Trait NativeExecProof 

pub unsafe trait NativeExecProof:
    Debug
    + Send
    + Sync {
    // Required methods
    fn owner(&self) -> DetTid;
    fn is_live(&self) -> bool;
    fn matches_peer(&self, peer: &OwnedFd) -> bool;
    fn qualify_target(&self, request: &PrepareNativeExec) -> bool;
    fn qualify_runtime(&self, bytes: &[u8]) -> bool;

    // Provided methods
    fn physical_ids(&self) -> Option<(i32, i32)> { ... }
    fn qualify_completion(
        &self,
        _ticket: ExecTicket,
        _binding: NativeExecBinding,
    ) -> bool { ... }
}

Real watcher and immutable-object authority, retained for a single birth.

Safety

Implementations must retain the genuine pidfd/watch registration, accept only the exact same living birth and main thread, and recheck terminal watcher failure. matches_peer must compare the actual accepted peer pidfd to that retained birth. Qualification must independently bind the actual captured resume mask and the one-main-thread, childless preparation cut, the immutable admitted namespace, and the held target/bootstrap files. The runtime proof must exactly decode all carried counters, observer sequence and forwarding boundary, refusing unsupported patch state.

The installed proof and its admission adapter must protect the ticket and provisioned objects, constrain Issue to the exact original native exec leaf, and prevent redemption from the old image. They must establish the covered fresh bootstrap and successor-before-loader transition, and accept Complete only from that genuine successor after its real post-exec and frontend proofs. A same-birth pidfd, token, seal or digest is not proof of kernel exec. Socket qualification must compare against independently held launch objects; actual numeric ownership requires the qualified guest owner’s physical queries and final rechecks, never object equality alone. No request field is authority for any of these facts. These obligations belong to the trusted native launch chain, not to this opaque storage.

Required Methods

fn owner(&self) -> DetTid

Deterministic owner established by actual admission.

fn is_live(&self) -> bool

The retained birth remains alive with no watcher failure.

fn matches_peer(&self, peer: &OwnedFd) -> bool

Actual accepted peer pidfd names precisely that retained live birth.

fn qualify_target(&self, request: &PrepareNativeExec) -> bool

Validate held target/bootstrap objects and immutable namespace, and compare the requested mask with the independently captured actual cut.

fn qualify_runtime(&self, bytes: &[u8]) -> bool

Validate the real, versioned backend runtime state before sealing it.

Provided Methods

fn physical_ids(&self) -> Option<(i32, i32)>

Physical main-thread identity from the same retained watched birth. Missing proof refuses control RPCs. Implementations must never derive this identity from request IDs or unretained numerical PID equality.

fn qualify_completion( &self, _ticket: ExecTicket, _binding: NativeExecBinding, ) -> bool

Revalidate the actual accepted successor’s held mappings, namespace, birth and binding immediately before Complete. Refuses by default. Called under the registry mutex; must never acquire scheduler/pending locks or recurse into the registry. This augments, and never replaces, the unsafe genuine-kernel-exec/lifecycle/consumer obligations above.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors