ic_backup/ports/ic_mutation/
mod.rs

1//! Async single reserved IC update contract; no default transport or dispatch implementation.
2
3use crate::model::attempt_journal::AttemptJournalRecord;
4use crate::model::ic_mutation::{IcMutationAcknowledgement, IcMutationRequest};
5use std::future::Future;
6use thiserror::Error;
7
8/// Integration-owned authenticated single-update submission for an original reservation.
9///
10/// Before invocation retain the exact original plan and IC bytes, persist the
11/// mutation reservation, qualify full prerequisite evidence and current exact
12/// network/caller/target/controller authority. Capture requires original consistency/
13/// fence/quiescence admission. Load additionally requires exact snapshot-origin
14/// permissions; target control/read visibility cannot substitute. Load/start require
15/// same-release source/upload identity,
16/// complete transfer and application-owned outside-snapshot restoration/restart safety.
17/// Retain obligations/source references and qualify exclusive dispatch/command and
18/// byte custody. The structural request itself proves none of these conditions.
19///
20/// Invoke only if qualified custody proves this reservation was never dispatched.
21/// Pending journal state after interruption is insufficient: reconcile the exact
22/// uncertain effect rather than invoke again. Send the exact management receiver,
23/// effective routing target, method and argument bytes as one host replicated update.
24/// No proxy/query substitution, hidden retries, observations, funding or extra calls
25/// occur within this invocation. Additional calls need their own prior approved
26/// durable accounting and independently qualified admission.
27///
28/// Return exact retained raw reply bytes and actual context/target association;
29/// integrations authenticate and qualify opaque evidence independently. A capture
30/// ID or canonical empty acknowledgement never produces an Applied/NotApplied
31/// receipt automatically. Failures/drop/death retain the consumed pending mutation,
32/// fences, source references and recovery evidence. No failure proves nonapplication
33/// or refunds allowance. Terminal replay invokes no provider. No default exists.
34pub trait IcMutationProvider {
35    /// Submit one exact originally reserved update without retry or follow-up observation.
36    ///
37    /// Recheck `request` against the exact currently guarded `journal` before signing
38    /// or dispatch. The caller retains journal exclusion across the returned future.
39    /// No runtime or `Send` requirement is imposed by this core port. Dropping a
40    /// pending future retains consumption and grants no reentry or repeat submission.
41    /// # Errors
42    /// Every failure preserves pending original evidence; reconcile indeterminate replies.
43    fn submit_mutation(
44        &mut self,
45        request: &IcMutationRequest<'_>,
46        journal: &AttemptJournalRecord,
47    ) -> impl Future<Output = Result<IcMutationAcknowledgement, IcMutationProviderError>>;
48}
49
50/// Redacted single-call failure; no variant grants retry, nonapplication or a refund.
51#[derive(Clone, Copy, Debug, Eq, Error, PartialEq)]
52pub enum IcMutationProviderError {
53    /// No qualified provider; no dispatch.
54    #[error("IC mutation provider unavailable")]
55    Unavailable,
56    /// Provider cannot qualify this exact bounded host update contract.
57    #[error("IC mutation contract unsupported")]
58    Unsupported,
59    /// Submission/reply/authentication outcome is indeterminate; retain pending evidence.
60    #[error("IC mutation update indeterminate")]
61    Indeterminate,
62}
ic_backup/ports/ic_mutation/mod.rs

ic_backup/ports/ic_mutation/
mod.rs
