Struct CheckoutGrantStore 

pub struct CheckoutGrantStore { /* private fields */ }

Persisted binding and grant state of one node.

Implementations

impl CheckoutGrantStore

pub fn floor_preview(&self) -> Result<FloorPreview, LicenceError>

Preview Self::reset_floor without changing anything. Needs a binding in effect, like the reset.

pub fn reset_floor_checked( &self, expected_floor: Option<u64>, ) -> Result<FloorPreview, LicenceError>

Reset the floor and return the preview it was applied on, in one critical section. With expected_floor, refuses (floor_changed) when the floor is no longer the value the operator was shown.

impl CheckoutGrantStore

pub fn open( dir: &Path, anchors: Arc<TrustAnchors>, local: LocalMeshId, clock: Clock, ) -> Result<Self, LicenceError>

Open the store in dir. A missing file is an empty store; a file that cannot be read, parsed or re-verified is an error (nothing is written).

pub fn open_or_poisoned( dir: &Path, anchors: Arc<TrustAnchors>, local: LocalMeshId, clock: Clock, ) -> Self

Self::open, but a bad file gives a poisoned store (it serves nothing, refuses writes and leaves the file alone) so the daemon can still install its policy, which then behaves like ManifestPolicy.

pub fn set_sink(&self, sink: Arc<dyn LicenceEventSink>)

Report LicenceEvents to sink.

pub fn attach_revocations(&self, list: Arc<RevocationList>)

Use list for SignerKey and ArtifactHash revocations.

pub fn local_mesh_id(&self) -> &LocalMeshId

The live local mesh id handle.

pub fn poisoned(&self) -> Option<String>

Why the store is poisoned, if it is.

pub fn is_hash_revoked(&self, blake3_hex: &str) -> bool

True when blake3_hex is revoked as an ArtifactHash.

pub fn active_binding(&self) -> Option<BindingRecord>

The binding in effect, if any.

pub fn binding_status(&self) -> Result<BindingRecord, LicenceError>

The binding in effect, or the reason there is none.

pub fn held_binding(&self) -> Option<BindingRecord>

The stored binding whatever its state (bound, unbound or orphaned), for the steward’s seq rule and for status. Not for gating anything.

pub fn verify_member( &self, signed: &SignedBinding, ) -> Result<BindingRecord, LicenceError>

The MEMBER profile against this store’s anchors and local mesh id, without storing anything (the steward verifies before it spends any replay state).

pub fn valid_grant_covering( &self, blake3_hex: &str, cog_id: &str, version: &str, ) -> Option<CheckoutGrant>

A valid grant that lists BLAKE3 blake3_hex for cog_id version.

pub fn valid_grant_for_artifact( &self, cog_id: &str, version: &str, sha256: &str, blake3: &str, ) -> Option<(CheckoutGrant, GrantArtifact)>

A valid grant for cog_id version that lists a binary whose (sha256, blake3) pair is exactly sha256 and blake3.

pub fn verified_grants(&self) -> Vec<VerifiedCheckoutGrant>

Every currently valid grant, ready for grant_checkout.

pub fn floor(&self) -> Option<u64>

The floor for the bound key, in unix seconds.

pub fn reset_floor(&self) -> Result<(), LicenceError>

Admin hook (weaver cog checkout reset-floor): forget the clock high-water mark and restart it from the current clock. This is the only way to undo a forward clock jump. The caller gates it (Admin).

pub fn tick(&self)

Record the clock and persist the high-water mark (the daemon calls this on its tick). The only place the read side writes to disk.

impl CheckoutGrantStore

pub fn accept_binding( &self, signed: &SignedBinding, posture: AdmissionPosture, extra: &dyn BindingExtraCheck, ) -> Result<Outcome, LicenceError>

Accept a binding. posture is the node’s admission state; extra is the steward profile hook (use super::NoExtraChecks for members).

pub fn accept_grant( &self, signed: &SignedGrant, ) -> Result<Outcome, LicenceError>

Accept a grant under the bound key (see ADR-106 section 4).

impl CheckoutGrantStore

pub fn grant_rows(&self) -> Vec<GrantRow>

Every held grant, valid or not, by (cog, version). Validity is judged as the policy judges it; without a binding in effect none is valid.

pub fn effective_now(&self) -> Option<u64>

max(now, floor) for the bound key, the time grants are judged by.

impl CheckoutGrantStore

pub fn was_ever_bound(&self) -> bool

True once this node has accepted a binding (the marker exists, or a binding is held now, which also writes the marker).

pub fn claims_artifact(&self, sha256: &str, blake3: &str) -> bool

True when a held grant (current or previous) lists a binary with this sha256 or this BLAKE3: the bytes are a checked-out Cognitum cog, whatever package they arrive in.

impl CheckoutGrantStore

pub fn held_signed_binding(&self) -> Option<(u64, SignedBinding)>

The stored binding for the local mesh, whatever its state, with its seq. An unbound record is still returned: its seq is what stops an older bind from being replayed.

pub fn bound_grant_key(&self) -> Option<String>

The grant key of the binding in effect, lower-case hex.

pub fn held_grant( &self, cog_id: &str, version: &str, ) -> Option<(u64, SignedGrant)>

The current grant held for cog_id version, with its seq.

pub fn sync_grants_page( &self, after: Option<(u64, &str, &str)>, max_entries: usize, max_bytes: usize, ) -> (Vec<(u64, String, String, SignedGrant)>, bool)

A page of the highest-seq grant per (cog, version), as (seq, cog, version, grant) ordered by that tuple and strictly after after, within max_entries and max_bytes; and whether more follow. Empty unless a binding is in effect. Expired and withdrawn grants are included: they are seq tombstones. Only the keys of the whole set are sorted; only the page’s envelopes are cloned.

Trait Implementations

impl Debug for CheckoutGrantStore

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.