runner_manager_domain/lib.rs
1// owner: b1-domain-core
2//
3// The module list is created by a1 so that neither b1 nor b2 has to edit it.
4// `store` belongs to b2; every other module belongs to b1.
5
6//! The deterministic core every other crate is measured against.
7//!
8//! Everything here is decidable without a network, a filesystem, or a clock.
9//! That is not an aesthetic preference — it is the property that makes the rest
10//! of the product testable, and each module states how it keeps it:
11//!
12//! * [`model`] — value types, and the [`model::Clock`] port that is the only
13//! source of "now" in the crate.
14//! * [`policy`] — routing-label derivation and `runs-on` matching (D4), the
15//! monitor-only/autoscale split (D19), and the policy lifecycle.
16//! * [`attempt`] — the runner-attempt lifecycle, its outcome, ownership, and
17//! restart-recovery decisions.
18//! * [`capacity`] — the two-level ceiling (D7, D9), as an allocator over all
19//! policies rather than a check a caller may forget.
20//! * [`path`] — the pure stored shape of an operator-configured local path. It
21//! decides syntax only; whether the directory exists, is local, or is writable
22//! is `b1`'s operational preflight in `crates/platform`.
23//! * [`workspace`] — where an attempt's files live and whether they survive it:
24//! a repository's [`workspace::WorkspacePolicy`] and one attempt's immutable
25//! [`workspace::AttemptWorkspace`] allocation.
26//! * [`store`] — SQLite persistence. Owned by `b2`, and the only module here
27//! that touches I/O.
28//!
29//! **There is no job reservation anywhere in this crate, and none may be added.**
30//! `AcquireJobs` has no REST equivalent, so demand is advisory and a second host
31//! may take a job this one has already started a runner for
32//! (`01-current-architecture.md`, edge case 6). The surplus runner that results
33//! is an accepted, bounded cost, not a defect to engineer around: the bounding
34//! controls are the host-scoped routing label
35//! ([`policy::RoutingLabels::derive`]) and the two capacity ceilings
36//! ([`capacity::HostAllocator`]). A lease, claim, or local reservation table
37//! added here would not remove the surplus case — it would only hide it from the
38//! tests that measure it.
39
40pub mod attempt;
41pub mod capacity;
42pub mod model;
43pub mod path;
44pub mod policy;
45pub mod store;
46pub mod workspace;