Crate pointlock_provider_devicerail 

pointlock-provider-devicerail

The DeviceRail implementation of the Pointlock provider SPI (design doc 04 §9; spine §4). The provider is a capability declaration plus faithful execution — it never folds, translates, improvises, retries, or degrades (04 §1):

• DeviceRailProvider: static devicerail_manifest + the atomic openSession sequence (spawn → system.hello → devices.list → device.select → device.connect → device.capabilities → attestation → session.start, 04 §9.3) with lockfile-digest attestation (04 §9.2).
• DeviceRailSession: the ten ProviderSession methods over one exclusively-owned devicerail-client connection.
• lock_via_spawn / make_lockfile: the pointlock lock freeze path (CLI wiring follows).

Wire names follow spine A.8 verbatim; DTO transcription is field-by-field (convert); error normalization implements the 04 §6 / §9.6 tables (error_map).

Documented divergences and gaps (honesty over fabrication)

• fetchEvidence is a typed unsupported error: DeviceRail asset URIs (devicerail://assets/sha256/<digest>) have no byte channel on the control plane and devicerail-client exposes no fetch API.
• PlatformKind has no mock counterpart; the mock platform maps provisionally to linux on both the lock and attestation paths (see convert::platform_kind_from_wire).
• Client-side backpressure errors surface directly as transport_lost (04 §9.6 envisions provider-internal queueing; M1 has none).
• The spawn exit protocol’s SIGTERM step is collapsed into the client’s kill path (stdin EOF → grace → kill).

Structs

DeviceRailProvider

The DeviceRail provider. Holds the capability lockfile the flow was compiled against; open_session re-attests the live world against it.

DeviceRailSession

One open DeviceRail session (see the module docs).

SpawnSpec

The spawn endpoint form: Pointlock owns the daemon process.

Constants

DEFAULT_DAEMON_COMMAND

Default daemon command, resolved through PATH (04 §9.1).

DEFAULT_SHUTDOWN_GRACE_MS

Default shutdown grace before the daemon child is killed (04 §9.1).

DRIVER_ERROR_RPC_CODE

The daemon’s numeric JSON-RPC code for driver-layer failures of device.execute (DeviceRail daemon DRIVER_ERROR). A driver failure is appended to the session log as an actionCompleted failed terminal before the RPC error is returned (durable-terminal shield), so this code is the wire discriminator between “the action reached the driver and failed” (a definite failed terminal) and “the request never entered action execution” (a ProviderError).

INFRA_REQUIRED_FEATURES

Provider-infrastructure features (04 §9.2 ★ rows): preconditions of this provider’s execution model itself, flow-independent, always placed in FeatureOffer.required.

OFFERED_OPTIONAL_FEATURES

Every non-infrastructure feature this provider offers in system.hello. The full known universe is always offered (required ∪ optional covers it), so FeatureSelection.enabled — and therefore the lockfile digest — depends only on the daemon, never on which flow triggered the handshake. action.protected.v1 is deliberately absent: v0.1 does not offer and does not consume it (04 §9.2).

PROVIDER_NAME

The v0.1 provider name (04 §8 assembly ruling: constant devicerail).

Functions

classify_remote_rpc

Classifies a JSON-RPC envelope error (04 §6.2 priority rows 1–2 first, then the action-layer table).

classify_wire_code

Maps one action-layer wire error code to the closed ErrorClass (04 §6.2 / §9.6; the wire code set is open — unknown codes fall through on the daemon’s declared retryable bit).

devicerail_manifest

The DeviceRail provider manifest (built once, shared).

execute_terminal_from_rpc

Extracts a definite four-way terminal from a device.execute RPC failure, when the wire fact is one (04 §9.6).

lock_via_spawn

Runs the pointlock lock wire sequence against a freshly spawned daemon and freezes the outcome into a sealed CapabilityLockfile (04 §10.2; CLI wiring lands with pointlock lock).

lock_via_spawn_at

lock_via_spawn with a caller-pinned attestedAt. The digest domain already excludes attestedAt (spine §4.1, 04 §10.2), so pinning is never needed for digest stability — it remains useful only for byte-identical lockfile artifacts / pinned provenance in fixtures.

lockfile_provider_identity

The provider identity this crate stamps into fresh lockfiles.

make_lockfile

Builds a sealed CapabilityLockfile from one live handshake + device-capabilities outcome. This is the pointlock lock freeze path and — with provider/attested_at taken from the held baseline — the attestation re-synthesis path.

provider_error_from_client

Builds the unified ProviderError carrier from a devicerail-client failure (04 §9.6 “client” rows; class names follow the Rust client crate per the R12 note).