Module lifecycle 

One ephemeral runner, from an allocation decision to a scrubbed runtime.

The ordering in this module is intentional. An attempt is written before the package or GitHub is touched, the JIT value exists only in a restrictive handoff, and a registration-timeout termination is journalled before the process is signalled. Recovery uses the same code as ordinary supervision; startup merely supplies the first observation.

Re-exports

pub use ExecutionProvider as ProcessSupervisor;

Structs

AttemptEventLog

CachedRuntimePackages

Production package adapter. It takes an e2 lease before returning, so a cache entry can never look unused while its runtime is starting.

JitRequestFailure

LaunchTimings

Where one launch spent its time. A step the launch never reached is zero.

LifecycleGithubObservation

GitHub’s authoritative runner state plus the identity returned by inventory. The id is carried independently of the local sidecar so recovery can close the crash boundary immediately after a successful remote registration.

LifecycleLauncher

Production implementation of e1’s launcher port.

LifecyclePorts

NativeProcesses

Native process supervision. The start token is stored beside the runtime; recovery never trusts a recycled PID merely because SQLite contains it.

NoAttemptEvents

OneTimeJitHandoff

The JIT value can be passed into a provider start exactly once. It must never become a provider identity, label, argument, persisted configuration or log field.

PersistentDemand

PlatformExecutionProvider

Production provider set. Native and isolated allocations are routed by the immutable execution kind in the policy/journal; an unavailable isolated backend can never fall through to native process launch.

PreparedEnvironment

ProcessStartFailure

Process operations are attempt-addressed so a recovered process and a child started in this invocation are supervised through one port.

PruneAuthority

Unforgeable evidence that pruning was reached through e1’s launch request. The type is public only because it appears in the public adapter trait; its private field and constructor prevent callers from substituting a guard acquired from an unrelated lock.

ResolvedEnvironment

RetryPolicy

Retry bounds for failures that can resolve without operator action.

TokioRetryDelay

TracingAttemptEvents

The daemon’s sink for retries and launch timings; the other attempt events already reach the log through the reconcile sink.

WindowsHyperVContainers

Enums

AttemptEvent

Non-secret lifecycle evidence. Payloads are identifiers and closed enums; neither the encoded configuration nor child output can enter this type.

EnvironmentIdentity

EnvironmentState

LifecycleError

ProviderCapability

A credential-free capability report. An isolated policy never treats a native-ready result as permission to launch.

ProviderDestroy

ProviderDiagnostic

Closed, non-secret provider diagnostics; adapters cannot attach arbitrary output.

ProviderStop

WindowsHyperVHostState

Host-only preflight detail. It is a closed vocabulary and never carries provider output, so CLI/TUI surfaces cannot accidentally expose it.

Traits

AttemptEventSink

DemandPersistence

Whether the demand that justified a retry still exists.

ExecutionProvider

Provider lifecycle and native process supervision. The default lifecycle methods adapt the existing native spawn/recovery implementation, and refuse every isolated allocation. Future platform adapters must implement their own prepare/start/inspect/stop/destroy paths rather than fall back here.

LifecycleGithub

The two GitHub views the lifecycle needs, combined so one fake can drive registration and authoritative runner telemetry.

RetryDelay

RuntimePackages

Package/cache operations used by one attempt.