Struct ProcessGroupGuard 

pub struct ProcessGroupGuard { /* private fields */ }

An owned fail-closed capability for one reserved process group.

Dropping an armed value closes both owner sockets. The out-of-group guard then sends SIGKILL to the group and both helper children are reaped within the caller’s process. Call Self::activate only after the workload has successfully joined the reserved group, and Self::disarm only after the group no longer requires broker-death containment.

This capability contains process-group membership, not arbitrary descendants. A workload which creates a session or changes group has left the portable boundary. The caller must also disarm immediately after reaping the final owned member: Unix provides no persistent handle which prevents an empty process-group ID from being reused.

Implementations

impl ProcessGroupGuard

pub fn new() -> Result<Self>

Reserve a process group and establish an out-of-group owner-loss guard.

Call this from a dedicated single-threaded process broker. The returned value exclusively owns two direct helper children until activate retires the startup anchor.

Errors

Returns an operating-system error if descriptor preparation, either helper fork, or group creation fails. Every successfully created helper is closed, terminated when still live, and reaped before an error is returned.

pub const fn process_group(&self) -> ProcessGroupId

Return the reserved group which a prepared workload must join.

pub const fn guard_process(&self) -> ProcessId

Return the persistent helper process for exact wait-event routing.

This identifier is for classifying events in a broker-owned all-child wait loop. Helper cleanup and event collection must be serialized. A terminal helper event means containment failed; do not treat it as a normal workload exit.

pub fn activate(&mut self, timeout: Duration) -> Result<()>

Retire and reap the startup anchor after a workload joins the group.

Errors

Returns InvalidInput for a zero timeout or repeated activation, or a write, wait, unexpected-status, or deadline error. Failure is fail-closed: the persistent guard remains armed and dropping this value kills the group.

pub fn disarm(self, timeout: Duration) -> Result<()>

Disarm and reap both helpers without signaling the workload group.

Errors

Returns InvalidInput for a zero timeout, or a write, wait, unexpected-status, or deadline error. Consuming failure remains fail-closed and performs bounded helper cleanup before returning.

Trait Implementations

impl Debug for ProcessGroupGuard

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for ProcessGroupGuard

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.