Module host_licence 

The ADR-106 run gate in a workload-host (phase 3).

A package is Cognitum-origin when its signed manifest says so (GrantOrigin::Cognitum) or when any of its binaries is bytes the gate knows as Cognitum bytes (listed by a held grant, or a revoked artifact hash): a re-pack under another id does not escape the gate.

For such a package the host asks the node’s CognitumRunGate:

• at place / load, for the binary the runtime’s own admission picks (native: the host arch; container: its arch order), hashes computed from its bytes. Only that binary is staged; the package’s other arches need no grant, but a revoked one refuses the package. The placement is refused when the admitted arch is not the chosen variant’s;
• at every start, for the binary that runs, rehashed from the file it was staged to when the adapter runs it from disk (native), else from the loaded bytes (a container image is tagged by the binary’s BLAKE3).

In a Seed-bound mesh that needs a valid checkout grant and an operator hash approval. A refusal is a governance refusal whose reason carries the stable code (licence run gate: [no_approval] ...), chained as workload.refuse and shown by weaver workload place --explain. A permit is chained as cog.run.permit with the grant and approval ids. Other signed packages never reach the gate.

Structs

LicensedRun

What a placed Cognitum cog is, for the check at each start.

Constants

EVENT_KIND_RUN_PERMIT

Chain kind of a permitted Cognitum run.