chio_supervisor/lib.rs
1//! Task supervision and honest health for Chio serving processes.
2//!
3//! A long-lived background worker that dies or wedges while its health surface keeps
4//! reporting green is the failure mode this crate exists to prevent. Each supervised
5//! worker retains its join handle, restarts with capped backoff on a caught panic or
6//! a restart-worthy exit, and, after a bounded number of failures, trips a persistent
7//! [`HealthFlag`] that the surfaces operators poll must report.
8//!
9//! Two properties are load-bearing:
10//!
11//! - Honesty. A tripped flag never clears itself on a later lucky success. A worker
12//! that recovered but lost work in the gap must still report the gap; the only path
13//! back to [`HealthLevel::Healthy`] is an explicit, operator-visible
14//! [`HealthFlag::clear`].
15//! - Fail closed. A [`HealthFlag`] marked TCB-critical reports
16//! [`HealthFlag::is_serving_closed`] the moment it leaves `Healthy`, so a caller can
17//! deny work before it executes rather than after.
18//!
19//! This is a zero-Chio-dependency leaf crate by design: the kernel receipt writer,
20//! the control-plane sync loop, and the SIEM exporter can each supervise their work
21//! without taking a dependency on one another or dragging the trusted computing base
22//! into the isolated telemetry pipeline.
23
24mod config;
25mod health;
26mod sync;
27mod thread;
28mod time;
29
30#[cfg(feature = "async")]
31mod task;
32
33pub use config::{SupervisedOutcome, SupervisorConfig};
34pub use health::{HealthFlag, HealthLevel, HealthSnapshot};
35pub use thread::SupervisedThread;
36pub use time::now_unix_ms;
37
38#[cfg(feature = "async")]
39pub use task::{supervise_task, SupervisedTask};