Module gate 

WorkloadGate: the governance gate for workload.* actions.

Evaluation order (every step’s outcome is chained, ADR-022):

1. The action must be one of GOVERNED_ACTIONS; an unknown workload.* action is refused and chained as workload.refuse.
2. The workload context object must parse and validate.
3. The subject revocation list must be readable, a request that installs, places, loads, starts or migrates must name a package, signer key or artifact hash, and none of those may be revoked. Teardown (stop, unload, re-adoption) is never blocked by a revocation.
4. Workloads carrying secrets need a pinned node (ADR-099 s8.3).
5. A WorkloadPermitRule must match; otherwise the default deny holds. This is enforced in code as well as by the WORKLOAD-DEFAULT-DENY rule, so a rule set that lost that rule still fails closed.
6. The governance engine evaluates the derived 5D effect vector with every rule except the default-deny category (effect ceiling and any other distributed rules still apply).

Structs

WorkloadGate

Governance gate for workload actions.

Constants

CHAIN_SOURCE

Chain source used for workload governance events.

DEFAULT_THRESHOLD

Default effect-magnitude threshold for workload actions.

Functions

chain_revocations

Chain every revocation and un-revocation list takes from now on, from any caller (the operator verb, a mesh notice, kernel code), as workload.revoke / workload.unrevoke events from source CHAIN_SOURCE. First call wins; returns whether this one did.

event_kind_for

Chain event kind for a governed action (None for unknown actions).

revoke_and_record

Revoke a subject and chain a workload.revoke event when newly added.

unrevoke_and_record

Lift a revocation and chain a workload.unrevoke event when one was removed. Same chain rules as revoke_and_record.