Crate rite_runtime 

Execution runtime for Rite ceremonies.

rite-runtime defines the protocol that frontends use to drive a ceremony to completion, the executor that walks the ceremony plan, and the supporting machinery for transcripts and action handlers.

Key types

• Executor, channel-driven engine that walks a ceremony plan.
• Action / ActionRegistry, the handler trait and registry.
• BackendRegistry / BackendFactory, lazy backend store.
• Reporter, action-facing handle for facts, signals, and prompts.
• TranscriptSink, durable JSONL audit log with hash chaining.

Stability

Internal crate. This is an implementation detail of the rite CLI, with no stable API and no semver guarantees across releases. Build against the public rite-sdk, rite-model, or rite-resolver crates instead.

Modules

test_support

Test-only helpers for action implementors.

Structs

ActionRegistry

Registry mapping action types to their handlers.

BackendKeyMeta

What an action needs to know about a backend-managed key.

BackendRegistry

Backend registry that owns all backend lifecycle state.

BackendVersion

A linked cryptographic backend library and its runtime version.

BuildInfo

Identity of the running rite binary. A property of the artifact, set at compile time; the strongly verifiable end of the trust boundary (checkable against a release tag and build provenance).

CeremonyRandom

The per-ceremony entropy source.

Disk

A block device and its mount, as shown in the System tab.

Draw

A value drawn from the source, paired with the path that derives it.

EntropyVerified

Outcome of re-deriving a transcript’s entropy source.

Environment

Live inventory of the machine’s attached devices.

ExecutionState

Complete execution state, recreated after each step.

ExecutionSummary

Summary returned by Executor::run on a successful completion.

Executor

Channel-driven executor. One per ceremony run.

FeatureCheck

A single security-feature determination: a machine-comparable status plus optional human context.

HandlerContext

Read-only view of execution state for handlers.

Hardening

Snapshot of platform memory- and DMA-protection features.

HostInfo

Identity of the host machine. A property of the environment, the weakly verifiable end of the trust boundary (an operator assertion that software can only partly corroborate).

InMemorySink

In-memory sink that collects every recorded StepFact.

JsonlFileSink

JSONL file sink with a salted commitment chain.

LoadedTranscript

Verified transcript contents: the facts, what could not be read, the fingerprint, and whether the run reached a terminal fact.

MaterialOverview

Overview of a declared material, carried by UiSignal::CeremonyOverview so the live UI can render the material list. In-flight only: the ceremony YAML is the source of truth for material metadata, so this never reaches the transcript.

OutputConfig

Configuration for ceremony output directory structure.

PromptId

Identifier that pairs a prompt request with its matching response.

Reporter

Action-facing handle threaded into every action handler.

Share

One share of a split: the threshold of its set, the x it was evaluated at (from 1) and one y byte per byte of the secret.

ShareSet

The shares of one split, as each custodian receives them.

StartupSnapshot

The one-shot UI snapshots emitted at ceremony start: static system identity and the initial device environment.

StepInfo

Information about a step needed by action handlers.

StepResult

Result of executing a step.

StepUnsupportedParam

A with: value this build cannot carry out, and the step holding it.

SystemClock

The real clock: reads the host wall clock via Utc::now. The default for every production run.

SystemInfo

Static build and host identity for the System tab and rite version --verbose.

SystemInfoParseError

Failure to parse one of this module’s string-backed enums.

TimedFact

A recorded fact with its line’s time and level.

TranscriptVerified

Outcome of verifying a transcript on disk.

UnknownFact

A line whose fact has a type this reader does not know, from a newer vocabulary. Its commitment is checked; its content is not read.

WithheldLine

A line whose fact is withheld: the transcript was disclosed without it.

Enums

ActionError

Errors that may surface from an Action handler.

ArtifactValue

Runtime representation of an artifact.

ExecEvent

Event emitted by the runtime to the frontend.

ExecutionError

Errors during ceremony execution.

FeatureStatus

Status of a platform security feature.

Icon

Visual cue for UI lines. Mapped to a glyph by the frontend.

MaterialOverviewKind

Kind of material in MaterialOverview. Mirrors the structural distinction of the IR’s MaterialKind without the load-time implementation detail (file sources).

ReporterError

Errors that can arise while emitting events or awaiting a response.

Response

In-process user response.

UiCommand

Command sent by the frontend to the runtime.

UiSignal

Transient UI-only signal. Never written to the transcript.

VerifyError

Verification failure modes.

Constants

DERIVATION_V1

Frozen-scheme tag recorded with the machine seed. It pins the entire construction (Extract/Expand, the ratchet rule, the info/path byte encodings), not merely the hash. A verifier treats it as a selector among known-good schemes it already trusts and rejects any value it does not recognise, it is never an instruction to trust an arbitrary algorithm.

MAX_DRAW_LEN

Longest value a single draw can produce: the HKDF-Expand output limit of 255 * HashLen bytes (RFC 5869), with SHA-256’s 32-byte output. [expand] panics beyond this, so anything replaying a recorded draw must bound the requested length by this value first.

PRODUCER

Name and version of the program writing transcripts, as the header records it.

Traits

Action

Action trait, every ceremony step handler implements this.

Clock

Source of wall-clock time for a ceremony run.

TranscriptSink

Synchronous, durable observer of StepFacts.

Functions

build_path

Build a derivation path. The single place the path format lives, so the draw side and the verify side cannot drift. A purpose is drawn at most once per step, so (epoch, step, purpose) uniquely identifies a value.

compute_file_fingerprint

SHA-256 fingerprint of a file’s contents.

compute_fingerprint

SHA-256 fingerprint of an in-memory byte slice.

derive_value

Derive the value at path from the given epoch seed.

disclose_transcript

Withhold every fact recorded above threshold, keeping each line’s commitments, so the result folds to the same fingerprint.

evaluate

Evaluate an expression in the given context.

evaluate_expr_value

Evaluate an ExprValue to a JSON value.

evaluate_expr_value_to_string

Evaluate an ExprValue to a string.

fact_summary

One-line summary of a StepFact for live-frontend display.

fold_seed

Advance the ratchet by one epoch, folding in a human contribution.

initial_seed

Compute seed_0 from the machine entropy m.

parse_params

Deserialize the per-step parameter blob into a typed handler-specific struct.

read_verified_transcript

Verify a JSONL transcript and return its facts.

resolve_artifact_bytes

Resolve an artifact reference to byte content.

resolve_backend_key

Resolve an artifact to a backend-managed key reference.

resolve_share

Resolve a reference to one share.

signal_summary

One-line summary of a UiSignal for live-frontend display.

truncate_for_display

Truncate a string to at most max_chars Unicode scalar values, appending "..." when truncation occurs.

value_to_json

Convert a Value to a JSON value for action parameters.

verify_entropy

Re-derive a transcript’s entropy source and confirm every drawn value.

verify_jsonl

read_verified_transcript over a transcript already in memory.

verify_step_fact_transcript

Verify a JSONL transcript file produced by JsonlFileSink.

write_new_file

Write bytes to a freshly created file at path, failing if anything already exists there.

Type Aliases

BackendFactory

A closure that creates a concrete backend from its name and config.

TranscriptFingerprint

A transcript’s fingerprint: the chain of its last line.