Trait ProtectedMemoryProvider 

pub unsafe trait ProtectedMemoryProvider {
    type Handle;
    type Reservation;

    // Required methods
    fn provider_identity(&self) -> usize;
    fn provider_generation(&self) -> usize;
    fn health_generation(&self) -> usize;
    fn protection_generation(&self) -> usize;
    fn health(&self) -> ProviderHealth;
    fn limits(&self) -> ProviderLimits;
    fn report(&self) -> ProviderReport;
    fn reserve(
        &self,
        access: &ProviderAccess,
        request: ProtectionRequest,
    ) -> Result<Self::Reservation, ProtectionError>;
    fn materialize(
        &self,
        access: &ProviderAccess,
        reservation: Self::Reservation,
    ) -> Result<Self::Handle, ProtectionError>;
    fn logical_len(
        &self,
        access: &ProviderAccess,
        handle: &Self::Handle,
    ) -> usize;
    fn physical_protection(
        &self,
        access: &ProviderAccess,
        handle: &Self::Handle,
    ) -> PhysicalProtection;
    fn bytes<'handle>(
        &self,
        access: &ProviderAccess,
        handle: &'handle Self::Handle,
    ) -> &'handle [u8] ;
    fn bytes_mut<'handle>(
        &self,
        access: &ProviderAccess,
        handle: &'handle mut Self::Handle,
    ) -> &'handle mut [u8] ;
    fn confirm_wipe(
        &self,
        access: &ProviderAccess,
        handle: &Self::Handle,
        attestation: Option<AttestationEvidence>,
        cursor: &mut TeardownCursor,
    ) -> WipeConfirmation;
    fn remove_protection(
        &self,
        access: &ProviderAccess,
        handle: &mut Self::Handle,
        cursor: &mut TeardownCursor,
    ) -> ProviderOperationResult;
    fn reconcile_accounting(
        &self,
        access: &ProviderAccess,
        handle: &mut Self::Handle,
        cursor: &mut TeardownCursor,
    ) -> ProviderOperationResult;
    fn dispose(
        &self,
        access: &ProviderAccess,
        handle: Self::Handle,
        cursor: &mut TeardownCursor,
    ) -> DisposalResult<Self::Handle>;
    fn quarantine(
        &self,
        access: &ProviderAccess,
        handle: Self::Handle,
        record: QuarantineRecord,
    );
}

Protected allocation and bounded quarantine provider.

Safety

An implementation must enforce unique live handles, stable backing ranges, checked finite admission budgets, generation/ABA safety, and infallible allocation-free quarantine transfer. Returned byte slices must name exactly one live handle’s complete logical allocation. Every hook must be non-unwinding. Provider operations must obey their reported applied/not-applied/indeterminate disposition; non-idempotent ambiguous work must not be replayed. AllocationPresenceUnknown must destroy every pointer capability and retain only a non-owning tombstone identity.

Required Associated Types

type Handle

Live allocation handle owned by one protected typestate value.

type Reservation

Pre-plaintext reservation carrying one registry slot and full budget.

Required Methods

fn provider_identity(&self) -> usize

Stable opaque provider-instance identity.

fn provider_generation(&self) -> usize

Provider-instance generation. Reconstruction must change it.

fn health_generation(&self) -> usize

Generation changed by provider health degradation.

fn protection_generation(&self) -> usize

Generation changed by physical protection transitions.

fn health(&self) -> ProviderHealth

Current provider health.

fn limits(&self) -> ProviderLimits

Finite provider limits.

fn report(&self) -> ProviderReport

Redacted aggregate report.

fn reserve( &self, access: &ProviderAccess, request: ProtectionRequest, ) -> Result<Self::Reservation, ProtectionError>

Reserves registry and complete resource budgets before allocation.

fn materialize( &self, access: &ProviderAccess, reservation: Self::Reservation, ) -> Result<Self::Handle, ProtectionError>

Creates protected storage without plaintext and consumes the reservation.

fn logical_len(&self, access: &ProviderAccess, handle: &Self::Handle) -> usize

Complete logical allocation length.

fn physical_protection( &self, access: &ProviderAccess, handle: &Self::Handle, ) -> PhysicalProtection

Current physical protection posture for this exact handle.

fn bytes<'handle>( &self, access: &ProviderAccess, handle: &'handle Self::Handle, ) -> &'handle [u8]

Immutable access tied to the unique live handle.

fn bytes_mut<'handle>( &self, access: &ProviderAccess, handle: &'handle mut Self::Handle, ) -> &'handle mut [u8]

Exclusive access tied to the unique live handle.

fn confirm_wipe( &self, access: &ProviderAccess, handle: &Self::Handle, attestation: Option<AttestationEvidence>, cursor: &mut TeardownCursor, ) -> WipeConfirmation

Confirms the completed overwrite/barrier at the requested assurance level.

fn remove_protection( &self, access: &ProviderAccess, handle: &mut Self::Handle, cursor: &mut TeardownCursor, ) -> ProviderOperationResult

Removes physical protection conclusively or reports uncertainty.

fn reconcile_accounting( &self, access: &ProviderAccess, handle: &mut Self::Handle, cursor: &mut TeardownCursor, ) -> ProviderOperationResult

Reconciles page/reference/accounting state exactly once.

fn dispose( &self, access: &ProviderAccess, handle: Self::Handle, cursor: &mut TeardownCursor, ) -> DisposalResult<Self::Handle>

Disposes the allocation exactly once.

fn quarantine( &self, access: &ProviderAccess, handle: Self::Handle, record: QuarantineRecord, )

Transfers one still-live handle into its pre-reserved quarantine slot.

This hook must be infallible, allocation-free, and non-unwinding.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors

impl<const SLOTS: usize> ProtectedMemoryProvider for BestEffortProvider<SLOTS>

type Handle = BestEffortHandle

type Reservation = BestEffortReservation