Module workload_ctl 

Placement control plane (ADR-099 sections 3 and 7; card mesh-placement-12): the pure engine (card 04) wired to the mesh.

• facts: card 03’s cached, verified NodeFacts as card 04’s PlacementFacts (liveness from membership or direct contact, receiver-assigned trust tier, load from live state, measured perf.*).
• cog_kind: the cog kind’s requirements (ADR-100 section 2).
• msg: the signed workload.ctl message set (nonce, expiry, decision id; unknown methods denied).
• session: the message set on the wire as MeshIpcEnvelope / MeshRequest, with the artifact piece protocol (card 11) multiplexed for fetch-before-load.
• host_service: a node’s workload-host (advertised through ServiceAdvertisement), driving card 09’s adapters under governance.
• plane / plane_place: the controller: learn targets, decide, chain, dispatch, retry the next candidate on refusal.
• transport: mesh TCP (Noise XX) and in-process connections; the in-process path serves this node’s own host and Seed adapters on an operator-assigned node id.

Re-exports

pub use crate::refusal_budget;

pub use cog_kind::cog_workload_spec;

pub use facts::LiveNodeFacts;

pub use facts::engine_tier;

pub use facts::governance_tier;

pub use facts::liveness_of;

pub use facts::placement_view;

pub use host_node_admin::NodeAdmin;

pub use host_revoke::ForcedTeardown;

pub use host_supervise::Supervised;

pub use lifecycle::InstanceLife;

pub use lifecycle::LifecyclePolicy;

pub use lifecycle::LifecycleState;

pub use lifecycle::RestartDecision;

pub use lifecycle::RestartPolicy;

pub use lifecycle::can_transition;

pub use host_service::CtlConfig;

pub use host_service::FactsSource;

pub use host_service::HOST_CHAIN_SOURCE;

pub use host_service::WorkloadHostService;

pub use msg::CtlRequest;

pub use msg::CtlResponse;

pub use msg::NonceGuard;

pub use msg::Refusal;

pub use msg::RefusalCode;

pub use msg::SignedCtl;

pub use msg::WORKLOAD_HOST_SERVICE;

pub use plane::CallFailure;

pub use plane::PLANE_CHAIN_SOURCE;

pub use plane::PlacementControlPlane;

pub use plane::PlacementRecord;

pub use plane::PlaneConfig;

pub use plane::PlaneError;

pub use plane::TargetInfo;

pub use plane_peers::OperatorPeer;

pub use plane_place::Attempt;

pub use plane_place::PlaceOrder;

pub use plane_place::PlaceReport;

pub use plane_place::render;

pub use plane_seed::SEED_ROUTE;

pub use plane_seed::StorePinOrder;

pub use refusal_budget::RefusalBudget;

pub use transport::CtlConnector;

pub use transport::MAX_SESSIONS;

pub use transport::MEM_SCHEME;

pub use transport::MeshConnector;

pub use transport::listen_tcp;

pub use transport::serve_listener;

pub use transport::serve_listener_with;

Modules

cog_kind

The cog kind’s requirements (ADR-100 section 2): how a verified cog package becomes a placement WorkloadSpec.

facts

Card 03’s verified, TTL-cached node facts as card 04’s PlacementFacts (ADR-099 sections 2-3).

host_licence

The ADR-106 run gate in a workload-host (phase 3).

host_node_admin

Node-admin methods on the workload.ctl wire (dashboard.status, dashboard.token.rotate): the same signed envelope, controller-key check, expiry and nonce replay guard as every other method, answered by a hook the daemon installs instead of by a workload adapter.

host_revoke

Forced unload on revocation: a node stops and unloads every instance it hosts whose package, signer key or artifact hash was revoked (ADR-099 section 7, card mesh-placement-revoke).

host_service

The target side: a node’s workload-host service (ADR-099 section 7).

host_supervise

Node-local supervision of hosted instances (ADR-099 section 7): a periodic health heartbeat whose meaning each kind defines, and bounded restarts with backoff, every step chained.

lifecycle

The instance state machine and the bounded-restart policy (ADR-099 section 7). Pure: no I/O, no clock of its own (callers pass now_ms), so every rule is table-testable.

msg

The workload.ctl message set (ADR-099 section 7).

plane

The controller side of placement (ADR-099 sections 3 and 7).

plane_lifecycle

Controller-side lifecycle (ADR-099 section 7): mirror each instance’s state from its node, notice a Dead node, mark its instances Lost and reschedule them through the same gate and placement engine as any placement, and settle with a node that comes back.

plane_node_admin

Controller side of the node-admin methods (dashboard.status, dashboard.token.rotate): one signed call to a known peer, with the request and its outcome chained on this node.

plane_peers

Operator-assigned trust for workload-host targets (ADR-099 section 3).

plane_place

Placement and instance control on the controller (ADR-099 sections 3, 4 and 7).

plane_seed

Seed nodes (ADR-100 section 5, option b): a Cognitum Seed does not run WeftOS, so there is no workload-host to message. The control plane addresses card 09’s remote.api Seed adapter, held on this node, by the operator-assigned node id. Only operator-pinned store cogs go there (our signed packages go to native / container nodes).

session

workload.ctl on the wire: MeshIpcEnvelopes carrying a KernelMessage addressed to ServiceMethod { workload-host, <method> }, correlated with MeshRequest, plus the artifact piece protocol multiplexed on the same stream for fetch-before-load.

transport

How the control plane reaches a workload-host, and how a node serves one: mesh TCP (optionally Noise XX, as the kernel mesh listener does) and in-process (same wire, in-memory streams) for local and Seed-adapter nodes and for hermetic tests.