Enum FailureKind 

pub enum FailureKind {
    Error,
    Panic,
    PolicyRefusal,
    SkidOvershoot {
        count: u64,
    },
    RunTimeout,
    BackendRunFailure,
    TerminalOutcome(TerminalOutcome),
}

A serializable error. This is useful for sending an error to the parent process. This works by converting an error into a string via its Display implementation. Although we lose type information in the process of converting to a string, this preserves the error message and its error chain.

Variants

Error

The child reported a failure it decided to report.

Panic

The child PANICKED and the panic was caught and reported.

⚠️ THIS IS THE ONE BIT THAT PROSE CANNOT CARRY. A caught panic and a reported error arrive at the parent as the same shape – a message and a chain of causes – so without a discriminant the parent must either match on English or call them the same thing. It called them the same thing, which is why a tracer panic and a bad flag were indistinguishable.

PolicyRefusal

The child stopped because a FAIL-CLOSED POLICY refused the run.

⚠️ A REFUSAL AND A REPORTED ERROR ARE THE SAME SHAPE HERE TOO, which is the identical argument that justified Panic. Record mode sets exit_on_unsupported_syscall and shutdown_on_unsupported_syscall: false, so it returns a typed UnsupportedSyscallError through Reverie instead of calling unrecoverable_shutdown. That path never produces an exit status of its own, so the status channel – which is what carries HERMIT_POLICY_REFUSAL_EXIT on the run path – has nothing to say, and the refusal arrived indistinguishable from “hermit broke”: exit 125, class=container-child-exit. Two configurations of one policy reported opposite things about the same decision.

SkidOvershoot

A precise PMU timer event (ptrace or KVM) arrived after its target. The count is carried across the container boundary so the parent can publish the named infrastructure error instead of leaving the pending no-result.

Fields

count: u64

RunTimeout

The child stopped because HERMIT’S OWN --timeout BOUND was reached.

⚠️ THE SAME ARGUMENT A THIRD TIME, and it is not hypothetical: measured on 2026-08-26, hermit run --timeout 3 -- ./spin fired at exactly 3s with no residue and still reported exit 125 / class=cli-error – “hermit broke” – because GuestTimedOut is produced INSIDE the container child and every type is a string by the time the parent sees it. Unlike the refusal path there is no status channel to fall back on either: the timeout unwinds and RETURNS rather than calling unrecoverable_shutdown, precisely because the unwind is the point.

BackendRunFailure

The backend failed while running the guest (crate::BackendRunFailure). Carried so the parent can record the verification run as failed by its backend instead of leaving the pending no-result stamp.

TerminalOutcome(TerminalOutcome)

The run ended with a scheduler terminal outcome (crate::SchedulerEndedRun): a deadlock under Hermit’s model, or its virtual clock passed --virtual-timeout. Its own outcome, neither a guest result nor an internal failure. Carried for the reason RunTimeout is: the child reports it through this channel, after the run was unwound and finished, rather than through the outcome’s status, which it exits with when its backend cannot unwind the guest.

Trait Implementations

impl Clone for FailureKind

fn clone(&self) -> FailureKind

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for FailureKind

impl Debug for FailureKind

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for FailureKind

fn default() -> FailureKind

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for FailureKind

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for FailureKind

impl PartialEq for FailureKind

fn eq(&self, other: &FailureKind) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for FailureKind

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for FailureKind