Crate sim_lib_exec

Expand description

Capability-gated bounded host-process execution for the SIM runtime.

This crate supplies a general host exec operation for libraries that need to run an external process under explicit authority. The operation accepts a structured argv vector, never inserts a shell, captures stdout and stderr, enforces a mandatory timeout, and truncates captured output at a caller-set byte cap. CommandSpec identifies exact installed checker commands, including unchanged interpreter bytes, resources, output and cleanup policy; LocalCheckPort keeps packet tooling outside the native process boundary. It is a host operation, not SIM evaluation.

Structs§

ArgAtom: One whole, NUL-free native argument; it is never shell-split.
BuildSourceRef: Stable sealed build-source reference.
CapabilityGrantRef: Stable least-authority grant reference.
CleanupContract: Required cleanup proof for process descendants and writable scratch roots.
CommandId: Semantic identity of an exact trusted command specification.
CommandResource: One opaque, boot-resolved resource made available to an exact command.
CommandSpec: Immutable allowlist entry pinning every local checker execution input.
DispatchEvidence: Bounded evidence for an ambiguous post-spawn outcome.
ExecOptions: Portable options used to create a sealed process request.
LauncherRegistry: Boot-built launcher registry; callers select an identity, never a concrete OS type.
LocalCheckLease: Explicit bounded lease request supplied to a local checker port.
LocalCheckRequest: Capability-scoped request naming only an installed allowlist entry.
LocalCheckResult: Stable checker-facing response without native process or path values.
OutputContract: Semantic process result and filesystem postcondition.
OutputExpectation: One independently observable path beneath a writable resource.
PacketRef: Stable implementation packet reference.
PrivateArtifactRef: Opaque, boot-trusted private-artifact reference.
ProcResult: Stable bounded process result; non-zero exit remains a result.
ProcessBudget: Bounded input, time, and output policy.
ProcessCancellation: Cooperative cancellation token shared with the platform adapter.
ProcessReceipt: Privacy-safe completed-process receipt.
ProcessRequest: Fully validated portable request passed to a platform capsule.
ProgramRef: Opaque, boot-trusted program reference.
ProjectRootRef: Opaque, boot-trusted project-root reference.
SandboxEvidence: Evidence for one requested control; only launchers may assert achieved.
SandboxLimits: Complete bounded resource policy. Zero is invalid for every limit.
SandboxMount: Opaque boot-resolved source mounted at a fixed absolute guest path.
SandboxPolicy: Validated portable sandbox policy, independent of any OS launcher.
SandboxRefusal: A fail-closed refusal or unprovable launch outcome.
SandboxReport: Requested-versus-achieved report plus every operational limit event.
SandboxRequest: Fully validated untrusted-process request. Arguments remain literal atoms.
SandboxResult: Bounded process output paired with launcher-supplied sandbox evidence.
SealedBindings: Exact child bindings. No ambient inheritance is representable.
StopReceipt: Proof that a dispatched process group was killed and reaped.

Enums§

BindingValue: A sealed literal or capsule-rendered resource reference.
CommandInvocation: Exact executable invocation; no variant performs shell parsing of argv.
CommandReplayPolicy: Replay law bound into the local request without depending on the operation crate.
CommandRoute: Selected capsule execution boundary.
LocalCheckStatus: Portable projection of the durable operation outcome.
MountAccess: Access granted to a declared mount.
NetworkAccess: Network authority for one command.
OutputState: Expected state of one declared output path after execution.
ProcessAttempt: Exact dispatch truth for one process attempt.
ProcessRefusal: Reason a process definitely did not cross the spawn boundary.
ResourceAccess: Read or write authority for one boot-resolved command resource.
SandboxAttempt: Exhaustive result of asking a sandbox launcher to execute a request.
SandboxControl: One independently provable sandbox control.
SandboxRequirement: Whether absence of a control is fatal or may be reported as unavailable.

Statics§

RECIPES: Cookbook recipes for this lib, embedded at build time.

Traits§

LocalCheckPort: Portable checker seam; packet tooling never constructs a native command.
ProcessPort: Runtime-owned seam implemented only by model and physical capsules.
SandboxLauncher: Replaceable object-safe untrusted-process authority boundary.

Functions§

exec: Checks capability and portable policy before invoking the port.
exec_capability: Capability required before a process request reaches its port.
proc_result_symbol: Read-constructor symbol for process results.
sandbox_exec: Runs an untrusted request and rejects any completion lacking required proof.