Crate holger_fleet 

holger-fleet — the estate side of the ONE monetize’s pull channel, for Holger

Monetize never calls into an estate (G1-pull, G16: no estate runs a monetize of its own). Every Holger box calls the ONE monetize instead. Since P4a (2026-10-25) the pump itself is SHARED — monetize-estate-side’s monetize_estate_side::pump, which Gunnar’s boxes take in T16 — and this crate holds only what is Holger’s:

call	where
the box’s own Ed25519 key, <data>/fleet/box.ed25519	key::BoxKey (shared)
Fleet.Report / Fleet.Orders / Fleet.Ask, verify, ack	puller::Puller (shared)
the wire, the jera round	grpc, duty (shared)
Holger’s order kinds and their refusals	order
the executor over holger’s own verbs	exec::execute over exec::HolgerBox
a Holger box as the shared pump runs it	pumped::Pumped
joining the ONE monetize (POST /attach/enrol)	enrol

Every signed form is monetize-embed’s own (monetize_embed::fleet), never a copy.

Re-exports

pub use exec::execute;

pub use exec::Applied;

pub use exec::GrowSet;

pub use exec::GrowState;

pub use exec::HolgerBox;

pub use exec::OrderedBy;

pub use exec::RechargeAsk;

pub use order::accept;

pub use order::Order;

pub use order::Verdict;

pub use pumped::Pumped;

Modules

config

The shared pump’s modules, under the names Holger’s callers already use. Where this box reports, and as whom (moved from Holger’s holger-fleet, P4a). The installer’s feed (the same keys every product’s boxes read: fleet, fleet_instance, fleet_at, fleet_ca, monetize_pubkey, plain or offered by a VM as offer.<vm>.<key>), else what an enrolment kept at CONFIG_REL.

duty

The shared pump’s modules, under the names Holger’s callers already use. The pull channel as a jera job (house rule: server background work is a jera ChainQueue job, never a raw thread). One job = one round: report, long-poll the orders (≤ 25 s), verify and run each, and report again at once when anything ran so the acks reach monetize. A small ticker submits the round under ONE idempotency key, so a round is never queued twice; the job’s ledger row says what it did.

enrol

Joining the ONE monetize (f-attach-enrol): the estate’s owner hands the operator’s one-shot token to POST /attach/enrol; the answer carries the product’s monetize key (what every order verifies under). Its client certificate is NOT kept: the pull channel presents none, as Gunnar’s does not — every call is signed by the box’s own key, and the door is verified under the public roots or the fed CA (crate::grpc::channel). The wire is Skidbladnir’s plugin-door-wire::attach; the request is signed by the owner’s key on the caller’s side (EnrolRequest::sign).

exec

The order executor: one verified order → one of holger’s own verbs → one ack.

grpc

The shared pump’s modules, under the names Holger’s callers already use. The Link over the wire: monetize-proto’s own Fleet client. Blocking calls over a runtime handle — the puller runs on a jera job’s blocking thread.

key

The shared pump’s modules, under the names Holger’s callers already use. This box’s own Ed25519 key — what the ONE monetize knows the box by. Minted once under the data root, owner-only, and pinned by monetize on the box’s first call inside its pin window (TOFU).

order

The orders a Holger box pulls, decoded and checked.

puller

The shared pump’s modules, under the names Holger’s callers already use. The puller: report, pull, verify, run, ack — the box’s whole side of monetize.v1.Fleet, over any Link (the gRPC client in super::grpc, an in-process guardian in the tests), running each order through the product’s PumpBox.

pumped

Holger’s box on the shared pump (P4a): the pump is monetize-estate-side’s (monetize_estate_side::pump); what is Holger’s is its executor (crate::exec) over its own order kinds (crate::order). Pumped is the one seam between the two.

sign_in

The sign-in-again link (P4c, A28 M11): the shared crate’s. A resend sign-in link, minted and mailed by the estate itself (Gunnar’s S10, owner 2026-10-11; Holger’s A16; SHARED since P4c, A28 M11): a sold estate’s buyer lost or let run out the one link the ready mail carried. monetize queues a signed sign_in_again order for the estate’s main naming whose passkey, which address and which console host — never a secret. The main verifies it, mints a fresh passkey invite on that account (only while it holds no passkey) and mails the link itself. Pure (std only, no I/O): the product mints and mails; this is the order’s checks, the lifetime and the words. Gunnar’s gunnar-repair sign_in is the same code until T16 (H20).

Structs

Addressee

Who this box is on the wire: the shared pump’s own (P4a). Who this box is on the wire.

Asked

What an ask is answered: the case it opened (a remedy), monetize’s words, and a page to open (empty for every ask a box makes today).

BoxKey

Fault

Why a call failed: monetize’s word (unauthenticated, unavailable, …) and its sentence.

FleetConfig

Pull

What one pull did.

Pulled

What is kept across restarts.

Puller

Signed

One signed call as it goes on the wire.

Constants

PRODUCT

This product’s name on the wire.

Traits

Link

The three calls, over whatever carries them.

Functions

hex

32 bytes → 64 hex.

key32

64 hex (or 44 base64) → 32 bytes.

now_unix_ms

Unix ms now (0 before the epoch).