRemovalRecoveryCommand retains an original Finish or Abort command. The complete closed-guard set precedes either native terminal request.

func (*Repository) RecordManagedRemovalRecoveryFinish 

func (r *Repository) RecordManagedRemovalRecoveryFinish(ctx context.Context, request managed.AttemptFinishRequest) (managed.Receipt, error)

RecordManagedRemovalRecoveryFinish retains the original Finish after closed custody.

func (*Repository) ReserveManagedRegistration 

func (r *Repository) ReserveManagedRegistration(ctx context.Context, q managed.ReserveRequest) (managed.Receipt, error)

ReserveManagedRegistration accounts for each incarnation before permission to issue.

func (*Repository) RetainManagedPhaseCommand 

func (r *Repository) RetainManagedPhaseCommand(ctx context.Context, input managed.PhaseCommandRequest) (managed.PhaseCommandGrant, error)

RetainManagedPhaseCommand commits original bytes, required audit and discoverability together. Registration also changes the exact reservation to MayHaveIssued in that same transaction. The grant is original-obligation accounting; C must still authenticate every send/recovery.

func (*Repository) RevokeManagedDeletion 

func (r *Repository) RevokeManagedDeletion(ctx context.Context, q managed.Command) (managed.Receipt, error)

RevokeManagedDeletion atomically prevents any later issuance of an unissued operation.

func (*Repository) RevokeManagedRemovalAttempt 

func (r *Repository) RevokeManagedRemovalAttempt(ctx context.Context, q managed.AttemptRequest) (managed.Receipt, error)

RevokeManagedRemovalAttempt permanently closes every unissued native/provider slot.

func (*Repository) SealManagedEffectiveRemovalCoverage 

func (r *Repository) SealManagedEffectiveRemovalCoverage(ctx context.Context, command managed.RecoveryCommand) (managed.RecoveryRecord[managed.EffectiveRemovalCoverage], error)

SealManagedEffectiveRemovalCoverage atomically retains a nonissuing coverage observation and its independent receipt. Full close intents remain separate.

func (*Repository) SealManagedTarget 

func (r *Repository) SealManagedTarget(ctx context.Context, q managed.Command) (managed.Receipt, error)

SealManagedTarget closes new reservations and atomically revokes unissued commands.

func (*Repository) SetManagedDesired 

func (r *Repository) SetManagedDesired(ctx context.Context, q managed.DesiredRequest) (managed.Receipt, error)

SetManagedDesired preserves lifecycle obligations when an operator changes intent.

func (*Repository) SettleManagedDeletion 

func (r *Repository) SettleManagedDeletion(ctx context.Context, q managed.SettlementRequest) (managed.Receipt, error)

SettleManagedDeletion accepts only definitive evidence bound to this exact operation.

func (*Repository) SettleManagedRemovalAttempt 

func (r *Repository) SettleManagedRemovalAttempt(ctx context.Context, q managed.AttemptSettlementRequest) (managed.Receipt, error)

SettleManagedRemovalAttempt accepts only complete, qualified finite-step disposition.

func (*Repository) SettleManagedRemovalRecovery 

func (r *Repository) SettleManagedRemovalRecovery(ctx context.Context, request managed.AttemptSettlementRequest) (managed.Receipt, error)

SettleManagedRemovalRecovery preserves the original settlement codec and binds it to complete effective coverage plus every accepted native guard close.

func (*Repository) SubmitManagedAction 

func (r *Repository) SubmitManagedAction(ctx context.Context, q managed.ActionSubmission) (managed.ActionReceipt, error)

SubmitManagedAction accepts the desired decision, reserved identities and audit together.

func (*Repository) TombstoneManagedRemovalAttempt 

func (r *Repository) TombstoneManagedRemovalAttempt(ctx context.Context, q managed.AttemptRequest) (managed.Receipt, error)

TombstoneManagedRemovalAttempt preserves every exact original terminal obligation.

func (*Repository) TombstoneManagedRemovalRecovery 

func (r *Repository) TombstoneManagedRemovalRecovery(ctx context.Context, q managed.AttemptRequest) (managed.Receipt, error)

TombstoneManagedRemovalRecovery completes an exactly settled removal after every original binding has accepted Finish. Replays retain the same receipt.

func (*Repository) TombstoneManagedTarget 

func (r *Repository) TombstoneManagedTarget(ctx context.Context, q managed.Command) (managed.Receipt, error)

TombstoneManagedTarget retains immutable ownership after all removal bookkeeping completes.

func (*Repository) TombstoneManagedUnissuedTarget 

func (r *Repository) TombstoneManagedUnissuedTarget(ctx context.Context, q managed.Command) (managed.Receipt, error)

TombstoneManagedUnissuedTarget closes only locally revoked work with no external obligations.

func (*Repository) WithProviderEffectBindings 

func (r *Repository) WithProviderEffectBindings(host managed.ProviderEffectBindingHost) (*ProviderEffectBindingRepository, error)

WithProviderEffectBindings fixes the trusted producer and verifier for this view. No default provider is installed, including for Docker targets.

func (*Repository) WithRemovalRecovery 

func (r *Repository) WithRemovalRecovery(host managed.RemovalRecoveryHost) (*Repository, error)

WithRemovalRecovery returns a host-configured view over the same persistence authority. It copies configuration and retains no separate lifecycle state or caller proof resolver.

type WriterFloorAdminBackend 

type WriterFloorAdminBackend interface {
	WriterFloorAdminAtomic(ctx context.Context, fn func(WriterFloorAdminTransaction) error) error
}

WriterFloorAdminBackend invokes its callback once and serializes authority activation. The outer deployment barrier has already closed traffic and holds the full DML/grant lock domain. This interface does not establish that barrier or authenticate the administrator.

type WriterFloorAdminTransaction 

type WriterFloorAdminTransaction interface {
	WriterFloorSnapshot
	WriterFloorTime(ctx context.Context) (time.Time, error)
	// InstallInitialWriterFloor atomically inserts history and current only into a pristine
	// protected namespace. Missing current with ANY retained history must refuse. The adapter
	// must enforce this even when the requested activation ID differs from existing history.
	InstallInitialWriterFloor(ctx context.Context, data []byte) error
	// AdvanceWriterFloor compares the exact current digest, inserts immutable history and
	// replaces current atomically. Existing history never changes; errors roll back all writes.
	// History has unique authority/activation and authority/epoch keys. Reusing an epoch with
	// a new ID must refuse, including after a current-only rollback. No history scan is needed.
	AdvanceWriterFloor(ctx context.Context, expectedDigest string, data []byte) error
}

WriterFloorAdminTransaction is available only through a dedicated administrative connection. It must not be implemented by an ordinary ControllerTransaction or runtime repository.

type WriterFloorReadBackend 

type WriterFloorReadBackend interface {
	WriterFloorSnapshot(ctx context.Context, fn func(WriterFloorSnapshot) error) error
}

WriterFloorReadBackend binds a trusted configured authority to consistent protected reads. Callbacks run under a read snapshot or the existing held mutation transaction.

type WriterFloorReader 

type WriterFloorReader struct {
	// contains filtered or unexported fields
}

WriterFloorReader implements inspection over a protected backend with no activation method.

func NewWriterFloorReader 

func NewWriterFloorReader(backend WriterFloorReadBackend, authority string) (*WriterFloorReader, error)

NewWriterFloorReader binds trusted host configuration, not a request-selected authority.

func (*WriterFloorReader) ReadManagedWriterFloor 

func (r *WriterFloorReader) ReadManagedWriterFloor(ctx context.Context) (managed.WriterFloor, error)

ReadManagedWriterFloor requires identical current and immutable history bytes.

func (*WriterFloorReader) ReadManagedWriterFloorActivation 

func (r *WriterFloorReader) ReadManagedWriterFloorActivation(ctx context.Context, ref managed.WriterFloorReference) (managed.WriterFloor, error)

ReadManagedWriterFloorActivation returns exact history even after current has advanced. It is inspection only and does not establish current readiness or repair missing metadata.

type WriterFloorSnapshot 

type WriterFloorSnapshot interface {
	ReadCurrentWriterFloor(ctx context.Context) ([]byte, error)
	ReadWriterFloorActivation(ctx context.Context, activationID id.ID) ([]byte, error)
}

WriterFloorSnapshot exposes exact protected reads within one authority snapshot. Current/history are separate from generic controller records and target deletion. Every returned byte slice is owned by the caller and bounded before allocation in SQL.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.