Module ports 

Injected effect ports — the seam that keeps every domain testable in isolation without touching the real filesystem, git, network, or clock (ADR-0001 §2).

Domain code (contract, facts, audit, release) takes these traits by reference instead of calling std::process, std::time, or the network directly. Production supplies real implementations in ossctl-cli; tests supply deterministic fakes. At founding these are the trait shapes only; concrete implementations land with their consuming units.

Structs

CommandOutput

Output of a subprocess run through a CommandRunner.

Traits

Clock

Supplies the current time. Injected so time-dependent logic (journal timestamps, run ages) is deterministic under test.

CommandRunner

Runs external commands (git, package-manager, registry CLIs) on behalf of a domain, capturing their output. The single seam for shelling out — nothing in ossctl-core calls std::process::Command directly.

Fs

Read/write access to the filesystem — the Fs half of the Fs/Git seam (ADR-0001 §2). Domain code (contract loading, journal persistence, sealed plans) goes through this port rather than calling std::fs directly, so it is testable against an in-memory fake. At founding this is a deliberately small surface; it grows (atomic writes, dir listing, metadata) as the journal and plan-sealing units land.

GitRepo

Read-only view of the git repository under audit/release. The detector and release engine read repo facts through this port rather than shelling out to git themselves.

IdGen

Generates opaque, unique, non-deterministic identifiers — run ids and the like. Injected so id-dependent output is deterministic under test.

JournalLock

An opaque RAII guard for the single-active-cut lock taken by JournalStore::lock_exclusive. Dropping it releases the lock; there are no methods — its lifetime is the contract.

JournalStore

Durable, atomic, lockable storage for the release journal — the seam that keeps the event-sourced journal (ADR-0003) testable without touching the real filesystem, while pinning down the atomicity discipline its production impl must honor.

RegistryQuery

Queries a package registry for already-published state — the “remote is ground truth” source the release reconciler consults (ADR-0003).

Tagger

Creates and publishes the one shared release tag + GitHub Release for a cut — the external side of the coordinator’s coordinator-only tag phase (ADR-0002 §2).