Expand description
Forced unload on revocation: a node stops and unloads every instance it hosts whose package, signer key or artifact hash was revoked (ADR-099 section 7, card mesh-placement-revoke).
Revoking a subject drops its grants and evicts its bytes, but a cog that
is already running keeps running from what it loaded. This closes that:
when a revocation is applied (the operator’s verb, a signed mesh notice,
or the daemon’s start-up and 60 s sweeps, which catch one applied while the
node was down or whose teardown failed) the host walks
its instances and tears down each one that now names a revoked subject.
The teardown is not gated: the applied revocation is the authority, so
enforcement does not depend on the operator having written a stop permit.
Every step is chained (workload.stop, workload.unload, with
forced_by_revocation naming the subject).
Structs§
- Forced
Teardown - One instance a revocation took down (or failed to).