Module executor 

The leaf ↔ runtime container-build boundary.

zlayer-toolchain is a leaf crate (it may not depend on zlayer-agent or zlayer-builder), yet toolchain source builds must run inside an isolated container provided by the runtime layer (Seatbelt on macOS, HCS on Windows). This module is the seam between the two:

• The leaf defines the executor contract: ContainerBuildExecutor, its input (ContainerBuildRequest) and output (ContainerBuildReport), plus a process-global registration slot.
• The runtime registers its implementation once at startup via set_container_executor (idempotent — a later call replaces the current executor, which is how tests swap in mocks).
• Build paths in this crate resolve the executor with container_executor. When none is registered they must fail with crate::error::ToolchainError::ExecutorUnavailable — a containerized build step NEVER falls back to a host subprocess.

The trait’s execute method is a manually desugared async fn (Pin<Box<dyn Future ...>>): the workspace does not use async_trait and this crate does not add it.

Structs

ContainerBuildReport

What the runtime hands back after executing a ContainerBuildRequest.

ContainerBuildRequest

Everything the runtime needs to execute an InstallPlan in an isolated container.

Enums

NetPolicy

Network policy for a containerized toolchain build.

Traits

ContainerBuildExecutor

Implemented by the runtime layer (Seatbelt on macOS, HCS on Windows).

Functions

container_executor

The currently registered container build executor, if any.

set_container_executor

Register the process-global container build executor.