ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Implement verified OCI prepared-lower lifecycle

Browse source
This commit is contained in:
ms2k 2026-07-15 15:22:02 +09:00
commit 5458460717
2 changed files with 4973 additions and 273 deletions
Download patch file Download diff file Expand all files Collapse all files

19
crates/lazaret-core/src/records/registry.rs
View file

@ -10,14 +10,14 @@ use super::{
NetworkReadinessEvidence, NetworkReadinessIdentity, Participant, ParticipantOwnership,
ParticipantState, PermittedDestinationObservation, PersistedHostProcessOwnership,
PidfsProcessAuthorityV1, PidfsProcessIdentityV1, PolicyAction, PolicyDelivery, PrefixRule,
PrepareOperation, PreparedArtifact, PreparedLowerOwnership, ProcessOwnershipCommitAck,
ProcessOwnershipMessageVersion, ProtocolCredential, ProtocolCredentialRole,
ProtocolPublicationIdentity, PtyIdentity, PublicationOwnership, ResolvedAutoApprovalRule,
ResolvedVolume, Resolver, ResultStream, SandboxCredentialBundle, SandboxOwnership, Session,
SessionBinding, SessionClose, SessionExit, SessionExitOutcome, SessionRequestCapability,
SessionTerminal, SessionTerminalEvent, SessionTerminalMessage, SessionTerminalState,
SignedProtocolRecord, StagedProcessOwnership, StateAnchorOwnership, StorageCatalog,
StoreMetadata, TerminalInput, TerminalOutput, TerminalResize, TerminalSignal,
PrepareOperation, PrepareStageState, PreparedArtifact, PreparedLowerOwnership,
ProcessOwnershipCommitAck, ProcessOwnershipMessageVersion, ProtocolCredential,
ProtocolCredentialRole, ProtocolPublicationIdentity, PtyIdentity, PublicationOwnership,
ResolvedAutoApprovalRule, ResolvedVolume, Resolver, ResultStream, SandboxCredentialBundle,
SandboxOwnership, Session, SessionBinding, SessionClose, SessionExit, SessionExitOutcome,
SessionRequestCapability, SessionTerminal, SessionTerminalEvent, SessionTerminalMessage,
SessionTerminalState, SignedProtocolRecord, StagedProcessOwnership, StateAnchorOwnership,
StorageCatalog, StoreMetadata, TerminalInput, TerminalOutput, TerminalResize, TerminalSignal,
TerminalSignalKind, TlsCredential, TlsRole, TrustManifest, TrustedHostConfigurationV1,
};
@ -127,7 +127,8 @@ schema_types!(
"ResolvedVolume" => ResolvedVolume,
"ResolvedAutoApprovalRule" => ResolvedAutoApprovalRule,
"DomainStore" => DomainStore,
"StorageCatalog" => StorageCatalog;
"StorageCatalog" => StorageCatalog,
"PrepareStageState" => PrepareStageState;
);
pub const DECLARED_RUNTIME_SCHEMA_TYPE_NAMES: &[&str] = &[

24
crates/lazaret-core/src/records/storage.rs
View file

@ -35,9 +35,29 @@ pub struct PrepareOperation {
pub operation_id: PrepareOperationId,
pub expected_artifact_id: PreparedArtifactId,
pub source_identity: SourceIdentity,
pub selected_manifest_digest: SelectedManifestDigest,
pub policy_id: PolicyId,
pub id_map_digest: IdMapDigest,
pub stage_path: HostPath,
pub device: DeviceId,
pub inode: InodeId,
pub stage_state: PrepareStageState,
pub device: Option<DeviceId>,
pub inode: Option<InodeId>,
}
#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub enum PrepareStageState {
Intent,
Owned,
}
impl PrepareOperation {
#[must_use]
pub const fn has_valid_evidence_shape(&self) -> bool {
matches!(
(self.stage_state, self.device, self.inode),
(PrepareStageState::Intent, None, None) | (PrepareStageState::Owned, Some(_), Some(_))
)
}
}
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]