Struct DaemonState 

pub struct DaemonState {
    pub config: DaemonConfig,
    pub audit: Arc<dyn AuditStore>,
    pub policy: PolicyTable,
    pub host_distro: Option<DistroId>,
    pub forwarder: Option<AuditForwarder>,
    pub running_exclusive: Arc<Mutex<HashMap<ExclusiveResource, String>>>,
}

Fields

config: DaemonConfig

audit: Arc<dyn AuditStore>

Polymorphic audit store. Concrete impls: SqliteStore (default) and PostgresStore (selected via [storage] backend = "postgres"). Both implement AuditStore async trait.

policy: PolicyTable

host_distro: Option<DistroId>

Strict host identity used to enforce the documented support matrix at preview and execution boundaries.

forwarder: Option<AuditForwarder>

Optional external audit-log forwarder. None when no [audit.forward] sink is configured; events recorded by the dispatcher are then only written to the local hash-chained store.

running_exclusive: Arc<Mutex<HashMap<ExclusiveResource, String>>>

Concurrency guard keyed by the system lock each in-flight mutating action holds (ME4).

Maps an ExclusiveResource to the request_hash of the action currently holding it. A mutating action is rejected with a ConflictResponse when either

• ExclusiveResource::System is held — a reboot-required action (release upgrade, rebase, layered install) is in flight and conflicts with everything mutating; or
• its own resource is held — e.g. a second AptUpgrade while the first still owns ExclusiveResource::Dpkg.

This replaced a single Option<String> slot that only High-risk reboot-required actions ever claimed. Under that rule AptUpgrade (High risk, reboot_required: false) claimed nothing, so two concurrent apt-get dist-upgrade runs both passed the gate and then collided on /var/lib/dpkg/lock-frontend — the exact contention the gate exists to prevent, and one that can leave dpkg needing --configure -a.

Actions with no shared lock (exclusive_resource returns None, e.g. StartService) still respect a held System but never block each other, so unrelated work is not serialised behind a long apt run.

The map is Arc<Mutex<…>> so cloned DaemonState values — one per IPC connection — all share the same guard. Mutex::lock is held for at most a few microseconds; read-only actions skip the check entirely.

On daemon crash the in-memory guard is lost. That is correct: the daemon’s SQLite store will show the orphaned Running row; the operator can inspect it via ListJobHistory.

Implementations

impl DaemonState

pub fn open(config: DaemonConfig) -> Result<Self, DaemonStateError>

Open the daemon state with no policy overrides and no forwarding. Suitable for tests and dev runs.

pub fn open_with_policy( config: DaemonConfig, policy: PolicyTable, ) -> Result<Self, DaemonStateError>

Open the daemon state with an explicit policy table and no forwarding.

pub fn open_full( config: DaemonConfig, policy: PolicyTable, forwarder: Option<AuditForwarder>, ) -> Result<Self, DaemonStateError>

Open the daemon state with full configuration. Production callers (main.rs) build the policy table from [policy.risk_overrides] and the forwarder from [audit.forward]. The audit store defaults to SQLite at config.database_path; pass an explicit audit to use Postgres or any other AuditStore impl.

pub fn open_with_audit( config: DaemonConfig, policy: PolicyTable, forwarder: Option<AuditForwarder>, audit: Arc<dyn AuditStore>, ) -> Self

Open the daemon state with an explicit audit store. Used by main.rs when [storage] backend = "postgres" is configured: the Postgres AuditStore is constructed via PostgresStore::connect and passed here as the audit argument.

pub fn bootstrap( config: DaemonConfig, ) -> Result<DaemonRuntime, DaemonStateError>

Trait Implementations

impl Clone for DaemonState

fn clone(&self) -> DaemonState

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DaemonState

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.