Module workload_governance 

Governance actions, audit events and permits for placed workloads (ADR-099). Governance for placed workloads (ADR-099 sections 4 and 7).

• effect: the workload effect fields and their 5D mapping.
• policy: governed workload.* actions, the default-deny rule set (distributed per ADR-092) and explicit permit rules.
• gate: WorkloadGate, which enforces the policy, checks subject revocations and chains every decision (ADR-022).

Revocation of package ids, signer keys and artifact hashes lives in crate::revocation.

Re-exports

pub use effect::NetworkPolicy;

pub use effect::NodeTrustTier;

pub use effect::PackageTrust;

pub use effect::WorkloadEffect;

pub use effect::WorkloadRefs;

pub use effect::WorkloadRequest;

pub use gate::WorkloadGate;

pub use gate::chain_revocations;

pub use gate::event_kind_for;

pub use gate::revoke_and_record;

pub use gate::unrevoke_and_record;

pub use policy::CATALOG_PRINCIPAL;

pub use policy::DEFAULT_DENY_RULE_ID;

pub use policy::EFFECT_CEILING_RULE_ID;

pub use policy::GOVERNED_ACTIONS;

pub use policy::SUPERVISOR_PRINCIPAL;

pub use policy::WorkloadPermitRule;

pub use policy::default_rules;

pub use policy::project_supervisor_permit;

pub use policy::install_default_rules;

pub use policy::is_governed_action;

Modules

effect

Workload effect fields (ADR-099 section 4) and their mapping onto the governance engine’s 5D EffectVector.

gate

WorkloadGate: the governance gate for workload.* actions.

policy

Workload governance actions, the default-deny rule set and permit rules (ADR-099 section 4, ADR-092 distribution).