Struct ProtectedContext 

pub struct ProtectedContext { /* private fields */ }

Implementations

impl ProtectedContext

pub fn load(path: &Path) -> Result<Self, &'static str>

Legacy development raw context only; never inferred as versioned.

pub fn load_versioned(path: &Path) -> Result<Self, &'static str>

Canonical versioned context, held from the original open. Exact wrapper bytes are the snapshot and config digest, not reserialized inner bytes.

pub fn from_held_versioned( path: &Path, file: File, ) -> Result<Self, &'static str>

Takes ownership of the original read-only CLOEXEC config descriptor. Path is checked for identity only, never reopened for config bytes. Reads at explicit offsets, independent of the caller’s shared cursor.

pub fn is_versioned(&self) -> bool

pub fn revalidate(&self) -> Result<(), &'static str>

pub fn socket_file(&self) -> Result<&File, &'static str>

Borrow the held Linux O_PATH socket handle after revalidation. A transport may connect through /proc/self/fd/N to avoid reopening the ambient path. This alone is not peer authentication or a mutation capability.

pub fn snapshot(&self) -> Result<(&ExpectedContext, &[u8]), &'static str>

pub fn config_sha256(&self) -> Result<String, &'static str>

impl ProtectedContext

pub fn capture_image_for_plan<F>( &self, id: &str, get: F, ) -> Result<CapturedImage, &'static str>

where F: FnMut(&str) -> Result<(u16, Vec<u8>), &'static str>,

Capture exact bounded evidence only after protected info/image/info. An eventual record constructor must accept this type, never ImageFacts.

pub fn inspect_with<F>( &self, id: &str, get: F, ) -> Result<InspectOutcome, &'static str>

where F: FnMut(&str) -> Result<(u16, Vec<u8>), &'static str>,

No retry, mutation or lease authority. Even an exact Missing result is withheld until the final info observation and filesystem check succeed.

pub fn inspect_owned_with<F>( &self, owner: &ExpectedContainer, get: F, ) -> Result<State, &'static str>

where F: FnMut(&str) -> Result<(u16, Vec<u8>), &'static str>,

Selected ownership facts under the same protected observation sequence. The expected plan still requires durable installation/slot binding.

pub fn inspect_image_with<F>( &self, id: &str, get: F, ) -> Result<ImageFacts, &'static str>

where F: FnMut(&str) -> Result<(u16, Vec<u8>), &'static str>,

Image facts are returned only after matching both protected observations.