Skip to main content

BudgetRegistry

chio_kernel_core::budget_split

Trait BudgetRegistry 

Source 
pub trait BudgetRegistry {
    // Required methods
    fn register_parent(
        &mut self,
        parent_token_id: String,
        parent_share_bps: u16,
    ) -> Result<(), BudgetSplitError>;
    fn try_admit_child(
        &mut self,
        parent_token_id: &str,
        child_token_id: String,
        share_bps: u16,
    ) -> Result<(), BudgetSplitError>;
    fn verify_child_admission(
        &mut self,
        parent_token_id: &str,
        child_token_id: String,
        share_bps: u16,
    ) -> Result<(), BudgetSplitError>;
    fn release_child(
        &mut self,
        parent_token_id: &str,
        child_token_id: &str,
        expected_share_bps: u16,
    ) -> Result<(), BudgetSplitError>;
    fn evict_parent(&mut self, parent_token_id: &str);
}
Expand description

A registry of live BudgetSplits, keyed by parent capability id.

The verifier calls BudgetRegistry::try_admit_child before issuing a VerifiedCapability for any token whose delegation_chain is non-empty. register_parent is called when a new parent token enters the system, and evict_parent is called when a parent is revoked or expires.

A federated registry that gossips splits across kernels has the same trait surface; the in-memory implementation in this crate only models single-process enforcement.

Required Methods§

Source

fn register_parent( &mut self, parent_token_id: String, parent_share_bps: u16, ) -> Result<(), BudgetSplitError>

Register a parent token’s share so subsequent delegations can be admitted against it. Re-registering the same parent with the same share is idempotent. Re-registering with a different share is a hard failure: the caller probably fed two distinct tokens with the same id, which is a delegation-graph bug.

Source

fn try_admit_child( &mut self, parent_token_id: &str, child_token_id: String, share_bps: u16, ) -> Result<(), BudgetSplitError>

Try to admit a child token under the given parent.

Unknown parents fail closed. Callers that have verifier-owned parent lineage or a parent snapshot must call BudgetRegistry::register_parent before admitting children. This prevents a verifier from fabricating a missing parent share at MAX_BUDGET_SHARE_BPS.

Source

fn verify_child_admission( &mut self, parent_token_id: &str, child_token_id: String, share_bps: u16, ) -> Result<(), BudgetSplitError>

Check whether a child token would admit under the given parent WITHOUT acquiring a holder lease.

Same fail-closed checks as BudgetRegistry::try_admit_child (unknown parents fail closed), but a fresh admissible child is committed with no releasable holder and an already-present child is left untouched. This is the entry point for verifier-only surfaces that produce a verdict but never release a lease. See AdmitMode::VerifyOnly.

Source

fn release_child( &mut self, parent_token_id: &str, child_token_id: &str, expected_share_bps: u16, ) -> Result<(), BudgetSplitError>

Release a previously admitted child token under the given parent.

Unknown parents and missing children are idempotent no-ops so cleanup can safely run after revocation or after an admission attempt that failed before mutating the registry. Share mismatches fail closed.

Source

fn evict_parent(&mut self, parent_token_id: &str)

Drop the parent’s split from the registry. Idempotent; calling evict_parent on an unregistered parent is a no-op so revocation races do not abort verification.

Dyn Compatibility§

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§