Module overlay_runtime 

A project kernel’s live governance: boot, reload, parent updates. A project kernel’s live governance: boot, reload and parent updates (ADR-103 A6, D8, Phase 2 package E).

• prepare runs early in boot, before any subsystem is built: it reads the project certificate, the signed parent policy and the overlay, checks them and merges. Any failure is a boot refusal (fail closed, decision 2); a project never starts with fewer rules than its parent.
• Prepared::apply_limits enforces the merged max_processes (the process table’s cap) and spawn_budget (the concurrent sub-agent spawn cap, kernel.agent.subagents.max_per_conv) by lowering the kernel config before it is used. Both are boot-time caps: a pushed policy that lowers them reports restart_required instead of pretending to apply live.
• OverlayRuntime owns the running state. OverlayRuntime::reload is the only thing that re-reads the files; an overlay edited on disk does nothing until it is called. OverlayRuntime::apply_parent_update accepts a pushed policy, which must carry a valid user signature and a version no older than the newest accepted. Every accepted change appends governance.overlay.applied and publishes the new effective hash to the chain’s rule_hash provider; every refused one appends governance.overlay.rejected and leaves the running rules alone.

The chain stamps rule_hash through a lock-free RuleHashCell; the gate swap and the cell write happen under the gate’s write lock, so a decision is never chained with the other generation’s hash. Lock order: the gate lock is taken before the chain lock (a check appends under it); nothing takes the gate lock while holding the chain lock.

Re-exports

pub use crate::overlay_trust::USER_PIN_FILE;

pub use crate::overlay_trust::VERSION_PIN_FILE;

pub use crate::overlay_trust::write_user_pin;

Modules

test_support

Process-wide child-root override for other crates’ integration tests, which boot a project-profile kernel before package H’s supervisor exists. Only compiled with the test-support feature, which a release build refuses (see the compile_error! in lib.rs).

Structs

Applied

The hashes and version of the rules a kernel is running.

OverlayGate

A gate whose inner GovernanceGate is replaced atomically on update.

OverlayRuntime

The running project governance.

Prepared

Everything boot learned about a project’s governance, before the chain exists.

Constants

DEFAULT_RISK_THRESHOLD

Fallback engine threshold when neither parent nor overlay set one.

REVOKED_FILE

Marker the user daemon drops in the run dir when it revokes the project; its presence stops boot, reload and update. Defined once in clawft_types::runtime_paths (revoked_marker), shared with the writer and the supervisor. Terminal revocation marker in a child’s run dir. Only the user daemon’s project.revoke writes it and nothing clears it; while it exists the supervisor never starts the project and the child refuses to boot, reload or take policy.

Functions

child_paths

The child’s paths: paths itself when it is a child root. A project profile on any other root is refused (package H makes RuntimePaths::resolve() return the child root for a spawned child).

install_nested_policy

prepare

Read, verify and merge the certificate, parent policy and overlay of the child at paths. Fails closed.

prepare_nested

The existing overlay runtime handles nested users too: signature verification, version history, limits, gate swap and every event’s rule hash are unchanged.