Struct SeedApiRuntime 

pub struct SeedApiRuntime { /* private fields */ }

The Seed runtime adapter.

Implementations

impl SeedApiRuntime

pub fn new( cfg: SeedConfig, transport: Arc<dyn SeedTransport>, creds: Arc<dyn SeedCredentials>, ) -> Result<Self, RuntimeError>

New adapter. Refuses a malformed node id or pin.

impl SeedApiRuntime

pub fn node_id(&self) -> &str

This adapter’s operator-assigned node id.

pub async fn identity(&self) -> Result<(String, String), RuntimeError>

The Seed’s own (device_id, public_key) from GET /api/v1/identity.

impl SeedApiRuntime

pub async fn installed(&self) -> Result<Vec<InstalledCog>, RuntimeError>

Installed cogs (GET /api/v1/apps).

pub async fn stop_cog(&self, id: &str) -> Result<(), RuntimeError>

Stop a cog by id (POST /api/v1/apps/{id}/stop).

pub async fn start_cog(&self, id: &str) -> Result<(), RuntimeError>

Start a cog by id (POST /api/v1/apps/{id}/start).

impl SeedApiRuntime

pub async fn pair( &self, client_name: &str, bootstrap: &SecretString, ) -> Result<(), RuntimeError>

Pair with the Seed: open the pairing window (authorized by bootstrap, which may be empty over the trusted USB link), request a client token, and store it in the operator secret store.

pub async fn writes_gated(&self) -> Result<bool, RuntimeError>

Current writes_gated flag from /api/v1/status.

pub async fn backup(&self, dir: &Path) -> Result<SeedBackup, RuntimeError>

Snapshot status, identity, installed apps, each app’s config and the witness chain into a new private directory dir.

pub async fn check_backup( &self, backup: &SeedBackup, same_firmware: bool, ) -> Result<String, RuntimeError>

Verify backup and check it was taken from this Seed: same operator node id, and the Seed’s current identity has the same device id and public key. With same_firmware, the firmware must also be unchanged (the backup reflects the state about to be upgraded). Returns the current firmware version.

pub async fn upgrade_firmware( &self, backup: &SeedBackup, target_version: &str, ) -> Result<UpgradeOutcome, RuntimeError>

Apply the pending firmware upgrade, but only if it is the version the operator pinned (target_version). Refuses without a verified backup of this Seed at its current firmware, while writes are gated, or when the Seed does not report which version is pending.

pub async fn recover_writes_gated( &self, backup: &SeedBackup, ) -> Result<(), RuntimeError>

Recover the witness-chain writes_gated state. Only runs when the Seed reports writes gated and backup still verifies.

Trait Implementations

impl WorkloadRuntime for SeedApiRuntime

fn network_exposure(&self) -> NetworkPolicy

The Seed firmware, not WeftOS, decides what its cogs can reach; the Seed has internet access, so the gate is told egress.

fn console_preemptions<'life0, 'life1, 'async_trait>( &'life0 self, h: &'life1 InstanceHandle, ) -> Pin<Box<dyn Future<Output = Result<Vec<Preemption>, RuntimeError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Every running cog, including ones WeftOS did not load (UDP 5006 contention: any listener on the Seed competes for the feed).

fn id(&self) -> &str

Adapter id (native, container.docker, remote.api.cognitum-seed).

fn provides(&self) -> Vec<Capability>

Capabilities a node advertises when this adapter works.

fn admit<'life0, 'life1, 'async_trait>( &'life0 self, w: &'life1 VerifiedWorkload, ) -> Pin<Box<dyn Future<Output = Result<Admission, RuntimeError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Self-check: can this node run w? Reserves nothing it cannot undo.

fn load<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, w: &'life1 VerifiedWorkload, cfg: &'life2 WorkloadConfig, ) -> Pin<Box<dyn Future<Output = Result<InstanceHandle, RuntimeError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Stage the payload and config; returns a handle for the instance.

fn adopt<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, h: &'life1 InstanceHandle, w: &'life2 VerifiedWorkload, ) -> Pin<Box<dyn Future<Output = Result<(), RuntimeError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Re-attach an instance this adapter loaded before the controller restarted (its in-memory table is gone but the device still holds it). The adapter verifies the instance is still there and still the pinned version, so stop / unload work again; it starts and changes nothing on the device.

fn start<'life0, 'life1, 'async_trait>( &'life0 self, h: &'life1 InstanceHandle, ) -> Pin<Box<dyn Future<Output = Result<(), RuntimeError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Start the instance.

fn stop<'life0, 'life1, 'async_trait>( &'life0 self, h: &'life1 InstanceHandle, _grace: Duration, ) -> Pin<Box<dyn Future<Output = Result<RunEvidence, RuntimeError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Stop it (terminate, then kill after grace) and return evidence.

fn unload<'life0, 'async_trait>( &'life0 self, h: InstanceHandle, ) -> Pin<Box<dyn Future<Output = Result<(), RuntimeError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Remove staged payload and state.

fn status<'life0, 'life1, 'async_trait>( &'life0 self, h: &'life1 InstanceHandle, ) -> Pin<Box<dyn Future<Output = InstanceStatus> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Current status.

fn control_mode(&self) -> ControlMode

Managed or adopted.

fn link_security(&self) -> LinkSecurity

How the link to a remote device is authenticated. Fails closed: only a remote adapter with a pinned transport says Pinned.

fn preempt<'life0, 'life1, 'async_trait>( &'life0 self, p: &'life1 Preemption, ) -> Pin<Box<dyn Future<Output = Result<(), RuntimeError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Stop one preempted instance.

fn resume<'life0, 'life1, 'async_trait>( &'life0 self, p: &'life1 Preemption, ) -> Pin<Box<dyn Future<Output = Result<(), RuntimeError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Restart one preempted instance after the console run.

fn console<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, h: &'life1 InstanceHandle, command: &'life2 str, ) -> Pin<Box<dyn Future<Output = Result<RunEvidence, RuntimeError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Run one console cycle ([console] limits apply). command must be one of the cog’s [console].allowed_commands.

fn staged_payload<'life0, 'life1, 'async_trait>( &'life0 self, _h: &'life1 InstanceHandle, ) -> Pin<Box<dyn Future<Output = Option<PathBuf>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

The file an instance’s binary was staged to, when the adapter runs it from disk (the licence run gate rehashes it at each start). None: not run from a file this node can read (a container image is tagged by the binary’s BLAKE3; a remote device holds its own copy).