Struct WorkloadHostService 

pub struct WorkloadHostService { /* private fields */ }

A node’s workload-host.

Implementations

impl WorkloadHostService

pub fn set_licence_gate(&self, gate: Arc<dyn CognitumRunGate>) -> bool

Use gate for Cognitum-origin cogs (first call wins).

pub fn licence_gate(&self) -> Option<&Arc<dyn CognitumRunGate>>

The licence run gate in use, if one was set.

impl WorkloadHostService

pub fn set_node_admin(&self, hook: Arc<dyn NodeAdmin>) -> bool

Install the node-admin hook (first call wins).

impl WorkloadHostService

pub async fn enforce_revocations( &self, list: &RevocationList, ) -> Vec<ForcedTeardown>

Stop and unload every hosted instance that list now revokes. Idempotent: instances already gone are not touched. Instances that cannot be torn down stay held and are reported with unloaded: false, so the next call retries them.

The instance map is locked only to pick the targets and to forget the ones that went; the teardowns (each up to the stop grace) run outside it, so a revocation sweep never holds up status, stop or place on this node.

impl WorkloadHostService

pub fn new( key: SigningKey, exchange: Arc<ArtifactExchange>, anchors: TrustAnchors, gate: Arc<dyn GateBackend>, ) -> Self

Host for the node owning key. Serves nobody until controllers are added, and loads nothing until a route adapter is added.

pub fn with_kinds(self, kinds: KindRegistry) -> Self

Accept these workload kinds for a package fetched from a peer. The default is KindRegistry::builtin; a node that places a registered non-cog kind across nodes must pass the same registry as its control plane, or the fetch refuses the kind.

pub fn set_revocations(&self, list: Arc<RevocationList>) -> bool

The revocation list this node enforces (first call wins). With it a place that races a revocation is caught and torn down, and Self::enforce_revocations callers share one source of truth.

pub fn revocations(&self) -> Option<&Arc<RevocationList>>

The list set by Self::set_revocations, if any.

pub fn with_ingest(self, hooks: IngestHooks) -> Self

Wire the ingest bridge: placed cogs get a per-instance token, bound to the placing project and revoked at stop and unload.

pub fn ingest(&self) -> Option<&IngestHooks>

The ingest wiring, if any.

pub fn with_refusal_budget(self, b: RefusalBudget) -> Self

Replace the bound on chained refusals of unverified requests.

pub fn with_route(self, route: &str, host: Arc<WorkloadHost>) -> Self

Adapter (under governance) for one route kind (native, …).

pub fn with_controllers(self, c: impl ControllerPolicy + 'static) -> Self

Who may send requests.

pub fn with_chain(self, cm: Arc<ChainManager>) -> Self

Chain for placement and refusal records.

pub fn with_address(self, addr: impl Into<String>) -> Self

Mesh address advertised for this service.

pub fn set_facts(&self, facts: SignedNodeFacts)

Replace the signed facts describe returns.

pub fn with_facts_source(self, source: FactsSource) -> Self

Read the signed facts from source on every describe (falling back to Self::set_facts when it has none).

pub fn node_id(&self) -> &str

This node’s id.

pub fn advertisement(&self) -> ServiceAdvertisement

The workload-host advertisement (ADR-099 section 7).

pub async fn handle( &self, header_method: &str, signed: &SignedCtl, fetch: Option<&mut PeerSet>, ) -> SignedCtl

Handle one signed request (fetch is the connection back to the controller, used to fetch the payload before loading).

pub async fn handle_checked( &self, header_method: &str, signed: &SignedCtl, fetch: Option<&mut PeerSet>, ) -> (SignedCtl, bool)

Self::handle, also saying whether the request was authenticated (a session drops a peer after an unauthenticated request).

impl WorkloadHostService

pub fn with_kind_registry(self, kinds: KindRegistry) -> Self

Use these kinds’ health definitions (default: the built-in kinds).

pub fn with_lease(self, lease: Duration) -> Self

Opt in to the node-side lease: continuous instances stop once no controller other than this node itself has been heard from for lease, and only for instances another node placed. It must be longer than the controller’s tick (a lease shorter than a few ticks would stop work for ordinary jitter) and, to stop the old copy before a replacement starts, at most the controller’s dead_after. Set it at or below the controller’s dead_after, so the copy on a partitioned node stops before the controller starts a replacement. Off by default.

pub fn with_restart_policy(self, p: RestartPolicy) -> Self

Replace the restart bounds.

pub async fn lifecycle_of(&self, instance_id: &str) -> Option<LifecycleState>

Lifecycle state of a hosted instance.

pub async fn supervise(&self, now_ms: u64) -> Vec<Supervised>

Run the health heartbeat and the bounded restarts once, at now_ms. Returns what changed. Instances are polled outside the instance map’s lock, so a slow adapter never holds up status or place.

pub fn spawn_supervisor(self: &Arc<Self>, period: Duration) -> JoinHandle<()>

Run Self::supervise every period for as long as the runtime lives.