ic_backup/lib.rs
1//! Host-side snapshot backup and same-release recovery for Internet Computer canisters.
2//!
3//! The library provides artifact checksums, no-follow traversal and staging,
4//! verified durable directory publication, bounded JSON persistence and journal
5//! locking, layout lifetime exclusion, durable restore dependencies and
6//! inherited command custody. Local download journals retain exact snapshot
7//! identity and verified publication progress. Local attempt journals bind exact
8//! declared identity and finite mutation/observation allowances, retaining durable
9//! reservations and qualified receipts. These mechanisms do not authorize canister
10//! effects.
11//! Bounded physical inventories retain canonical declared parent forests; pure
12//! selection policy expands exact principals without live discovery or authority.
13//! Explicit effect graphs retain validated operation dependencies and project
14//! deterministic planning order/readiness without authorizing dispatch.
15//! Immutable operation plans bind these declarations to exact target/request digests
16//! and original attempt allowances, deriving journal authority under the full plan digest.
17//! Pure execution progress joins exact retained journals to the original plan and
18//! projects causal Applied evidence, pending attempts and exhaustion without dispatch.
19//! The IC request boundary encodes closed host-ingress management operations and
20//! binds exact method/routing/Candid bytes to original mutation or observation digests.
21//! Codec qualification does not establish IC effects or fresh execution authority.
22//! A separate membership port binds ephemeral provider results to original intent,
23//! exact current context/full inventory and an integration-owned challenge.
24//! Pure matching views grant neither controller authority nor application continuity.
25//! The separate control port checks direct caller-controller evidence for exact
26//! IC mutation payloads; its matching views still grant no dispatch or restore safety.
27//!
28//! Applications own membership, release identity, control routing, quiescence
29//! and external-effect settlement. Capture/restore runners and an IC transport
30//! have not been extracted yet. Filesystem access and credentials remain on the
31//! operator host.
32
33mod hash;
34pub mod model;
35pub mod ops;
36pub mod policy;
37pub mod ports;
38
39#[cfg(test)]
40mod test_support;