Enum TrustLevel 

pub enum TrustLevel {
    Trusted,
    Untrusted,
}

How far a workload’s code is trusted — the declared input from which admission derives a minimum ExecSubstrate (R894).

Absent means trusted, and that is only safe because of where it is stamped

The default direction is the trap this axis exists to close, so it is worth stating exactly. Every WorkloadSpec in the tree today is built by operator code — a reconciler, an appliance builder, a qed dispatcher — and none of them declares trust. Making the absent key mean untrusted would refuse the entire fleet on the day this lands; making it mean trusted is correct for exactly that population and wrong for any other.

So the rule is not “absent means trusted”. It is: the single choke point that ingests code the operator did not write stamps TRUST_UNTRUSTED_VALUE as it builds the spec (WorkloadSpec::stamp_untrusted), and a spec that reaches admission without having passed through operator-authored construction cannot exist. A tenant does not hand yah a WorkloadSpec; it hands yah an image and an argv, which yah’s own code puts into a spec. That is why the marker is not self-attestable: the untrusted party never holds the pen.

R823 (untrusted camp vending on microVMs) is the first such choke point. If a second one appears, it stamps too — and the rule to apply is that any constructor taking third-party bytes calls stamp_untrusted in the same function that takes them, not in a caller that might be forgotten.

Variants

Trusted

Operator-authored code. No substrate floor.

Untrusted

Third-party code. Must not share a kernel with the fleet.

Implementations

impl TrustLevel

pub fn minimum_substrate(self) -> ExecSubstrate

The weakest substrate this trust level may run on.

TrustLevel::Untrusted maps to ExecSubstrate::MicroVm because a container shares the node’s kernel, and “untrusted code never shares a kernel with the fleet” is the rule this axis makes checkable. W344’s isolation table says “containerd or microVM” for higher-risk code; the 2026-09-11 operator call resolved that disjunction to the strict side for code the operator did not write.

TrustLevel::Trusted maps to ExecSubstrate::Native, the bottom of the ordering — i.e. no constraint, which is what every workload running today has.

pub fn as_str(self) -> &'static str

The annotation value spelling this level.

Trait Implementations

impl Clone for TrustLevel

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for TrustLevel

impl Debug for TrustLevel

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TrustLevel

fn default() -> Self

Returns the “default value” for a type.

impl Eq for TrustLevel

impl Hash for TrustLevel

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl Ord for TrustLevel

fn cmp(&self, other: &Self) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

fn clamp_to<R>(self, range: R) -> Self

where Self: Sized, R: ClampBounds<Self>,

🔬This is a nightly-only experimental API. (clamp_to)

Restrict a value to a certain range.

impl PartialEq for TrustLevel

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl PartialOrd for TrustLevel

fn partial_cmp(&self, other: &Self) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl StructuralPartialEq for TrustLevel