Enum Step 

pub enum Step {
    PluginInternal {
        pid: PluginId,
        pi: PluginInternal,
    },
    HostCall {
        hc: HostCall,
        auth: Authorized,
        result: HostResult,
    },
    KernelInternal {
        op: KernelOp,
    },
    MemFree {
        caller: PluginId,
        addr: MemAddr,
    },
    CapRevoke {
        caller: PluginId,
        cap_id: CapId,
    },
}

Step represents a single state transition in the Lion microkernel.

Variants

PluginInternal

Plugin-internal computation (untrusted, sandboxed)

Fields

pid: PluginId

The plugin performing computation

pi: PluginInternal

The internal computation descriptor

HostCall

Host call (trust boundary, mediated)

Fields

hc: HostCall

The host call request

auth: Authorized

Authorization witness (validated at execution)

result: HostResult

Result of host call execution

KernelInternal

Kernel-internal operation (trusted TCB)

Fields

op: KernelOp

The kernel operation to execute

MemFree

Direct memory free operation (refinement bridge)

Fields

caller: PluginId

The plugin requesting the free

addr: MemAddr

The address to free

CapRevoke

Direct capability revoke operation (refinement bridge)

Fields

caller: PluginId

The plugin requesting revocation

cap_id: CapId

The capability ID to revoke

Implementations

impl Step

pub fn host_call_atomic( state: &State, hc: HostCall, cap_id: CapId, ctx: PolicyContext, result: HostResult, ) -> Result<Self, StepError>

Create a host call step with ATOMIC authorization.

The action is derived from the HostCall via hc.required_action(), binding authorization to the exact operation being performed. This prevents the vulnerability where a valid Authorized token for one action could be reused to execute a different HostCall.

pub fn is_effectful(&self) -> bool

Check if this step is effectful (crosses trust boundary).

pub fn subject(&self) -> Option<PluginId>

Get the subject (executing plugin) of the step, if any.

pub fn level(&self, state: &State) -> SecurityLevel

Get the security level of the step.

pub fn is_declassify(&self) -> bool

Check if this is a declassify operation.

pub fn execute(&self, state: &State) -> Result<State, StepError>

Execute this step, returning the new state.

pub fn execute_mut(&self, state: &mut State) -> Result<(), StepError>

Mutating execution – modifies state in place (production path).

Equivalent to execute but avoids the full-state clone by mutating in place. The validation logic is identical.

Trait Implementations

impl Clone for Step

fn clone(&self) -> Step

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Step

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.