ic_backup/lib.rs
1//! Host-side snapshot backup and same-release recovery for Internet Computer canisters.
2//!
3//! [`model`] owns bounded records, exact identities, IC wire formats and valid state
4//! transitions. [`policy`] validates evidence and projects progress without IO.
5//! [`ops`] owns guarded persistence, artifact staging and original-journal transitions.
6//! [`workflow`] coordinates snapshot capture, transfer, upload, restore and recovery
7//! through integration-supplied async [`ports`] and mandatory admission callbacks.
8//! [`view`] exposes read-only projections across those boundaries.
9//!
10//! Complete operation plans retain inventory, dependency graphs and original attempt
11//! limits. Progress derives from the complete original journals and qualified receipts.
12//! Lost replies preserve pending spending; they never authorize blind retries, reset
13//! allowances or replacement plans. Same-release restore targets existing canister IDs.
14//! Artifact verification retains exact source bindings and requires stable byte custody.
15//!
16//! Applications own fresh membership, control/read permissions, consistency, fencing,
17//! restore safety and external-effect settlement. Admission uses the existing passive
18//! evidence models and pure validators; no default application authority is installed.
19//! Records, matching hashes and decoded replies alone do not authorize effects or
20//! establish authenticated outcomes. Terminal replay is effect-free, and failures
21//! retain unfinished journals, artifacts, source references and fence obligations.
22//!
23//! The separate `ic-backup-agent` crate implements configured single-update transport.
24//! Reusable operator composition uses the original workflow coordinator, bounded
25//! advancement and typed inspection. Applications supply exact learned bindings,
26//! effect-specific ports and qualified terminal/release evidence.
27//! Host supplies generic filesystem, process and hash capabilities; Platform supplies
28//! external IC identities, codecs and SDK boundaries. Product contracts remain local,
29//! with filesystem access and credentials on the operator host.
30
31pub mod model;
32pub mod ops;
33pub mod policy;
34pub mod ports;
35pub mod view;
36pub mod workflow;
37
38#[cfg(test)]
39mod test_support;