Module native_exec_control 

Coordinator-owned native exec transactions. No Tool is decoded or run here.

This inactive interface requires a trusted watched native launcher. A PID, ticket or socket credential alone is not proof that a kernel exec occurred. The launcher owns that unsafe contract, including the covered interpreter, protected bootstrap descriptors and successor-before-loader initialization.

Structs

ExecTicket

A protected single-use token. It carries no guest-visible deterministic data.

NativeExecBinding

Immutable target and state identities retained under the ticket.

NativeExecContext

Scheduler facts read under its mutex before a neutral native control edge.

NativeExecNeutralBinding

Neutral, admitted live-cut data outside opaque Tool bytes. Actual live producer identities retained by the authenticated coordinator.

NativeExecProvision

Affine host-only provision access. Dropping incomplete access poisons the birth and retains its Failed tombstone. It is neither Clone nor Copy.

NativeExecRegistry

Serial retained store for one watched native process. The coordinator must place this behind the same mutex for RPC, admission and watcher callbacks. No socket EOF calls died: the birth watcher supplies actual death.

NativeExecSocketBinding

Socket facts queried by the genuine protected guest owner at its live cut. Numeric slots are handoff data, not independent host proof of a child FD.

NativeExecSocketBindings

The same independently admitted socket roles in their current handoff slots.

PrepareNativeExec

Data submitted at the already-prepared, still-live Detcore injection cut.

Enums

ExecControlError

A native control refusal, never a replacement for a returned kernel errno.

ExecStage

Retained transaction stage. Terminal records cannot be removed or replayed.

GlobalRequest

Existing full request wire type; native controls preserve its exact tags. This is public only so it can be used in the GlobalTool trait. It should NOT be used by any client outside of this file.

GlobalResponse

Existing full response wire type; neutral native responses carry no clock. Responses from the global object

Constants

MAX_STATE_BYTES

Maximum complete state frame, including both Tool and runtime state.

MAX_TRANSITIONS

Finite retained history for the first, bounded native exec implementation.

Traits

NativeExecProof

Real watcher and immutable-object authority, retained for a single birth.

Functions

split_state

Split an already-authenticated complete state frame with exact lengths. This checks its structural format; the caller must separately authenticate the expected digest and perform bounded exact decoding of both payloads.

split_state_binding

Decode the admitted neutral identity outside the opaque Tool bytes. The transport caller must first authenticate the entire expected frame digest.