Crate appcore_update 

Application artifact update, activation and rollback lifecycle.

The Runtime treats artifacts as opaque bytes. It verifies generic identity, compatibility and integrity but never knows application code or business data.

Structs

ActivationEvidence

Host evidence returned after an adapter activates an artifact.

ActivationReceipt

Receipt required to commit or roll back one activation.

ActivationReceiptV2

Versioned V2 activation receipt kept separately from the V1 receipt.

ActivationRequest

Runtime-owned context passed to a host activation adapter.

ArtifactChunkRequestV2

Path-free bounded byte-range request carried by a Peer RPC V2 stream.

ArtifactChunkResponseV2

Metadata repeated beside the decoded bytes in a Peer RPC V2 response stream.

ArtifactDescriptor

Immutable application artifact published by an update provider.

ArtifactOfferRequestV2

Path-free offer metadata sent through a Peer RPC V2 request stream.

ArtifactOfferResponseV2

Response metadata for an artifact offer.

ArtifactTarget

Platform and packaging target for one published artifact.

ArtifactTransferPolicy

Transfer limits applied before reading or allocating a chunk.

ArtifactTrustPolicy

Deployment-owned allowlist applied before signature verification.

CacheOptions

Configuration for one bounded update cache.

CachedArtifact

A fully verified artifact published by UpdateCache.

CatalogEntry

One signed descriptor and its location relative to the catalog root.

Ed25519ArtifactVerifier

Ed25519 verifier backed by deployment-owned public trust roots.

FileArtifactSource

Local file source for bounded artifact transfer.

FileArtifactStore

Filesystem artifact store using atomic pointer replacement.

FileRecoveryStore

Filesystem journal for the additive V2 recovery contract.

FileUpdateProvider

Local-first update provider backed by a bounded JSON artifact index.

FileUpdateProviderFactory

Factory for the local-first file update provider.

HostUpdateFlow

One deployment-owned adapter composition. Use a single external process lock for the journal and host operation. This type never acquires a hidden lock, starts a process, selects providers or performs a domain migration.

LatestCompatibleOfferRequestV2

Requests the latest signed release compatible with a Runtime host.

LatestCompatibleOfferResponseV2

Latest compatible signed descriptor selected by an update peer.

LatestCompatibleUpdateIdentity

Query used to select the latest release compatible with a Runtime host.

MobileUpdatePolicy

Explicit mobile update policy with no store or installer implementation.

MobileUpdateRequest

Request context used to evaluate one mobile update offer.

NoUpdateFaults

Fault injector that never interrupts production execution.

PolicyArtifactVerifier

Composes deployment allowlists with a cryptographic verifier.

QuarantineExclusion

One catalog release excluded by active quarantine.

QuarantineKey

Complete release identity used as the quarantine key.

QuarantineRecord

Persisted bounded quarantine entry.

QuarantineSelection

Selection result with bounded quarantine explanations.

QuarantineStore

Bounded, restart-persistent quarantine store.

RecoveryResult

Result of an explicit recovery action.

ReleaseCatalog

Validated catalog of signed, platform-specific artifact descriptors.

ReleaseCatalogStore

Persistent catalog that serves bytes only for catalog-owned descriptors.

StagedArtifact

Opaque staged artifact owned by an artifact store.

UpdateCache

Filesystem cache for resumable, opaque artifact downloads.

UpdateCoordinator

Coordinates provider, store, integrity, health and rollback boundaries.

UpdateIdentity

Local identity used to select one compatible release.

UpdateRequest

Query used to select an update candidate.

Enums

ActivationPhaseV2

Persisted phase of one V2 activation attempt.

ArtifactPeerStatusV2

Typed status returned by an update peer before byte streaming begins.

MobileUpdateAction

Mobile update action owned by the deployment or platform distribution.

MobileUpdateDecision

Result of the bounded mobile update compatibility gate.

QuarantineReason

Typed reason why a release was quarantined.

QuarantineState

Current state of a quarantine entry.

RecoveryAction

Explicit host action applied to a V2 recovery receipt.

RecoveryDecision

Read-only conclusion from one recovery inspection.

SigningKeyStatus

Lifecycle status of one deployment-owned artifact signing key.

UpdateError

Update lifecycle failure.

UpdateFaultPoint

Controlled lifecycle points available to fault-injection tests.

UpdateOutcome

Final result of one update attempt.

UpdatePreparation

Result of staging and activating an update before process-level health verification.

UpdateStaging

Result of candidate verification and staging before activation.

Constants

ACTIVATION_V2_FORMAT_VERSION

Version of the additive activation recovery journal.

DEFAULT_ARTIFACT_CHUNK_BYTES

Conservative default maximum decoded chunk size.

FILE_UPDATE_PROVIDER_ID

Provider ID for the local-first JSON index and file artifact adapter.

QUARANTINE_FORMAT_VERSION

Version of the persistent quarantine document.

QUARANTINE_MAX_ENTRIES

Maximum number of release keys accepted by one store.

RELEASE_CATALOG_MAX_BYTES

Maximum encoded catalog size accepted by the built-in reader.

RELEASE_CATALOG_MAX_ENTRIES

Maximum number of entries retained by one catalog.

UPDATE_CHUNK_CAPABILITY

Capability used to request one bounded artifact byte range.

UPDATE_METADATA_FORMAT_VERSION

Stable format version for update pointers and pending activation metadata.

UPDATE_OFFER_CAPABILITY

Capability used to negotiate availability of one immutable artifact.

UPDATE_PEER_METADATA_MAX_BYTES

Maximum serialized metadata accepted by the update payload contracts.

Traits

ActivationAdapter

Generic host adapter for prepare, activation, health, commit, rollback and recovery. When composed by HostUpdateFlow, every boundary must be bounded and idempotent for the same attempt/artifact identity. Inspect actual host state before changing an interrupted attempt; prepared intent does not prove that activation has not happened. Preserve previous artifacts through recovery.

ActivationHealthCheck

Health gate executed after an artifact becomes active.

ArtifactAuthenticityVerifier

Verifies that an artifact descriptor was published by a trusted identity.

ArtifactSource

Reads bounded chunks for one immutable artifact.

ArtifactStore

Store contract for atomic staging and reversible activation.

ArtifactWriter

Receives chunks without activating or installing the artifact.

UpdateFaultInjector

Fault-injection contract used by deterministic update tests.

UpdateProvider

Provider contract for listing and fetching opaque application artifacts.

UpdateRecoveryGate

Host-owned write exclusion and data recovery preparation. Implementations must impose deadlines, persist installation-bound backups, and keep normal writes blocked on every ambiguous result, including restart.

Functions

artifact_signing_payload

Builds the stable byte payload covered by an artifact signature.

receive_artifact

Receives and verifies one complete artifact through a bounded stream.

Type Aliases

SharedUpdateProvider

Shared update provider interface produced by deployment factories.

UpdateResult

Result returned by the update lifecycle.