Struct Runner 

pub struct Runner { /* private fields */ }

Runs worker modes under the platform jail.

Implementations

impl Runner

pub fn new( backend: Box<dyn JailBackend>, worker: PathBuf, limits: Limits, ) -> Runner

A runner over an explicit backend, worker, and limits, with no grants beyond the worker and the jail.

pub fn with_grants( backend: Box<dyn JailBackend>, worker: PathBuf, limits: Limits, exec_grants: Vec<PathBuf>, read_grants: Vec<PathBuf>, runtime_profile: RuntimeProfile, ) -> Runner

A runner whose jail additionally grants literal files: read and execute for exec_grants, read only for read_grants. This is how the pinned engine binaries and weights reach a jailed worker: literal files only, never a directory, and the worker still re-hashes each one against its pinned BLAKE3 before use.

runtime_profile is the measured jail class this worker mode is authorized for. Only the audio worker mode passes RuntimeProfile::Accelerator; every other mode passes RuntimeProfile::Plain whatever grants it carries, so no worker inherits allowances measured for a different engine.

pub fn with_provider_jail( backend: Box<dyn JailBackend>, worker: PathBuf, limits: Limits, exec_grants: Vec<PathBuf>, read_grants: Vec<PathBuf>, provider: ProviderJail, ) -> Runner

A runner under the provider jail class, whose profile additionally grants the measured closures and service namespace the pinned external components need.

The class alone buys nothing: the backend renders the widened profile only when this class arrives together with a non-empty executable grant and these parameters, so a worker that names the class with nothing wired keeps the base profile.

pub fn with_platform_defaults() -> Result<Runner, RunnerError>

The platform backend, the co-located worker binary, and default limits.

pub fn backend(&self) -> &dyn JailBackend

The backend this runner spawns through.

pub fn limits(&self) -> &Limits

The limits this runner enforces.

pub fn policy_digest(&self) -> Result<String, RunnerError>

The policy digest that keys this runner’s probe cache entry.

pub fn run( &self, mode: &str, payload: Value, files: &[(&str, &[u8])], ) -> Result<Response, RunnerError>

Runs one adapter mode inside the jail and returns its response.

files are written into a fresh jail directory before the spawn, so the child reads inputs by bare name from its working directory. The capability probe must have passed for the current policy digest, and runs once per process if not.