Skip to main content

clawft_kernel/workload_governance/
mod.rs

1//! Governance for placed workloads (ADR-099 sections 4 and 7).
2//!
3//! - [`effect`]: the workload effect fields and their 5D mapping.
4//! - [`policy`]: governed `workload.*` actions, the default-deny rule set
5//!   (distributed per ADR-092) and explicit permit rules.
6//! - [`gate`]: [`WorkloadGate`], which enforces the policy, checks subject
7//!   revocations and chains every decision (ADR-022).
8//!
9//! Revocation of package ids, signer keys and artifact hashes lives in
10//! [`crate::revocation`].
11
12pub mod effect;
13pub mod gate;
14pub mod policy;
15
16#[cfg(test)]
17mod tests;
18
19pub use effect::{NetworkPolicy, NodeTrustTier, PackageTrust, WorkloadEffect, WorkloadRefs, WorkloadRequest};
20pub use gate::{
21    WorkloadGate, chain_revocations, event_kind_for, revoke_and_record, unrevoke_and_record,
22};
23pub use policy::{
24    CATALOG_PRINCIPAL, DEFAULT_DENY_RULE_ID, EFFECT_CEILING_RULE_ID, GOVERNED_ACTIONS, SUPERVISOR_PRINCIPAL,
25    WorkloadPermitRule, default_rules, project_supervisor_permit, install_default_rules, is_governed_action,
26};