Module export 

ExportSpec — what an ephemeral Process is allowed to leave behind.

The compounding move: ephemeral envs default to leaving nothing behind. Anything that must survive teardown is named explicitly via one or more ExportSpecs on :lifetime (:ephemeral … :exports …). Each export declares:

• what artifact to ship out (a ArtifactSource variant)
• where to ship it through (a VectorChannel variant — Vector ingest endpoint, NATS JetStream subject, or stdout)
• when to ship it (an ExportTrigger variant)

The pleme-io convention is that everything emitted from a workload flows through the Vector + NATS layer, never to ad-hoc sinks. VectorChannel enforces that at the type level — there is no S3Bucket or RawFileSystem variant. Vector’s downstream sink graph (file, VictoriaLogs, VictoriaMetrics, Loki, …) handles durability + analytics; this primitive only names the ingestion shape.

The reconciler’s Releasing phase (between Attested/Failed and Exiting) reads lifetime.ephemeral.exports, filters by ExportTrigger against the terminal phase, and emits one tatara-export-worker Job per surviving spec. Each Job emits a receipt of its own export action so the export itself participates in the BLAKE3 attestation chain.

Lisp authoring:

(defephemeral akeyless-closed-loop-attest
  :aplicacao  (…)
  :ttl        "1h"
  :teardown   OnAttested
  :exports
    (;; Receipts — tier-1 guaranteed delivery via NATS JetStream
     (:source  (:receipts)
      :channel (:nats-subject :subject "pleme.pleme-dev.ephemeral.{{run_id}}.receipt"
                              :stream  "EPHEMERAL_RECEIPTS")
      :when    OnAttested)
     ;; Test report — best-effort via Vector HTTP ingest
     (:source  (:test-report :configmap "akeyless-test-results"
                             :key       "junit.xml"
                             :format    Junit)
      :channel (:http-event :signal-type "test-report")
      :when    Always)
     ;; Run marker — small synthetic event for shinryu cohort math
     (:source  (:run-marker :labels (:run-id "{{run_id}}"
                                      :phase "end"))
      :channel (:http-event :signal-type "ephemeral-marker")
      :when    Always)))

Structs

ArtifactSource

What artifact this export ships out.

ExportSpec

One declared export from an ephemeral Process.

HttpEventChannel

HTTP POST channel — Vector http_server source.

NatsSubjectChannel

NATS JetStream channel — guaranteed-delivery publish.

ProcessSnapshotSource

Process snapshot source — bundles spec + status as JSON.

ReceiptsSource

Receipts source — no fields. The worker reads every ReceiptEnvelope annotated with this Process’s PID.

RunMarkerSource

Run marker source — small synthetic event with labels.

StdoutChannel

Stdout channel — worker prints the event; Vector picks up via kubernetes_logs.

TestReportSource

Test report source — a ConfigMap key with optional format hint.

UnknownArtifactKind

UnknownChannelKind

UnknownExportTrigger

UnknownReportFormat

VectorChannel

Where the export bytes flow.

Enums

ArtifactError

ArtifactKind

Closed-set discriminator over ArtifactSource’s four tagged-union slots. Single source of truth that drives ArtifactSource::variant’s ambiguity + emptiness resolver, the ArtifactError::Empty message, and the reverse ArtifactVariant::kind projection. Adding a fifth artifact variant lands at one ALL entry + one as_str arm + one select arm + one ArtifactVariant::kind arm — exhaustively checked by the compiler.

ArtifactVariant

Resolved enum view used by the worker.

ChannelError

ChannelKind

Closed-set discriminator over VectorChannel’s three tagged-union slots. Single source of truth that drives VectorChannel::variant’s ambiguity + emptiness resolver, the ChannelError::Empty message, and the reverse ChannelVariant::kind projection. Adding a fourth channel variant lands at one ALL entry + one as_str arm + one select arm + one ChannelVariant::kind arm — exhaustively checked by the compiler.

ChannelVariant

ExportTrigger

When the export fires. Aligns with ProcessPhase so the reconciler’s Releasing phase can match against the terminal phase reached directly.

ReportFormat

Bytes-shape hint for TestReportSource. Tatara emits the bytes untransformed and tags the Vector event with this so shinryu can route to the right parser tier.

ReportPayloadShape

How the export worker should embed a TestReportSource’s bytes into the shipped ExportEvent.payload. Lifted as a closed-set typed projection from ReportFormat::payload_shape so the worker’s dispatch is exhaustive on ReportPayloadShape, not on ReportFormat with a silent _ arm. Adding a future ReportFormat variant forces the author to pick its shape here (single edit site); adding a future shape (e.g. compressed) forces every consumer to handle it.

Constants

DEFAULT_NATS_URL

Default NATS URL when NatsSubjectChannel.url is unset.

DEFAULT_VECTOR_INGEST

Default Vector ingest endpoint when HttpEventChannel.endpoint is unset. Single source of truth for downstream tooling.