Module parent_policy 

The signed parent policy the user daemon exports (ADR-103 D8). The signed parent policy (ADR-103 A6, D8, Phase 2 package E).

The user daemon exports its governance rules and limits as a ParentPolicy, signs it with the user key and writes it to <run>/<id>/parent-policy.json. A project kernel reads it at boot (and on governance.reload / governance.parent.update), checks the signature against the user_pubkey of its certificate and merges its overlay onto it (crate::governance_overlay::merge).

Signed bytes: PARENT_POLICY_DOMAIN + canonical JSON of every field but sig (rules sorted by id, the risk threshold as the hex of its bits). The tag is distinct from the certificate, anchor and proof-of-possession tags of package A, so a signature made for one can never verify as another.

version only moves forward: a kernel pins the highest version it has accepted and refuses an older signed policy (ParentPolicyError::Rollback), so putting an old, looser, validly signed file back does nothing.

Structs

ParentPolicy

<run>/<id>/parent-policy.json.

Enums

ParentPolicyError

Why a parent policy was refused. Every variant names its key.

Constants

PARENT_POLICY_DOMAIN

Domain tag prepended to the signed bytes of a ParentPolicy.

PARENT_RULES_DOMAIN

Domain tag of parent_rules_hash.

PARENT_SCHEMA

Parent policy format version.

VERSION_SLACK_SECS

How far past the clock a previous version may be and still be believed.

Functions

export

User side: snapshot engine, tighten with limits, sign.

export_rules

export from an already-taken snapshot (rules, engine threshold and human-approval flag).

export_rules_to

export_to from an already-taken snapshot.

export_to

User side: export and atomically write path (normally <run>/<id>/parent-policy.json). The version continues from whatever valid policy the file already holds.

load_parent_policy

Read and parse a parent policy file (size-capped; missing is an error: a project kernel with no parent policy must not start).

next_version

The next version after prev: past prev and past the clock, so a lost counter file cannot send the version backwards behind a kernel’s pin.

parent_rules_hash

Hash of a rule set and its limits (the parent_hash of an effective merge). Covers active, severity and selectors through each rule’s full serialized form.

verify_parent_policy

Check shape, hash and signature against the trusted user key.

write_atomic_0600

Atomic write, mode 0600 on unix: a private temp file in the same directory, fsynced, then renamed over path.