Module hooks 

The two Phase A hooks (§9, §10): a signed external desired-state source, verified and cached with no producer and no network, and a signed health report emitted locally with the minimal disclosure profile.

Both are Ed25519 over the exact bytes of a JSON document, with a domain tag so a signature for one can never pass as the other. Signatures sit next to the document as <file>.sig: 128 lowercase hex digits.

I/O stays here and in main; the core only receives a verified document (Core::set_external) and hands out the state the report is built from.

Structs

DesiredDoc

The signed document. Its units join the generation’s manifest; a unit the manifest declares is the manifest’s (the generation wins).

ExternalSource

ExternalSourceConfig

services.planarian.externalSource: declared in the generation, so changing it is Security-sensitive (it is under services.planarian).

HealthReport

IncidentSummary

Verified

A document that passed verification, with the bytes it was verified over.

Enums

DisclosureProfile

Computed by the core, never chosen by a requester. Phase A has Minimal only; expanding it is Security-sensitive (it would be a new option under services.planarian).

Poll

Constants

DESIRED_TAG 🔒

HEALTH_TAG 🔒

Functions

emit

Write health-report.json and its signature (local only in Phase A).

health_key

The core’s report key: created on first use, readable by root only. The public half is written beside it for whoever checks the reports.

hex

incident_state 🔒

report

sanitized

What the core takes from an external document’s unit (§9): its desired state and condition. Probes run by the core with privileges (Exec) come only from the administrator’s manifest, and risk is not the document’s to lower: an externally declared unit is Security-sensitive, so acting on it asks first, and the diagnoser follows no edge the document drew.

sig_path 🔒

sign_desired

Sign a desired-state document (for tests and the gym; Phase A has no producer).

status_kind

The variant name of a status, dropping its payload (probe ids, reasons).

tagged 🔒

unhex

verify_report

Check a report against the core’s public key.