running_process/broker/mod.rs
1//! v1 broker module — schemas are FROZEN FOREVER once v1.0 ships.
2//!
3//! Phase 0 of #228: this module exposes the prost-generated wire types
4//! (envelope, manifest, service definition) for every later phase to
5//! depend on. No consumers ship yet — Phases 1+ wire them in.
6//!
7//! See `proto/broker_v1_*.proto` and the parent issue for the rationale
8//! behind every field number and `reserved` range.
9
10pub mod adopt;
11pub mod backend_handle;
12pub mod backend_lib;
13pub mod backend_lifecycle;
14pub mod backend_sdk;
15pub mod builders;
16pub mod capabilities;
17pub mod client;
18pub mod doctor;
19pub mod fs_health;
20pub mod host_identity;
21pub mod lifecycle;
22pub mod manifest;
23pub mod protocol;
24pub(crate) mod secure_dir;
25pub mod server;
26
27/// Framing byte for every v1 broker connection. Wire layout:
28/// `[u8 framing_version=1][u32 LE body_length][prost body]`.
29///
30/// THIS BYTE is the truly-frozen-forever invariant — see #228
31/// "Frozen-forever commitments" section. A v2 client connecting to a
32/// v1 broker writes `[1][len][v2-shaped Hello]`; the v1 broker reads
33/// the framing byte and decides whether to decode or `Refused` with
34/// `ERROR_VERSION_UNSUPPORTED`.
35pub const FRAMING_VERSION_V1: u8 = 1;
36
37/// Hard ceiling on any single broker frame. Broker disconnects on
38/// overflow. See #228 "Wire-level commitments".
39pub const MAX_FRAME_SIZE_BYTES: usize = 16 * 1024 * 1024;
40
41/// Hard ceiling on the Hello envelope specifically. Broker returns
42/// `Refused` on overflow. See #228 "Wire-level commitments".
43pub const MAX_HELLO_SIZE_BYTES: usize = 64 * 1024;
44
45/// Upper bound on a LifecycleEvent's prost-encoded size, set to the
46/// minimum POSIX `PIPE_BUF` so atomic-append into the event log is
47/// guaranteed on every platform. Linux raises this to 4096 in practice,
48/// but the cross-platform floor is 512.
49pub const LIFECYCLE_EVENT_PIPE_BUF_FLOOR: usize = 512;