Struct WorkflowTaskGovernanceControlPlane 

pub struct WorkflowTaskGovernanceControlPlane<S, A> { /* private fields */ }

Authorized facade over the destructive tombstone governance store.

Implementations

impl<S, A> WorkflowTaskGovernanceControlPlane<S, A>

where S: WorkflowTaskTombstoneGovernanceStore, A: WorkflowTaskGovernanceAuthorizer,

pub fn new(store: Arc<S>, authorizer: Arc<A>) -> Self

Creates a fail-closed control plane.

pub fn with_observer( self, observer: Arc<dyn WorkflowTaskGovernanceObserver>, ) -> Self

Attaches a low-cardinality outcome observer.

pub async fn place_hold( &self, principal: &WorkerId, tenant_id: WorkflowTenantId, checkpoint_id: CheckpointId, reason: WorkflowTaskLegalHoldReason, ) -> Result<WorkflowTaskLegalHold, WorkflowTaskGovernanceError>

Places a hold using the authenticated principal as the audit actor.

Errors

Fails closed on denied authority or store failure.

pub async fn release_hold( &self, principal: &WorkerId, tenant_id: WorkflowTenantId, checkpoint_id: CheckpointId, ) -> Result<WorkflowTaskLegalHold, WorkflowTaskGovernanceError>

Releases a hold using the authenticated principal as the audit actor.

Errors

Fails closed on denied authority or store failure.

pub async fn export_next_page<R>( &self, principal: &WorkerId, tenant_id: WorkflowTenantId, after: Option<WorkflowTaskTombstoneCursor>, limit: WorkflowTaskTombstoneLimit, archive: &R, ) -> Result<WorkflowTaskTombstoneArchiveReport, WorkflowTaskGovernanceError>

where R: WorkflowTaskTombstoneArchive,

Archives one page and confirms its watermark only after receipt.

Errors

Fails closed on denied authority, source-store failure, archive failure, or durable confirmation failure.

pub async fn prepare_purge( &self, principal: &WorkerId, lease: WorkflowTaskCleanupLease, retention: WorkflowTaskTombstoneRetention, limit: WorkflowTaskTombstonePurgeLimit, approval_window: WorkflowTaskTombstoneApprovalWindow, ) -> Result<WorkflowTaskTombstonePurgeIntent, WorkflowTaskGovernanceError>

Prepares a purge only when the lease belongs to the principal.

Errors

Rejects denied authority, a mismatched lease principal, or store failure.

pub async fn approve_purge( &self, principal: &WorkerId, tenant_id: WorkflowTenantId, purge_id: WorkflowTaskTombstonePurgeId, ) -> Result<WorkflowTaskTombstonePurgeIntent, WorkflowTaskGovernanceError>

Approves using the authenticated principal, preserving four-eyes checks.

Errors

Fails closed on denied authority or store governance failure.

pub async fn list_purge_approvals( &self, principal: &WorkerId, tenant_id: WorkflowTenantId, limit: WorkflowTaskTombstoneApprovalInboxLimit, ) -> Result<Vec<WorkflowTaskTombstoneApprovalInboxItem>, WorkflowTaskGovernanceError>

Lists the tenant’s bounded durable approval inbox.

Errors

Fails closed on denied authority or store failure.

pub async fn claim_purge_approval( &self, principal: &WorkerId, tenant_id: WorkflowTenantId, lease: LeaseDuration, ) -> Result<Option<WorkflowTaskTombstoneApprovalLease>, WorkflowTaskGovernanceError>

Claims the oldest eligible approval using the authenticated reviewer.

Errors

Fails closed on denied authority or store failure.

pub async fn approve_claimed_purge( &self, principal: &WorkerId, lease: WorkflowTaskTombstoneApprovalLease, ) -> Result<WorkflowTaskTombstonePurgeIntent, WorkflowTaskGovernanceError>

Approves an exact principal-owned reviewer lease.

Errors

Rejects a mismatched reviewer, denied authority, or stale lease.

pub async fn reject_claimed_purge( &self, principal: &WorkerId, lease: WorkflowTaskTombstoneApprovalLease, reason: WorkflowTaskTombstoneRejectionReason, ) -> Result<WorkflowTaskTombstoneApprovalInboxItem, WorkflowTaskGovernanceError>

Rejects an exact principal-owned reviewer lease with durable evidence.

Errors

Rejects a mismatched reviewer, denied authority, or stale lease.

pub async fn execute_purge( &self, principal: &WorkerId, lease: WorkflowTaskCleanupLease, purge_id: WorkflowTaskTombstonePurgeId, ) -> Result<WorkflowTaskTombstonePurgeEvidence, WorkflowTaskGovernanceError>

Executes using an exact principal-owned fenced lease.

Errors

Rejects denied authority, a mismatched lease principal, or store execution failure.

pub async fn get_evidence( &self, principal: &WorkerId, tenant_id: WorkflowTenantId, purge_id: WorkflowTaskTombstonePurgeId, ) -> Result<Option<WorkflowTaskTombstonePurgeEvidence>, WorkflowTaskGovernanceError>

Reads evidence under an explicit tenant-scoped grant.

Errors

Fails closed on denied authority or store failure.

Trait Implementations

impl<S, A> Debug for WorkflowTaskGovernanceControlPlane<S, A>

fn fmt(&self, formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.