Module stager 

Update stager — the apply substrate the hot and warm update paths build on.

The stager runs one job: land a staged update safely. It downloads the update to a side location that never touches the live path, verifies its signature before anything is applied, flips the live pointer to the new version, and — if a post-apply health check fails — flips the pointer back to the previous version. The previous version stays staged the whole time, so a rollback is a pointer flip rather than a re-download.

The seams

The stager owns the state machine, not the I/O. Everything that touches the outside world is an injectable seam, so the machine can be exercised without a real download, a real key, or a real process boot:

• UpdateSource downloads the release to a side location.
• SignatureVerifier checks the ed25519 signature over the staged bytes. In production this wraps the project’s ed25519 key custody (the same verify the event log and approval flow use); the stager only ever sees a yes/no answer, so a foundation crate needs no signing dependency to run it.
• Activator materializes the pointer flip — a symlink swap, an image tag, or a process swap. It is called once to apply and, in reverse, once to roll back.
• HealthCheck probes the freshly-applied version. Health::Healthy commits; anything else triggers the auto-rollback.

Each seam has a blanket implementation for the matching closure, so a caller can pass a closure where a full type would be overkill.

The state machine

Stager::stage_and_apply walks a fixed sequence:

  download ──▶ verify ──▶ apply (pointer flip) ──▶ health check
                 │                                     │
                 │ (unverified)                        ├─ healthy  ──▶ Committed
                 ▼                                     │
              refused                                  └─ unhealthy ──▶ auto-rollback ──▶ RolledBack
              (nothing applied)                            (pointer flips back)

The invariant the tests pin: an unverified bundle is never applied (the live pointer is untouched), the previous version stays staged, and a failed health check leaves the system honestly back on the previous version.

The staged artifact carries the StagedBundle it delivers, so a caller that already classified the release (see crate::compat) hands the same value straight through to apply.

Structs

ReleaseId

A release identity — the pointer the live slot resolves to and flips between.

StagedArtifact

An update downloaded to a side location, before verification.

Stager

The apply substrate: stage → verify → apply → (commit | auto-rollback).

Enums

Health

The result of a post-apply health check.

Outcome

What happened to a stage_and_apply call that got as far as a health check.

StageError

Why a stage_and_apply call could not reach a health check.

Traits

Activator

Materializes a pointer flip to a release — a symlink swap, an image tag, or a process swap.

HealthCheck

Probes a freshly-applied version to decide whether it commits or rolls back.

SignatureVerifier

Verifies the ed25519 signature over a staged artifact.

UpdateSource

Downloads a release to a side location, never the live path.