Skip to main content Crate capsule_runtime Copy item path Source pub use artifact_config::configured_artifact_names ;pub use artifact_config::lower_artifact_config ;pub use artifact_config::ARTIFACT_CONFIG_ENV ;pub use artifact_config::MAX_ARTIFACT_CONFIG_BYTES ;pub use artifact_supply::SourceSupply ;pub use artifact_supply::SourcedArtifact ;pub use containment::applied_mechanism ;pub use containment::check_containment_floor ;pub use containment::containment_shortfall_reason ;pub use containment::detect_achieved_containment ;pub use containment::detect_sealed_blocker ;pub use containment::detect_userns_grant ;pub use containment::doctor_runtime_dir ;pub use containment::explain_scope ;pub use containment::install_from_places ;pub use containment::read_only_advisory_for ;pub use containment::render_install ;pub use containment::render_read_only ;pub use containment::render_records_dir ;pub use containment::render_runtime_dir ;pub use containment::resolve_runtime_dir_reach ;pub use containment::resolve_runtime_dir_reaches ;pub use containment::DoctorDirReports ;pub use containment::ExportsFilesReport ;pub use containment::FilesystemBoundaryReport ;pub use containment::FilesystemRestriction ;pub use containment::PreopenReport ;pub use containment::PreopenSurface ;pub use containment::RuntimeDirReach ;pub use containment::RuntimeDirReport ;pub use containment::ScopeReport ;pub use containment::ShortfallCause ;pub use containment::StateStoreReport ;pub use diagnostic::diagnostic_workdir ;pub use diagnostic::set_diagnostic_workdir ;pub use diagnostic::Emitted ;pub use murmur_home::usable_murmur_home ;pub use murmur_home::HomeUnusable ;pub use murmur_home::HOME_UNUSABLE_HINT ;pub use network_namespace::check_egress_namespace ;pub use network_namespace::detect_egress_namespace_blocker ;pub use network_namespace::skip_without_egress_namespace ;pub use network_namespace::EgressNamespaceBlocker ;pub use records_dir::records_dir_root ;pub use records_dir::records_group ;pub use records_dir::records_group_under ;pub use records_dir::RecordsDir ;pub use records_dir::HOOKS_SUBDIR ;pub use records_dir::RECORDS_DIR_ENV ;pub use records_dir::RECORDS_DIR_NAME ;pub use runtime_dir::runtime_dir_inside_warning ;pub use runtime_dir::runtime_dir_placement ;pub use runtime_dir::RuntimeDirPlacement ;pub use runtime_dir::RUNTIME_DIR_ENV ;pub use runtime_dir::RUNTIME_DIR_GUEST_PATH ;pub use sealed::classify_installed_profile ;pub use sealed::classify_profile_attachment ;pub use sealed::inspect_installed_profile ;pub use sealed::inspect_profile_attachment ;pub use sealed::InstalledProfileState ;pub use sealed::ProfileAttachment ;pub use sealed::SealedBlocker ;pub use sealed::UsernsGrant ;pub use sealed::SEALED_APPARMOR_ATTACHMENT_PATHS ;pub use sealed::SEALED_APPARMOR_PROFILE_PATH ;pub use sealed::SEALED_APPARMOR_PROFILE_SHA256 ;pub use child_launch::child_workdir_for ;pub use child_launch::format_workdir_identity ;pub use child_launch::launch_child_capsule ;pub use child_launch::parse_workdir_identity ;pub use child_launch::ChildLaunchRequest ;pub use child_launch::LaunchedChild ;pub use child_launch::MUR_BINARY_ENV ;pub use child_launch::READINESS_TOKENS_FLAG ;pub use child_launch::WORKDIR_IDENTITY_FLAG ;pub use delegation::CompletionAddress ;pub use delegation::Spawner ;pub use delegation::SpawnerHandle ;pub use delegation_plane::DelegationLaunch ;pub use delegation_plane::DelegationOrigin ;pub use delegation_plane::DelegationPlane ;pub use delegation_plane::DelegationRequest ;pub use delegation_plane::DelegationResult ;pub use delegation_plane::StartedDelegation ;pub use delegation_plane::DELEGATION_RESULT_TIMEOUT ;pub use delegation_plane::DELEGATION_TIMEOUT_ENV ;pub use door_auth::door_posture ;pub use door_auth::is_loopback_bind ;pub use door_auth::public_door_bind_warning ;pub use door_auth::public_door_warning ;pub use door_auth::render_public_door_warning ;pub use door_auth::AuthRefusal ;pub use door_auth::DoorAuth ;pub use door_auth::DoorExposure ;pub use door_auth::DoorGrant ;pub use door_auth::DoorToken ;pub use door_auth::PublicDoorDisclosure ;pub use door_auth::DOOR_TOKEN_ENV ;pub use errors::RuntimeError ;pub use errors::UnreachableEntrypoint ;pub use formation::FormationId ;pub use formation::FormationPeer ;pub use formation::FormationPeers ;pub use formation_credentials::FormationAuthority ;pub use formation_credentials::FormationBundle ;pub use formation_credentials::FormationMember ;pub use formation_credentials::FormationToken ;pub use formation_credentials::FormationVerifier ;pub use formation_credentials::FormationVerifyKey ;pub use formation_credentials::FORMATION_CALL_SCOPES ;pub use formation_credentials::FORMATION_CHANNEL_ENV ;pub use host_warnings::host_warnings_reported ;pub use host_warnings::host_warnings_reported_in ;pub use host_warnings::HOST_WARNINGS_REPORTED_ENV ;pub use lanes::TaskLane ;pub use lifeline::ChildLifeline ;pub use lifeline::FormationLifeline ;pub use lifeline::MemberLifeline ;pub use lifeline::SpawnerLifeline ;pub use lifeline::FORMATION_LIFELINE_ENV ;pub use lifeline::SPAWNER_LIFELINE_ENV ;pub use limits::ExecutionLimits ;pub use origin::TaskOrigin ;pub use origin::TaskProvenance ;pub use origin::TrustClass ;pub use peer_handoff::audience_from_card ;pub use peer_handoff::handle_id ;pub use peer_handoff::handle_peer_request ;pub use peer_handoff::is_peer_path ;pub use peer_handoff::mint ;pub use peer_handoff::stored_path_for ;pub use peer_handoff::verify ;pub use peer_handoff::HandleError ;pub use peer_handoff::HandlePayload ;pub use peer_handoff::MintedHandle ;pub use peer_handoff::PeerError ;pub use peer_handoff::PeerMintKey ;pub use peer_handoff::PeerPlane ;pub use peer_handoff::HANDLE_ID_HEADER ;pub use peer_handoff::PEER_INBOX_DIR ;pub use peer_handoff::PEER_PATH_PREFIX ;pub use registration::check_roost_health ;pub use registration::deregister_session ;pub use registration::register_session ;pub use registration::SessionOutcome ;pub use resource_plane::check_export_root ;pub use resource_plane::check_peer_files_root ;pub use resource_plane::handle_resource_request ;pub use resource_plane::reason_phrase ;pub use resource_plane::symlink_policy ;pub use resource_plane::DeclaredExport ;pub use resource_plane::ListEntry ;pub use resource_plane::ListResponse ;pub use resource_plane::ReadResponse ;pub use resource_plane::ResourceError ;pub use resource_plane::ResourcePlane ;pub use resource_plane::ResourceResponse ;pub use resource_plane::SymlinkPolicy ;pub use resource_plane::RESOURCE_PATH_PREFIX ;pub use resources::HostResourceLimits ;pub use retention::list_records ;pub use retention::locate_message ;pub use retention::prune_records ;pub use retention::prune_sessions ;pub use retention::remove_record ;pub use retention::truncate_record ;pub use retention::MessageLocation ;pub use retention::MessageStatus ;pub use retention::PrunedRecord ;pub use retention::PrunedSession ;pub use retention::RecordSummary ;pub use retention::RemovedRecord ;pub use retention::TruncationMarker ;pub use retention::TruncationOutcome ;pub use roster::admit_roster ;pub use roster::admit_roster_file ;pub use roster::caller_overflow_fix ;pub use roster::caller_overflow_warning ;pub use roster::AdmittedMember ;pub use roster::AdmittedRoster ;pub use roster::CallerOverflow ;pub use roster::RosterEdge ;pub use roster::RosterRefusal ;pub use running::Liveness ;pub use running::ProcessState ;pub use running::RunningGuard ;pub use running::RunningRecord ;pub use running::SignalOutcome ;pub use runtime::check_env_allow_reaches_guests ;pub use runtime::check_no_reserved_tool_names ;pub use runtime::has_subprocess_route_at_staging ;pub use runtime::launch_session ;pub use runtime::launch_session_handling_sigterm ;pub use runtime::secret_shaped_env_grants ;pub use runtime::stage_session ;pub use runtime::stripped_env_allow_entries ;pub use runtime::undeclarable_runtime_pin_role ;pub use runtime::warn_on_gateway_endpoint_in_network_allow ;pub use runtime::warn_on_interpreter_runtime_grants ;pub use runtime::warn_on_launch_only_gateway_credential ;pub use runtime::warn_on_secret_shaped_env_grants ;pub use runtime::warn_on_unmetered_gateways ;pub use runtime::warn_on_userns_restriction_disabled_host_wide ;pub use runtime::warn_on_workdir_exec ;pub use runtime::SecretShapedEnvGrant ;pub use runtime::StrippedEnvAllowEntry ;pub use spawn_credential::SpawnApproval ;pub use spawn_credential::SpawnCredential ;pub use spawn_envelope::EnvelopeAxis ;pub use spawn_envelope::EnvelopeViolation ;pub use spawn_envelope::SpawnEnvelope ;pub use staged_runtime::check_staged_runtime_floor ;pub use state_store::ensure_state_store ;pub use state_store::state_store_reports ;pub use state_store::validate_store_name ;pub use state_store::STATE_PREOPEN_NAME ;pub use types::capability_policy_from_runtime_manifest ;pub use types::ArtifactRequest ;pub use types::CapabilityPolicy ;pub use types::InstalledArtifactSummary ;pub use types::LaunchEnding ;pub use types::LaunchResult ;pub use types::LockExpectation ;pub use types::ResolvedLockArtifact ;pub use types::ResumeMode ;pub use types::ResumeRequest ;pub use types::StageRequest ;pub use types::StagedSession ;pub use workdir_fs::EntryKind ;pub use workdir_fs::RefusalReason ;pub use workdir_fs::WorkdirError ;pub use workdir_fs::WorkdirOperation ;pub use workdir_fs::WorkdirRefusal ;pub use workdir_fs::WorkdirRoot ;pub use workdir_writes::render_runtime_writes ;pub use workdir_writes::RuntimeWriteCondition ;pub use workdir_writes::RuntimeWriteKind ;pub use workdir_writes::RuntimeWriteReport ;pub use workdir_writes::RuntimeWriteScope ;pub use workdir_writes::SESSION_ID_PLACEHOLDER ;artifact artifact_config Operator-authored per-artifact configuration: the config: block on an artifact’s entry in
the capsule operator’s own manifest, lowered to compact JSON and delivered to that artifact
alone as ARTIFACT_CONFIG_ENV artifact_supply Where a runtime pull finds an artifact the session’s stores do not hold. bindings child_launch Launching a delegated child as an operating-system process of the parent’s own runtime. containment Containment classes: what an operator declares versus what a host actually achieves . delegation Which capsule delegated to this one, and how a delegated child says that it finished. delegation_plane Handing one task to one sub-capsule, and learning what became of it. detached Shell commands that outran their grace period and finished in the background. diagnostic The runtime’s one way to write a line to standard output or standard error. door_auth Who may call the A2A door: the tokens a capsule declaring network.authentication mints at
launch, the check every gated request passes, and the refusals it answers with. errors formation The formation a session belongs to, and the one id that names it. formation_credentials Who in a formation may call whom: the credential a formation launcher issues for each roster
edge, the check every member’s door makes, and the channel a member’s runtime is handed its
credentials and its callees’ addresses on. formation_launch Launching a formation: every member of an admitted roster as a mur run subprocess of its own,
peers first and the entry member last, and every member stopped once the entry member’s process
has ended. host_warnings Host-level warnings: stated once per launch, not once per process. lanes Which queued task runs next. lifeline Lifelines: pipes through which a process learns that another process it depends on has ended. limits Per-guest execution limits: epoch-based deadlines and store resource caps. mac_token One opaque token grammar, and the memory-only key that seals it. murmur_home The murmur home, ~/.murmur, and the modes of what it holds. network_namespace The capsule’s own network namespace: the structural half of the mechanism that replaced the
seccomp-notify connect/sendto supervisor. origin Why a task woke the capsule, and how far its content is trusted. peer_handoff Peer file handoff: runtime-minted handles over a two-sided grant. plan precompile Compiling WASM artifacts ahead of their first launch. process_driver Loading a process driver: the artifact a transport: process manifest names under
inference.driver, which knows how to drive one harness CLI. records_dir The session’s records directory: every record the runtime writes about a session, outside the
workdir the capsule’s commands can write, and kept after the session ends. registration What a session tells mur-roost about itself at launch, and what it is handed back. resource_plane The resource plane: the read-only file surface a capsule declares under exports.files. resources Host-process resource bounds for every native subprocess this runtime spawns. retention Retention: what bounds the three stores that grow, and what it costs to bound them. roster Roster admission: a parsed roster.yaml checked against the stores and the project’s
murmur.lock, and either bound to exact artifacts with its reachability expanded into edges, or
refused whole. running The machine-wide map of capsules that are currently reachable: one record per session that
opened an A2A door, at ~/.murmur/running/<session_id>.json. runtime runtime_dir The session’s runtime directory: every file the runtime writes for its own use, outside the
workdir the capsule’s commands can write. sealed The sealed containment mechanism: a private mount namespace pivoted onto a composed root. security Process-level hardening against the /proc/<pid>/environ side channel. spawn_credential The two secrets a delegated spawn travels on, and the headers they travel in. spawn_envelope The capability ceiling a spawned capsule must fit inside, and the comparison that refuses one
that does not. staged_runtime capabilities.shell.staged_runtime: staging a pinned host runtime tree into a capsule root.state_store Durable, capsule-scoped state stores: ~/.murmur/state/<store>/, granted per artifact by
capabilities.state and mounted into a guest as a second WASI preopen named
STATE_PREOPEN_NAME tool_names The tool name of an artifact inside one staged session. types workdir_fs Every runtime write, append, create, removal and decision-read inside a capsule’s workdir,
performed relative to a held directory descriptor with no symbolic link followed. workdir_writes What the runtime itself writes inside the capsule’s workdir, declared rather than discovered. report_eprint eprint! for report output, through report_to_stderrreport_eprintln eprintln! for report output, through report_to_stderrreport_print print! for report output, through report_to_stdoutreport_println println! for report output, through report_to_stdout().runtime_err runtime_out!eprintln!. See to_stderrruntime_out Write a formatted line to standard output, falling back to logs/bootstrap.log. BackstopMatch The pattern that makes the credential backstop drop a name, verbatim, and where it came from. HostProbe The host facts the tier decision is made from, taken together as one reading. IoMaxReport The declared I/O ceiling and what became of it, carried into --explain-scope, into
session_start.effective_grants and into W-SEC-021. LifecycleConfig LifecycleOverride Lifecycle override: allows a parent (mur-roost) or CLI flag to constrain
the lifecycle down from what the manifest declares. PlanTraceAppender A third O_APPEND handle to the session’s trace.jsonl, held by a plan run. ResourceTraceAppender A second, independent O_APPEND handle to the session’s trace.jsonl, used by the resource
plane, by the peer plane’s listener, and by the peer-handoff tools in the agent loop. ToolchainHelperReport Everything warn_on_unreachable_toolchain_helpersunprobed. ToolchainHelperWarning One compiler driver whose helper subprocess has no Execute-carrying grant under sealed. UnprobedToolchainDriver One compiler driver whose -print-prog-name= probe could not be run, so W-SEC-012 was not
evaluated for the helpers named in unchecked_helpers. A2aError The A2A errors, A2A v1.0 §5.4, in code order. AfterTask BackstopPatternSource Which list a credential backstop pattern came from. IoMaxStatus Whether the declared capabilities.resources.cgroup_io_bytes_per_sec ceiling is actually on
this session’s cgroup scope. MurmurError The errors a door answers a completion with: murmur’s own protocol riding on SendMessage
with x-murmur-task-origin: completion, so none of them is an A2A error. SwapControl Whether this kernel gives a cgroup a memory.swap.max to write, as mur doctor reports it. TaskAcceptance A2A_EXTENSIONS_HEADER The HTTP header a client activates A2A extensions in, and the header a response lists the
extensions it activated in. Matched case-insensitively. A2A_PROTOCOL_VERSION The one A2A protocol version the door speaks, and the value every murmur client sends in
A2A_VERSION_HEADER A2A_VERSION_HEADER The HTTP header an A2A request names its protocol version in. Matched case-insensitively. SCOPE_SWAP_MAX memory.swap.max for every scope: no swap at all.SERVED_WIT_PACKAGES Every murmur:* WIT package declared under crates/capsule-runtime/wit/, paired with the one
version of it this host links and resolves, sorted by package name. STREAM_EXTENSION_URI URI of the agent-card extension that lists the murmur frames the capsule’s stream can write,
and the A2A-Extensions value a client sends to receive them. It is the address of that
extension’s section in the reference docs, on the streaming protocol page beside the frames it
names. Every murmur frame on the wire sits under metadata keyed by this URI. WIT_LEVELS_FILE The repository path of the committed WIT level table, for messages that name it. active_swap_areas How many swap areas /proc/swaps lists as active, or None where it cannot be read. cgroup_delegation_available Whether this host can hand the runtime a delegated cgroup v2 scope — the precondition
[prepare_scope] fails closed on. check_interpreted_entrypoints_reachable Refuses a sealed capsule whose capabilities.shell.allow names a script that nothing
declared could make importable inside the composed root. credential_backstop_drops Whether the credential backstop would drop a variable of this name — the same question
[strip_credential_shaped_vars] answers per entry, asked of a name alone. See
credential_backstop_match credential_backstop_match The first credential backstop pattern that matches name, or None when the backstop keeps
it — the one decision procedure behind [strip_credential_shaped_vars],
credential_backstop_dropsW-SEC-024 and the E-CAP-016 staging refusal. detect_landlock_abi The kernel’s Landlock ABI version, or None when there is no Landlock (off Linux always), from
a reading taken here. find_on_path The first executable named binary on this process’s PATH, or None when there is none. io_max_device_available Whether the filesystem behind path has a block device an io.max ceiling can name. landlock_doctor_lines The lines mur doctor prints under its Landlock heading for a kernel reporting
kernel_abi: what the kernel offers, what the runtime builds at, and what a capsule loses on
this host below [LANDLOCK_TARGET_ABI]. murmur_state_name Murmur’s word for the A2A v1.0 task state wire, or None for TASK_STATE_UNSPECIFIED and
anything that is not a v1.0 state name. preopen_reports The filesystem surface each of the given artifacts will be preopened into, resolved but not
opened, one entry per artifact that has a guest. probe_io_max Answers “would the declared io.max ceiling apply on this host?” by performing the write,
against a throwaway cgroup created and removed inside this call. probe_swap_control Probe whether this kernel exposes memory.swap.max, without creating or moving anything. requires_process_bounding Does this policy give the capsule any way to run a native subprocess at all? served_wit_level The WIT level this host serves: the newest level in WIT_LEVELS_FILE skip_without_host_support Whether a test that launches a subprocess-capable capsule must stand down on this host,
printing the blocker when it must. warn_on_unreachable_toolchain_helpers Warns (W-SEC-012, non-fatal, once per uncovered helper) when a sealed capsule allowlists a
known compiler driver whose helper binaries have no grant carrying the Landlock Execute
right. Returns what it warned about so the decision is assertable without capturing stderr. wit_levels Every committed WIT level, oldest first, parsed once from WIT_LEVELS_FILE