Module policy 

Workload governance actions, the default-deny rule set and permit rules (ADR-099 section 4, ADR-092 distribution).

Structs

WorkloadPermitRule

An explicit allowance that lifts the workload.* default deny.

Constants

ACTION_INSTALL

Install a package on a node.

ACTION_LOAD

Load an instance into a runtime.

ACTION_MIGRATE

Migrate an instance to another node.

ACTION_NODE_BIND

Bind a fleet identity to a mesh node.

ACTION_PLACE

Place an instance on a node.

ACTION_REVOKE

Revoke a package, signer key or artifact hash.

ACTION_START

Start a loaded instance.

ACTION_STOP

Stop a running instance.

ACTION_UNLOAD

Unload an instance.

CATALOG_PRINCIPAL

The principal the daemon’s catalog verbs (workload install / unload) decide as. The catalog verifies nothing, so those requests are unsigned; a permit that accepts unsigned packages has to be limited to this principal (validate refuses one that names none), so it cannot also admit an unsigned placement.

DEFAULT_DENY_CATEGORY

SOP category marking rules that a matching permit rule lifts.

DEFAULT_DENY_RULE_ID

Rule id of the workload.* default-deny rule.

EFFECT_CEILING_RULE_ID

Rule id of the effect-magnitude ceiling that still applies after a permit.

GOVERNED_ACTIONS

Every action the workload gate governs. Any other workload.* string is refused as unknown.

SUPERVISOR_PRINCIPAL

The internal principal the user-daemon project supervisor acts as. Never accepted from a request: the supervisor builds its own gate and host with this id, so an operator-facing placement path (whose gate has no such permit) cannot start a project workload.

WORKLOAD_ACTION_PREFIX

Prefix shared by every workload governance action.

Functions

default_rules

The workload rules shipped in the governance rule set.

install_default_rules

Seed the workload rules into a cluster rule store (ADR-092).

is_governed_action

Whether action is one of GOVERNED_ACTIONS.

project_supervisor_permit

The permit that lets the supervisor, and only the supervisor, run the project kind on this node. It does not reach any other kind.