Struct Agent

Source

pub struct Agent { /* private fields */ }

Expand description

One agent: an owner of lanes, channels, capabilities and promises.

Implementations§

Source §

impl Agent

Source

pub fn new() -> Self

Create an agent kernel with an unpredictable capability secret.

The secret comes from the operating system’s CSPRNG. A clock-derived seed would make capability ids guessable to a peer that can estimate the start time, which defeats unforgeability.

Source

pub fn with_secret(secret: [u8; 32]) -> Self

Create an agent with a fixed secret (tests, deterministic replays).

Source

pub fn cell(&self) -> &KernelCell

The shared cell, for transports and adapters that need direct access.

Source

pub fn register(&self, provider: Box<dyn Provider>) -> ProviderId

Register a provider and return its id.

Source

pub fn set_latency(&self, latency_ms: u64)

Configure the simulated provider latency (milliseconds per batch).

Source

pub fn mint( &self, provider: ProviderId, object: u64, attrs: CapAttrs, ) -> Result<CapHandle>

Mint a first-generation capability.

Source

pub fn attenuate( &self, parent: &CapHandle, attrs: CapAttrs, ) -> Result<CapHandle>

Attenuate a capability. Refuses any widening.

Source

pub fn import(&self, id: CapId) -> CapHandle

Import a capability id without owning a reference.

This is how a peer handle is reconstructed from the wire: the id must already exist in this kernel, otherwise the first call fails with rpc/unknown-capability. Importing never proves authority; the registry does.

Source

pub fn revoke(&self, cap: &CapHandle)

Revoke a capability and every capability derived from it.

Source

pub fn create_lane( &self, name: impl Into<String>, budget: Budget, ) -> Result<LaneId>

Create a lane.

Source

pub fn attenuate_lane(&self, lane: LaneId, budget: Budget) -> Result<()>

Attenuate a lane’s budget.

Source

pub fn destroy_lane(&self, lane: LaneId) -> Result<()>

Destroy a lane and drop its queued work.

Queued jobs are removed from the dispatch queue and their promises are rejected, so a destroyed lane cannot keep spending budget or produce side effects after the fact.

Source

pub fn create_channel( &self, name: impl Into<String>, direction: Direction, ) -> Result<ChannelId>

Create a channel.

Subscribe a lane to a channel.

Source

pub fn send( &self, lane: LaneId, channel: ChannelId, payload: Value, caps: &[CapHandle], ) -> Result<u64>

Send a message, transferring capabilities with it.

Source

pub fn recv(&self, channel: ChannelId) -> Result<Option<Message>>

Receive the next message on a channel.

Source

pub fn call( &self, lane: LaneId, cap: &CapHandle, method: &str, args: Vec<Arg>, ) -> Result<PromiseHandle>

Issue a call. The returned promise is pending until the kernel runs.

Source

pub fn run(&self) -> u64

Run until no job is queued. Returns the number of provider round-trips.

Source

pub fn round_trips(&self) -> u64

Round-trips observed so far.

Source

pub fn await_promise(&self, promise: &PromiseHandle) -> Result<Value>

Await a promise, running the kernel until it settles.

Source

pub fn resolve(&self, promise: &PromiseHandle, value: Value) -> Result<()>

Resolve a pending promise manually (used by peers that answer out of band).

Source

pub fn cancel(&self, promise: &PromiseHandle) -> Result<()>

Cancel a promise.

A job that has not been dispatched yet is removed from the queue, so a cancellation really prevents the provider call (and its side effects). A job already in flight cannot be stopped; its result is discarded.

Source