cellos_supervisor/
lib.rs

1//! Library surface for [`cellos-supervisor`] internals that need to be
2//! reachable from integration tests.
3//!
4//! The crate is primarily a binary (`src/main.rs`) — the bulk of the
5//! supervisor lives in modules private to that binary. This `lib.rs` exposes
6//! only the pieces that integration tests under `tests/` need to consume,
7//! starting with [`resolver_refresh`] (SEC-21 host-controlled DNS resolver
8//! refresh + drift event emission).
9//!
10//! Adding new public modules here is allowed; do not blanket re-export
11//! supervisor internals — keep the surface narrow so the binary remains the
12//! source of truth for composition.
13
14pub mod destruction_evidence;
15pub mod dns_proxy;
16pub mod ebpf_flow;
17pub mod event_signing;
18pub mod linux_cgroup;
19pub mod nft_counters;
20pub mod per_flow;
21pub mod resolver_refresh;
22pub mod sni_proxy;
23pub mod spec_input;
24pub mod trust_keyset_load;
25
26// F1a — Path B host-side probes (`HostProbe` / `ProbeContext` / `emit_reading`)
27// and F3b — host-side telemetry receiver (vsock listener + host-stamping +
28// agent-silenced detection) both live in the sibling crate
29// `cellos-host-telemetry` per ADR-0006 §5.4. Re-exported here as
30// `host_telemetry` so supervisor-internal call sites (and integration tests)
31// reach a single stable name; F4b's per-cell wiring will land on this alias.
32pub use cellos_host_telemetry as host_telemetry;
33// E7 will add `#[cfg(target_os = "linux")] pub mod per_flow;` here when nflog
34// listener lands (separate slot, anticipated by windows-build hygiene).
35
36/// D7 (security) — minimal test-visible surface for the per-event signing
37/// config so an integration test can pin its zeroize posture. The real
38/// definition lives in `src/event_signing.rs` (`SigningConfig`, private to
39/// the module); this module re-publishes a struct-shape mirror that
40/// integration tests can reference without widening the binary's public
41/// surface.
42///
43/// **Not for production callers.** The supervisor uses its own (private)
44/// `event_signing::SigningConfig` directly. This mirror exists only so
45/// `tests/signing_config_zeroize.rs` can compile-time-assert that the
46/// `key_bytes` field is `Zeroizing<Vec<u8>>` and the struct derives
47/// `ZeroizeOnDrop`.
48///
49/// **Honest scope.** This mirror's *posture* (zeroize-on-drop + `key_bytes`
50/// wrapped in `Zeroizing<Vec<u8>>`) matches the canonical struct in
51/// `event_signing.rs`. The fields here are a STRUCTURAL APPROXIMATION,
52/// not a name-for-name copy: the canonical struct carries an
53/// `algorithm: Algorithm` field whose enum type is private to
54/// `event_signing.rs` and therefore unreachable from this lib surface;
55/// and this mirror additionally carries a pre-built
56/// `signing_key: ed25519_dalek::SigningKey` for test ergonomics, which
57/// the canonical struct does not. The load-bearing compile-time check
58/// is that BOTH this mirror and the canonical struct derive
59/// `ZeroizeOnDrop` and wrap key material in `Zeroizing`. The drift
60/// reminder lives in `tests/event_signing_posture_drift.rs`.
61#[doc(hidden)]
62pub mod event_signing_posture {
63    /// Structural-approximation mirror of `event_signing::SigningConfig`
64    /// for the purpose of pinning the zeroize posture in an integration
65    /// test. The posture invariants (`ZeroizeOnDrop` + `Zeroizing<Vec<u8>>`
66    /// on `key_bytes`) match canonical; field set is approximate (see
67    /// module-level doc comment).
68    #[derive(zeroize::ZeroizeOnDrop)]
69    pub struct SigningConfig {
70        #[zeroize(skip)]
71        pub kid: String,
72        pub key_bytes: zeroize::Zeroizing<Vec<u8>>,
73        pub signing_key: ed25519_dalek::SigningKey,
74    }
75}
76
77// A2-02 / ADR-0007 — doc-hidden mirror of `composition::resolve_caller_identity`
78// (private to the binary). Mirrors the FC-32 `__fcXX` shim pattern so an
79// integration test can pin the `CELLOS_CALLER_IDENTITY` -> trim -> `"default"`
80// fallback contract. Not for production callers.
81#[doc(hidden)]
82pub mod __a2_02 {
83    pub fn resolve_caller_identity() -> String {
84        std::env::var("CELLOS_CALLER_IDENTITY")
85            .ok()
86            .map(|v| v.trim().to_string())
87            .filter(|v| !v.is_empty())
88            .unwrap_or_else(|| "default".to_string())
89    }
90}
cellos_supervisor/lib.rs

cellos_supervisor/
lib.rs
