Struct PluginAdmission 

pub struct PluginAdmission<V> { /* private fields */ }

Selection policy, trust root, catalogue, and verifier in one admission step. 把筛选策略、信任根、目录与验证器合成一次准入。

Implementations

impl<V: PluginSignatureVerifier> PluginAdmission<V>

pub fn new( policy: PluginPolicy, trust: PluginTrustPolicy, catalog: PluginCatalog, verifier: V, ) -> Self

Build one admission from an already-parsed catalogue. 用一份已解析的目录构造准入。

pub fn from_package_root( package_root: &Path, policy: PluginPolicy, trust: PluginTrustPolicy, verifier: V, ) -> Result<Self, HostError>

Build one admission from the plugin locks under package_root. 从 package_root 下的插件锁构造准入。

pub fn catalog(&self) -> &PluginCatalog

The catalogue this admission consults. 本准入所咨询的目录。

pub fn admit( &self, artifact: PluginArtifact, ) -> Result<VerifiedPluginArtifact, HostError>

Admit one raw artifact: selection first, then verification. 准入一个原始工件：先筛选，后校验。

The order matters and is the kernel’s: revocation and the lock are consulted before the signature, so a revoked or unlisted version is refused whatever the signature says. An official manifest must pass verify_signed, which requires a trust root — a host that configures none gets MissingOfficialKey instead of a silent downgrade to checksums; a user manifest takes the digest path, because no verifier is consulted for that source. 顺序很重要，而且由内核决定：撤销与锁在签名之前被检查，因此已吊销或未登记的版本无论签名说什么 都被拒绝。官方 manifest 必须过 verify_signed，而它要求信任根——没有配置信任根的宿主会拿到 MissingOfficialKey，而不是被静默降级为纯摘要；用户 manifest 走纯摘要路径，因为该来源不会 咨询验证器。

impl<V: PluginSignatureVerifier> PluginAdmission<V>

pub fn install( &self, table: &WasmPluginTable, slot: &str, artifact: PluginArtifact, ) -> Result<u64, HostError>

Admit an artifact and install it into a Wasm slot. 准入一个工件并把它安装进 Wasm 槽。

The lane comes from the assurance the artifact earned, and the slot’s own contract, framework, and channel list are checked by install before anything is queued. 通道来自工件换来的保证等级；槽自身的合同、框架与通道列表由 install 在挂起任何东西之前 检查。

impl<V: PluginSignatureVerifier> PluginAdmission<V>

pub fn load_process( &self, backend: &ProcessBackend, program: ProcessProgram, artifact: PluginArtifact, ) -> Result<ProcessInstance, HostError>

Admit an artifact and stage it for process execution. 准入一个工件并为进程执行暂存它。