Struct NativeExecRegistry 

pub struct NativeExecRegistry { /* private fields */ }

Serial retained store for one watched native process. The coordinator must place this behind the same mutex for RPC, admission and watcher callbacks. No socket EOF calls died: the birth watcher supplies actual death.

Implementations

impl NativeExecRegistry

pub fn new( proof: Arc<dyn NativeExecProof>, nonce: [u8; 32], ) -> Result<Self, ExecControlError>

Retain the launcher’s proof and a private fresh CSPRNG nonce. The nonce is control-plane secrecy, never a draw from any guest PRNG or clock.

pub fn prepare( &mut self, context: NativeExecContext, request: PrepareNativeExec, ) -> Result<ExecTicket, ExecControlError>

Retain exact Tool bytes only after existing exec preparation is proved.

pub fn permits_connection_close( &mut self, peer: &OwnedFd, predecessor: Option<ExecTicket>, ) -> Result<bool, ExecControlError>

Classify clean EOF for this exact accepted native connection incarnation. None denotes the admitted initial stream; a successor tag names only its own consumed ticket. Delayed EOF remains valid after the later transition completes. Prepared/cancelled attempts and another image’s Issue cannot grant permission. Physical terminal closure is separately owned by the real watch; this method never turns EOF into death.

pub fn binding( &mut self, owner: DetTid, ticket: ExecTicket, mm: MmId, ) -> Result<NativeExecBinding, ExecControlError>

Read the exact retained binding for provisioning or successor map proof. This does not issue or redeem the transaction.

pub fn issued_binding( &mut self, peer: &OwnedFd, ticket: ExecTicket, ) -> Result<NativeExecBinding, ExecControlError>

Read the retained Issued binding for the actual authenticated successor peer without asking the packet to supply its owner or image incarnation. This neither consumes nor authorizes delivery; redeem still performs all independent Config/composite checks and consumes before sending bytes.

pub fn begin_provision( &mut self, peer: &OwnedFd, ticket: ExecTicket, ) -> Result<NativeExecProvision<'_>, ExecControlError>

Consume one Prepared+sealed provision attempt before constructing or sending any packet or descriptor. The caller holds the very same mutex as RPC/admission/watch callbacks through this affine lease. No scheduler lock may be acquired while the lease is held.

pub fn seal( &mut self, owner: DetTid, ticket: ExecTicket, mm: MmId, runtime_digest: [u8; 32], runtime: &[u8], ) -> Result<[u8; 32], ExecControlError>

Seal the actual runtime bytes exactly once before final input provision. The complete digest covers version, both lengths, Tool and runtime bytes.

pub fn issue( &mut self, owner: DetTid, ticket: ExecTicket, mm: MmId, digest: [u8; 32], ) -> Result<(), ExecControlError>

Last old-image edge. Sealed runtime and completed provision are required.

pub fn redeem( &mut self, peer: &OwnedFd, ticket: ExecTicket, config: [u8; 32], digest: [u8; 32], ) -> Result<Vec<u8>, ExecControlError>

Redeem against the actual accepted socket’s pidfd. Consume first: failed ACK/config/state delivery can never make this ticket redeemable again. The unsafe launcher contract, not these credentials, proves native exec.

pub fn cancel( &mut self, owner: DetTid, ticket: ExecTicket, mm: MmId, ) -> Result<(), ExecControlError>

Returned exec errno or an earlier refusal cancels only pre-redemption. Ordinary Detcore CancelExec still performs its own full rollback.

pub fn complete( &mut self, owner: DetTid, ticket: ExecTicket, mm: MmId, ) -> Result<(), ExecControlError>

The trusted successor reports completed real lifecycle and frontend verification, before the acknowledgment can release the guest loader.

pub fn failed(&mut self, ticket: ExecTicket) -> Result<(), ExecControlError>

Permanently fail this birth’s native launch chain, retaining the Failed tombstone. Only explicit pre-redemption cancellation permits a retry.

pub fn provision_transport_failed(&mut self)

A same-birth authenticated provision stream became ambiguous before a usable ticket could be consumed. Preserve terminal records, fail all live transactions and prohibit retries for this birth. Unauthenticated peers must never call this method.

pub fn died(&mut self)

Called only by actual birth-watch death/failure, never replacement EOF.

pub fn stage(&self, ticket: ExecTicket) -> Option<ExecStage>

Observe the retained stage without mutating a transaction or its bytes.

Trait Implementations

impl Debug for NativeExecRegistry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.