Crate sim_lib_exec 

Capability-gated bounded host-process execution for the SIM runtime.

This crate supplies a general host exec operation for libraries that need to run an external process under explicit authority. The operation accepts a structured argv vector, never inserts a shell, captures stdout and stderr, enforces a mandatory timeout, and truncates captured output at a caller-set byte cap. It is a host operation, not SIM evaluation.

Structs

ArgAtom

One whole, NUL-free native argument; it is never shell-split.

DispatchEvidence

Bounded evidence for an ambiguous post-spawn outcome.

ExecOptions

Portable options used to create a sealed process request.

LauncherRegistry

Boot-built launcher registry; callers select an identity, never a concrete OS type.

PrivateArtifactRef

Opaque, boot-trusted private-artifact reference.

ProcResult

Stable bounded process result; non-zero exit remains a result.

ProcessBudget

Bounded input, time, and output policy.

ProcessCancellation

Cooperative cancellation token shared with the platform adapter.

ProcessReceipt

Privacy-safe completed-process receipt.

ProcessRequest

Fully validated portable request passed to a platform capsule.

ProgramRef

Opaque, boot-trusted program reference.

ProjectRootRef

Opaque, boot-trusted project-root reference.

SandboxEvidence

Evidence for one requested control; only launchers may assert achieved.

SandboxLimits

Complete bounded resource policy. Zero is invalid for every limit.

SandboxMount

Opaque boot-resolved source mounted at a fixed absolute guest path.

SandboxPolicy

Validated portable sandbox policy, independent of any OS launcher.

SandboxRefusal

A fail-closed refusal or unprovable launch outcome.

SandboxReport

Requested-versus-achieved report plus every operational limit event.

SandboxRequest

Fully validated untrusted-process request. Arguments remain literal atoms.

SandboxResult

Bounded process output paired with launcher-supplied sandbox evidence.

SealedBindings

Exact child bindings. No ambient inheritance is representable.

StopReceipt

Proof that a dispatched process group was killed and reaped.

Enums

BindingValue

A sealed literal or capsule-rendered resource reference.

MountAccess

Access granted to a declared mount.

ProcessAttempt

Exact dispatch truth for one process attempt.

ProcessRefusal

Reason a process definitely did not cross the spawn boundary.

SandboxAttempt

Exhaustive result of asking a sandbox launcher to execute a request.

SandboxControl

One independently provable sandbox control.

SandboxRequirement

Whether absence of a control is fatal or may be reported as unavailable.

Statics

RECIPES

Cookbook recipes for this lib, embedded at build time.

Traits

ProcessPort

Runtime-owned seam implemented only by model and physical capsules.

SandboxLauncher

Replaceable object-safe untrusted-process authority boundary.

Functions

exec

Checks capability and portable policy before invoking the port.

exec_capability

Capability required before a process request reaches its port.

proc_result_symbol

Read-constructor symbol for process results.

sandbox_exec

Runs an untrusted request and rejects any completion lacking required proof.