macroonz-harness 0.2.0

Safe-Rust property, fuzz, fault, schedule, mutation, network, and benchmark testing with typed evidence, reduction, and replay.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

//! The entry a replay-bearing admission stores, and the caller-owned boundary it stores across.

use crate::descriptor::{ProposalId, ReplayRef};
use crate::report::ReplayCapsule;

#[path = "type_guard.rs"]
mod guard;

/// One replay capsule entry, assembled by an admission act.
///
/// The reference is derived from the capsule's own content at the private mint, so the three members can only agree.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct ReplayCapsuleEntry {
    proposal: ProposalId,
    replay: ReplayRef,
    capsule: ReplayCapsule,
}

/// The caller's storage location for one admitted entry.
///
/// The replay reference rides with the location, so an admission can refuse a response about some other entry instead of trusting a neighboring value.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct StoredReplayEntryRef {
    replay: ReplayRef,
    token: String,
}

/// Why the caller's replay depot did not store an admitted entry.
///
/// Durability is the sink's own statement: the harness reaches no filesystem and cannot establish where anything was persisted.
#[must_use = "a refusal is the reason a replay entry was not stored"]
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum ReplayDepotRefusal {
    /// The depot is not accepting an admission.
    Unavailable,
    /// The depot already carries this content-derived replay entry.
    AlreadyStored(ReplayRef),
    /// The offered storage token is empty and names nowhere.
    EmptyLocation,
    /// The caller states that the destination is not review-durable.
    DestinationNotDurable,
}

/// The caller-owned storage effect an explicit human admission invokes.
///
/// The sink receives an entry that is already assembled and already immutable: it stores or refuses, and returning success is its own statement that storage occurred.
pub trait ReplayDepotSink {
    /// Store the exact admitted entry and return its caller-owned location.
    ///
    /// # Errors
    ///
    /// The sink's own [`ReplayDepotRefusal`].
    fn store(
        &mut self,
        entry: &ReplayCapsuleEntry,
    ) -> Result<StoredReplayEntryRef, ReplayDepotRefusal>;
}