Crate chio_supervisor 

Task supervision and honest health for Chio serving processes.

A long-lived background worker that dies or wedges while its health surface keeps reporting green is the failure mode this crate exists to prevent. Each supervised worker retains its join handle, restarts with capped backoff on a caught panic or a restart-worthy exit, and, after a bounded number of failures, trips a persistent HealthFlag that the surfaces operators poll must report.

Two properties are load-bearing:

• Honesty. A tripped flag never clears itself on a later lucky success. A worker that recovered but lost work in the gap must still report the gap; the only path back to HealthLevel::Healthy is an explicit, operator-visible HealthFlag::clear.
• Fail closed. A HealthFlag marked TCB-critical reports HealthFlag::is_serving_closed the moment it leaves Healthy, so a caller can deny work before it executes rather than after.

This is a zero-Chio-dependency leaf crate by design: the kernel receipt writer, the control-plane sync loop, and the SIEM exporter can each supervise their work without taking a dependency on one another or dragging the trusted computing base into the isolated telemetry pipeline.

Structs

HealthFlag

A cloneable handle to one surface’s health. Level and counter reads are lock-free; the reason string lives behind a Mutex whose only invariant is the single Option it holds, so recovering a poisoned lock with into_inner is sound (there is no cross-field state to leave half-mutated).

HealthSnapshot

A serializable point-in-time view of a HealthFlag, for operator surfaces and the telemetry exporter. All fields are additive; consumers deserialize with #[serde(default)].

SupervisedThread

A supervised OS thread that owns its join handle and a HealthFlag. The worker closure is the loop body; it receives the shutdown flag so it can exit promptly and return SupervisedOutcome::Shutdown.

SupervisorConfig

Restart and trip policy for one supervised worker.

Enums

HealthLevel

Severity of a supervised surface. Ordered by increasing severity; the flag only ever raises the level and never lowers it except through HealthFlag::clear.

SupervisedOutcome

Result of one worker-body invocation, reported back to the supervisor loop.

Functions

now_unix_ms

Milliseconds since the Unix epoch, saturating on a clock set before 1970 or after the year the count overflows a u64. Never panics, so it is safe on the pre-dispatch hot path and inside a catch_unwind boundary.