Enum HaltScope 

pub enum HaltScope {
    Tenant,
    Agent {
        name: String,
    },
    Revision {
        digest: Digest,
    },
    Subject {
        id: String,
    },
}

What an emergency stop covers.

A plane hosts many agents, and agent 12 of 28 is misbehaving at three in the morning is the ordinary incident — a switch that can only stop all 28 is not an emergency stop for it. So a halt names its scope. Every standing halt is checked together and a run is refused if any matches, so a broad stop and a narrow one coexist and lifting the narrow one leaves the broad one standing.

Revision names exact reviewed bytes, so a fix published as a new version runs while the broken revision stays stopped — prefer it when a deploy is the incident. Agent covers every revision of a declared name. Tenant is the power switch.

Subject is keyed on the other axis, and it is the one to reach for when the incident is not the workload but the authority: a credential somebody has withdrawn, a service account that turned out to be shared, a person who has left. The three scopes above ask what is running; this one asks who it is running for: any principal on the delegation chain bound at admission and carried on every run’s IdentityBound record — the person at its root, each workload it was delegated through, and the one acting. Authority flows down the chain, so withdrawing any link withdraws everything below it. A run with no chain of its own is covered by none of them — there is nothing to key on, and inventing a match would stop work for a reason nobody could look up.

A name is a string the manifest’s author typed, and a halt is still keyed on one because it is a refusal: a name-keyed refusal at worst stops work somebody did not mean to stop, which an operator sees at once and lifts — the opposite of a name-keyed grant, which context.agent.name is therefore never used for.

Variants

Tenant

Everything this tenant would start. The power switch.

Agent

Every revision of one declared agent, by metadata.name.

Fields

name: String

Revision

One exact reviewed revision, by manifest digest.

The form that is precise about which revision is stopped, so a fix published as a new version is not stopped with it.

Fields

digest: Digest

Subject

Everything acting for one principal, wherever it stands on the run’s delegation chain.

The authority axis rather than the workload axis. Ordered last so that it wins the message when several scopes cover one run: an operator who withdrew a credential and whoever is refused are looking for different sentences, and “the tenant is halted” sends the second one to the wrong incident.

Fields

id: String

Implementations

impl HaltScope

pub const FORMS: [&'static str; 4]

Every form parse accepts, written the way an operator types it.

One list, because a scope an operator cannot learn the spelling of is a control they cannot reach — and the CLI’s help, its refusal and the operator API all have to say the same thing this parser accepts. Held to the list rather than to the variant count: a count agrees with itself while a form is missing.

pub fn agent(name: impl Into<String>) -> Self

Every revision of one declared agent.

pub const fn revision(digest: Digest) -> Self

One exact reviewed revision.

pub fn subject(id: impl Into<String>) -> Self

Everything acting for one principal on a run’s delegation chain.

pub fn key(&self) -> String

The durable key, and the form an operator types on the command line.

Round-trips through parse. One column rather than a discriminant beside a value, because a scope stored in two columns is a scope two backends can disagree about the emptiness rules of.

pub fn forms() -> String

The forms, joined for a refusal a person reads.

pub fn parse(key: &str) -> Option<Self>

Read back a stored key.

None for anything this build does not understand — a scope written by a newer version, say. A caller reading standing halts must treat that as corruption rather than skipping the row: a halt this instance cannot read is one it must not run through.

pub fn withdraws_from(&self, chain: &Delegation) -> Option<&str>

The principal this halt withdraws, if it is anywhere on chain.

The one scope that reaches work already running. The others stop admission, because cutting a saga mid-flight leaves reversals unrun; here the incident is the authority, and a run carrying on under a withdrawn credential is the harm. It pauses: the run stops at its next step boundary, its mutations stand, and lifting the halt continues it.

pub fn withdrawn_subject(&self) -> Option<&str>

The principal this halt names, when it names one.

pub fn covers( &self, agent: Option<&AgentIdentity>, chain: Option<&Delegation>, ) -> bool

Whether this halt stops a run governed by agent and acting under chain.

Both, because the scopes ask different questions. Three of them ask what is running and one asks who it runs for, so a caller that passed only the agent would silently never match a withdrawn authority — the worst failure available here, since it is a refusal that does not happen and therefore leaves no trace at all.

A run with neither — a skill registered directly on the plane, with no manifest and no chain — is stopped only by Tenant. There is nothing narrower to key it on, and inventing a match would stop work for a reason nobody could look up.

Trait Implementations

impl Clone for HaltScope

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for HaltScope

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for HaltScope

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for HaltScope

impl Hash for HaltScope

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl Ord for HaltScope

fn cmp(&self, other: &Self) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

fn clamp_to<R>(self, range: R) -> Self

where Self: Sized, R: ClampBounds<Self>,

🔬This is a nightly-only experimental API. (clamp_to)

Restrict a value to a certain range.

impl PartialEq for HaltScope

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl PartialOrd for HaltScope

fn partial_cmp(&self, other: &Self) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl StructuralPartialEq for HaltScope