Struct WorkloadHost 

pub struct WorkloadHost { /* private fields */ }

Governs and records one adapter.

Implementations

impl WorkloadHost

pub fn new( runtime: Arc<dyn WorkloadRuntime>, gate: Arc<dyn GateBackend>, agent_id: impl Into<String>, node_tier: NodeTrustTier, ) -> Self

Host for runtime on a node of node_tier.

pub fn with_chain(self, cm: Arc<ChainManager>) -> Self

Attach the chain.

pub fn node_tier(&self) -> NodeTrustTier

The trust tier this host’s node is governed at right now.

pub fn set_node_tier(&self, tier: NodeTrustTier)

Change the governed tier (an operator demotion or promotion). Takes effect on the next gated call, including on instances already placed.

pub fn runtime(&self) -> &Arc<dyn WorkloadRuntime>

The adapter.

pub async fn load( &self, w: &VerifiedWorkload, cfg: &WorkloadConfig, ) -> Result<InstanceHandle, RuntimeError>

Gate, admit and load. Store pins are also gated as workload.install.

pub async fn adopt( &self, h: &InstanceHandle, w: &VerifiedWorkload, ) -> Result<(), RuntimeError>

Re-attach an instance loaded before a controller restart (WorkloadRuntime::adopt), gated as workload.load and chained with phase readopted. A no-op if the instance is already known.

pub async fn start(&self, h: &InstanceHandle) -> Result<(), RuntimeError>

Gate and start.

pub async fn console( &self, h: &InstanceHandle, command: &str, ) -> Result<RunEvidence, RuntimeError>

Gate and run one console cycle, chained as workload.start with phase console.

Instances the adapter says must stop first (sensor feed contention, including ones WeftOS did not load) are each gated as workload.stop; if any is denied nothing is stopped. Each stop is chained as it happens (so a failed console run still leaves the record), and afterwards each stopped instance is restarted, gated as workload.start and chained with phase resume-after-console.

pub async fn stop( &self, h: &InstanceHandle, grace: Duration, ) -> Result<RunEvidence, RuntimeError>

Gate and stop.

pub async fn unload(&self, h: InstanceHandle) -> Result<(), RuntimeError>

Gate and unload.

pub async fn workload_for(&self, h: &InstanceHandle) -> Option<VerifiedWorkload>

The workload a loaded instance came from, if this host loaded or adopted it.

pub async fn revoke_teardown( &self, h: &InstanceHandle, grace: Duration, why: Value, ) -> Result<(), RuntimeError>

Stop and unload an instance because its package, signer or artifact was revoked. Not gated: the applied revocation is the authority (why names it in both records), so enforcement cannot depend on an operator having written a stop or unload permit. The unload is attempted even when the stop fails (the instance may already have exited). Each step is chained like the gated one, with forced_by_revocation set.

pub async fn status(&self, h: &InstanceHandle) -> InstanceStatus

Status (not gated: read-only).

impl WorkloadHost

pub async fn upgrade_seed_firmware( &self, seed: &SeedApiRuntime, backup: &SeedBackup, target_version: &str, ) -> Result<UpgradeOutcome, RuntimeError>

Governed, backed-up Seed firmware upgrade to the operator-pinned target_version: gated as workload.install of seed-firmware@<target_version> (so the decision names the version), applied only if that is the version the Seed has pending, outcome chained.

pub async fn recover_seed_writes( &self, seed: &SeedApiRuntime, backup: &SeedBackup, ) -> Result<(), RuntimeError>

Governed writes_gated recovery (truncate-confirm after a backup).