ic_backup/policy/execution_settlement/
mod.rs

1//! Exact complete Applied local journal admission; no terminal or release authority.
2
3use crate::{
4    model::{
5        attempt_journal::AttemptJournalRecord, execution_settlement::ExecutionSettlementRecord,
6        operation_plan::OperationPlanRecord,
7    },
8    policy::execution_progress::{
9        self, ExecutionProgressError, ExecutionProgressRequest, ExecutionProgressView,
10        OperationProgressState,
11    },
12};
13use thiserror::Error;
14
15/// Admit the original complete causal journal set and match every retained history.
16///
17/// The canonical progress owner checks exact coverage/context/operation/limits and
18/// retained prerequisite evidence; no missing input means unused allowance. Every
19/// operation must be Applied, even when remaining allowances are nonzero. Exact
20/// full history includes negative/uncertain receipts and consumed attempts, not
21/// just the final progress shape. This performs no IO/serialization/transitions or
22/// remote observations. Receipt authentication, dispatch chronology, artifacts,
23/// actual application safety and command quiescence remain separately qualified.
24/// # Errors
25/// Rejects changed plan, incomplete/invalid/unsettled journals or different exact histories.
26pub fn validate(
27    plan: &OperationPlanRecord,
28    journals: &[&AttemptJournalRecord],
29    settlement: &ExecutionSettlementRecord,
30) -> Result<ExecutionProgressView, ExecutionSettlementPolicyError> {
31    if &plan.digest() != settlement.plan_intent() {
32        return Err(ExecutionSettlementPolicyError::IntentMismatch);
33    }
34    let (view, actual) =
35        execution_progress::progress_with_journals(&ExecutionProgressRequest { plan, journals })?;
36    if let Some(operation) = view
37        .operations
38        .iter()
39        .find(|operation| operation.state != OperationProgressState::Applied)
40    {
41        return Err(ExecutionSettlementPolicyError::UnsettledOperation(
42            operation.operation_sequence,
43        ));
44    }
45    if settlement.journals().len() != plan.operations().len() {
46        return Err(ExecutionSettlementPolicyError::JournalSetMismatch);
47    }
48    for (row, operation) in settlement.journals().iter().zip(plan.operations()) {
49        if row.operation_sequence() != operation.operation_sequence() {
50            return Err(ExecutionSettlementPolicyError::JournalSetMismatch);
51        }
52        let journal = actual
53            .get(&row.operation_sequence())
54            .ok_or(ExecutionSettlementPolicyError::JournalSetMismatch)?;
55        if &journal.digest() != row.history() {
56            return Err(ExecutionSettlementPolicyError::HistoryMismatch(
57                row.operation_sequence(),
58            ));
59        }
60    }
61    Ok(view)
62}
63/// Typed local settlement denial; no error dispatches, refunds or releases evidence.
64#[derive(Debug, Eq, Error, PartialEq)]
65pub enum ExecutionSettlementPolicyError {
66    /// Checkpoint names another full original plan.
67    #[error("execution settlement original plan mismatch")]
68    IntentMismatch,
69    /// Original complete evidence/causality failed canonical admission.
70    #[error(transparent)]
71    Progress(#[from] ExecutionProgressError),
72    /// Operation has no retained Applied outcome.
73    #[error("execution settlement operation {0} is not applied")]
74    UnsettledOperation(u64),
75    /// Checkpoint rows do not cover exactly the original operation set.
76    #[error("execution settlement journal set mismatch")]
77    JournalSetMismatch,
78    /// Same final progress hides changed exact reservations/receipt evidence.
79    #[error("execution settlement journal {0} history mismatch")]
80    HistoryMismatch(u64),
81}
82#[cfg(test)]
83mod tests;
ic_backup/policy/execution_settlement/mod.rs

ic_backup/policy/execution_settlement/
mod.rs
