pub struct Kernel { /* private fields */ }Expand description
High-level kernel interface wrapping the verified state machine.
All state transitions go through State and Step,
which have machine-checked correspondence to the Lean specification.
§Examples
use lion_core::{Kernel, SecurityLevel};
let mut kernel = Kernel::new();
kernel.register_plugin(1, SecurityLevel::Public, 4096).unwrap();
assert_eq!(kernel.plugin_count(), 1);
assert_eq!(kernel.plugin_level(1), Some(SecurityLevel::Public));Implementations§
Source§impl Kernel
impl Kernel
Sourcepub fn tick(&mut self) -> Result<(), Error>
pub fn tick(&mut self) -> Result<(), Error>
Advance the logical clock by one tick.
§Errors
Returns Error if the time counter would overflow u64::MAX.
Sourcepub fn execute(&mut self, step: &Step) -> Result<(), Error>
pub fn execute(&mut self, step: &Step) -> Result<(), Error>
Execute a step against the current state.
The step is validated and executed atomically. On success, the internal state is updated. On failure, the state is unchanged.
§Errors
Returns Error::Step if the step’s preconditions are not met or execution fails.
Sourcepub fn execute_mut(&mut self, step: &Step) -> Result<(), Error>
pub fn execute_mut(&mut self, step: &Step) -> Result<(), Error>
Execute a step by mutating state in place (production path).
Same validation as execute but avoids the full-state clone.
On failure, partial mutations may have occurred – callers should
treat failure as non-recoverable (same as the pure path which
discards the failed clone).
§Errors
Returns Error::Step if the step’s preconditions are not met or execution fails.
Sourcepub fn register_plugin(
&mut self,
id: PluginId,
level: SecurityLevel,
mem_size: Size,
) -> Result<(), Error>
pub fn register_plugin( &mut self, id: PluginId, level: SecurityLevel, mem_size: Size, ) -> Result<(), Error>
Register a new plugin with the given security level and memory size.
§Errors
Returns an error if a plugin with the same ID already exists.
Sourcepub fn plugin_level(&self, id: PluginId) -> Option<SecurityLevel>
pub fn plugin_level(&self, id: PluginId) -> Option<SecurityLevel>
Get the security level of a plugin.
Sourcepub fn get_cap(&self, cap_id: CapId) -> Option<&Capability>
pub fn get_cap(&self, cap_id: CapId) -> Option<&Capability>
Get a capability by ID.
Sourcepub fn cap_is_valid(&self, cap_id: CapId) -> bool
pub fn cap_is_valid(&self, cap_id: CapId) -> bool
Check if a capability is valid (not revoked).
Sourcepub fn plugin_holds(&self, pid: PluginId, cap_id: CapId) -> bool
pub fn plugin_holds(&self, pid: PluginId, cap_id: CapId) -> bool
Check if a plugin holds a specific capability.
Sourcepub fn delegate_cap(
&mut self,
parent_id: CapId,
target: PluginId,
requested_rights: Rights,
) -> Result<CapId, Error>
pub fn delegate_cap( &mut self, parent_id: CapId, target: PluginId, requested_rights: Rights, ) -> Result<CapId, Error>
Delegate a capability to a target plugin.
The kernel mints the child capability internally:
- Validates the parent exists and is valid
- Allocates a fresh capability ID
- Intersects requested rights with parent rights
- Computes the HMAC seal with the current key
- Inserts the child and grants it to the target plugin
§Arguments
parent_id- The parent capability to derive fromtarget- The plugin to receive the delegated capabilityrequested_rights- The rights requested (will be intersected with parent)
§Errors
Returns Error::Capability(CapabilityError::Revoked) if the parent capability is revoked.
Returns Error::Capability(CapabilityError::EmptyRights) if the rights intersection is empty.
Returns Error::Kernel(KernelError::CapNotFound) if the parent capability does not exist.
Returns Error::Kernel(KernelError::CapIdExhausted) if the capability ID space is exhausted.
Returns Error::Kernel(KernelError::CapIdCollision) if the allocated ID already exists (should not happen).
Sourcepub fn insert_cap_raw(
&mut self,
cap: Capability,
target: PluginId,
) -> Result<(), Error>
pub fn insert_cap_raw( &mut self, cap: Capability, target: PluginId, ) -> Result<(), Error>
Insert a pre-formed capability (kernel-internal / test use only).
This bypasses kernel minting. Use delegate_cap() for the safe delegation path.
§Errors
Returns Error::Kernel(KernelError::CapIdCollision) if a capability with the same ID already exists.
Sourcepub fn revoke_cap(&mut self, cap_id: CapId) -> Result<(), Error>
pub fn revoke_cap(&mut self, cap_id: CapId) -> Result<(), Error>
Revoke a capability transitively.
The capability and all capabilities derived from it are marked invalid. Uses the O(k) children-index fast path with proper BFS traversal.
§Errors
Returns Error::Kernel(KernelError::CapNotFound) if the capability does not exist.
Sourcepub fn alloc(&mut self, owner: PluginId, size: Size) -> u64
pub fn alloc(&mut self, owner: PluginId, size: Size) -> u64
Allocate a memory resource, returning its address.
Sourcepub fn free(&mut self, addr: u64) -> Result<(), Error>
pub fn free(&mut self, addr: u64) -> Result<(), Error>
Free a memory resource.
§Errors
Returns an error if valid capabilities still target this address (temporal safety) or if the address is not live.
Sourcepub fn plugin_count(&self) -> usize
pub fn plugin_count(&self) -> usize
Get the number of registered plugins.
Sourcepub fn actor_count(&self) -> usize
pub fn actor_count(&self) -> usize
Get the number of actors.
Sourcepub fn resource_count(&self) -> usize
pub fn resource_count(&self) -> usize
Get the number of resources.
Sourcepub fn workflow_count(&self) -> usize
pub fn workflow_count(&self) -> usize
Get the number of workflows.