Struct Executor 

pub struct Executor<B: Backends + Clone, S: Store> {
    pub kernel: Kernel<S, ExecHost<B>>,
    pub b: B,
    pub cfg: Config,
    pub session: Session,
    pub parked: BTreeMap<TxnId, Parked>,
    pub last: Option<(DerivedFacts, Decision)>,
    pub excluded: Vec<String>,
    pub prebuilt: Option<Prebuilt>,
    pub floor_raised: Option<(GenerationId, Vec<String>)>,
    pub(crate) waiting: BTreeMap<TxnId, (Timestamp, Plan)>,
}

Fields

kernel: Kernel<S, ExecHost<B>>

b: B

cfg: Config

session: Session

parked: BTreeMap<TxnId, Parked>

last: Option<(DerivedFacts, Decision)>

The derived facts and decision of the last submission that got that far, for the executor log (I7).

excluded: Vec<String>

Untracked owner files the last submission’s staging left out (§9 step 1: Nix does not see them; they are reported, never an error).

prebuilt: Option<Prebuilt>

The result of a PrebuildJob run off the daemon’s core thread; the next submit of the same transition uses it if the live override file is still the one it was built from.

floor_raised: Option<(GenerationId, Vec<String>)>

Set when the last commit raised the security floor (§12e): the generation and the packages it fixed, for the daemon to report.

waiting: BTreeMap<TxnId, (Timestamp, Plan)>

Generation transactions waiting in Built for an activation window (§12f), with when each began waiting (CLOCK_BOOTTIME).

Implementations

impl<B: Backends + Clone, S: Store> Executor<B, S>

pub fn new(journal: Journal<S>, b: B, me: OwnerId, cfg: Config) -> Self

pub fn policy_version(&self) -> PolicyVersion

pub fn adopt_current(&self)

At startup: make sure the running generation’s override content is recorded, so a later Rollback to it can restore it.

pub fn update_context(&mut self, ctx: Context, protect: Vec<GenerationId>)

Keep the probe-run baselines and the GC protected set current.

pub(crate) fn eval_of( &self, g: GenerationId, ) -> Result<EvaluatedGeneration, String>

pub(crate) fn plan( &self, p: &Proposal, authz: &Authorization, state: &SystemState, defs: &UnitDefs, prebuilt: Option<Prebuilt>, ) -> Result<Plan, Submitted>

pub(crate) fn facts_of( &self, plan: &Plan, state: &SystemState, defs: &UnitDefs, ) -> DerivedFacts

§11: the facts of a plan, from the current observation.

pub(crate) fn decision_of(&self, plan: &Plan, state: &SystemState) -> Decision

pub(crate) fn revalidate( &mut self, id: TxnId, plan: &Plan, state: &SystemState, defs: &UnitDefs, ) -> Option<Submitted>

C2 (§9 step 6, I8): a transaction leaving Built for Activating is checked again as on the way in: the owner’s source and the override file are as it was built from, and the decision made again from the facts derived now is the one it was admitted with. Otherwise it ends Rejected (Stale) and is asked for again. None when it may go on.

pub(crate) fn plan_existing( &self, plan: &mut Plan, g: GenerationId, live_hash: Hash, ) -> Result<Option<OverrideSet>, Submitted>

Equivalent effects, equivalent facts (§11, R04): an existing generation’s facts come from its dry activation and the override content recorded for it, as a built candidate’s do. Returns that content, if one was recorded.

pub(crate) fn release(&self, plan: &Plan)

pub(crate) fn binding( &self, txn: TxnId, p: &Proposal, plan: &Plan, state: &SystemState, ) -> Hash

What the approval token binds (§8 ApprovalToken.bound_to). It names the transaction too, so each request for approval has its own: an approval issued before a restart can never approve the change asked for again after it, however identical (§12 step 4, S07).

pub(crate) fn transaction( &self, p: &Proposal, plan: &Plan, state: &SystemState, defs: &UnitDefs, ) -> Transaction

pub(crate) fn stale(&self, plan: &Plan) -> bool

§9 step 6: the owner’s Nix-visible source must still hash to base_source.

pub(crate) fn kernel_error(e: KernelError) -> Submitted

pub fn prebuild_job(&self, t: &Transition) -> Option<PrebuildJob<B::Gens>>

where B::Gens: Clone,

The slow part of planning t, to run elsewhere: Some for a catalog change, whose staging, evaluation and build can take minutes. Hand its result to prebuilt before submitting t.

pub fn admit( &self, t: &Transition, authz: &Authorization, ) -> Result<(), (RejectReason, &'static str)>

Admission before work (§12, R09): the checks that need no staged source, run before anything is staged, evaluated or built. Each is a necessary condition of decide’s authorization, so admission refuses only what policy would refuse after the build.

pub fn submit( &mut self, p: Proposal, authz: Authorization, state: &SystemState, defs: &UnitDefs, ) -> Submitted

Submit a proposal. state and defs are the current observation.

pub fn submit_again( &mut self, p: Proposal, from: TxnId, authz: Authorization, state: &SystemState, defs: &UnitDefs, ) -> Submitted

§12f: submit p as preparing again from, a transaction a rollback withdrew. The link is journaled with the new transaction (Transaction.prepared_again_from). Core only: it is not in Proposal, which callers build, so no caller can name a withdrawn transaction and keep it from being prepared again.

pub(crate) fn submit_from( &mut self, p: Proposal, authz: Authorization, state: &SystemState, defs: &UnitDefs, again: Option<TxnId>, ) -> Submitted

pub(crate) fn schedule( &mut self, id: TxnId, plan: Plan, source: &Source, state: &SystemState, ) -> Submitted

§12f: a generation candidate that takes effect only at boot takes the boot-only path; one that would disturb a session, or any while foreground work holds, waits in Built for an activation window (activate_waiting); everything else runs now.

Rollbacks (owner decisions, Oct 31 and Nov 2): a rollback never waits. One the user or an Intent asks for (Rollback, or planarian undo’s Revert) is its own window, also under Foreground; the diagnoser’s Rollback is a repair. The §11 floors were applied before this, so either may have been parked for approval first; this is reached once it is admitted and, if it asked, approved. At that moment, and only then, every generation transaction waiting in Built is withdrawn for it (Rejected(Interrupted), I6); the daemon prepares each again once the rollback is terminal. Quiet mode’s deferral of an unrelated repair rollback is the repair loop’s.

pub(crate) fn disturbs_a_session(&self, a: &ActivationPlan) -> bool

The activation would restart or reload something an active user session uses (§12f): a user unit, or one whose restart drops a session.

pub(crate) fn sessions_idle(&self) -> bool

pub fn activate_waiting( &mut self, state: &SystemState, defs: &UnitDefs, ) -> Vec<(TxnId, Submitted)>

Activate transactions waiting in Built whose window has opened: no foreground work, and the sessions idle (or the change does not disturb one). Returns what ran.

pub(crate) fn run(&mut self, id: TxnId, plan: &Plan) -> Submitted

pub(crate) fn after( &mut self, id: TxnId, plan: &Plan, end: &TxnState, ) -> Option<Proposal>

Bookkeeping after a terminal state; returns a §12a write-back, if any.

pub fn approve( &mut self, hash: &Hash, approver: &Authorization, state: &SystemState, defs: &UnitDefs, ) -> Submitted

planarian approve <hash> (§12 step 4): re-derive, re-decide, rebind. The caller has checked root and an interactive TTY (Phase A).

pub(crate) fn expire_one(&mut self, txn: TxnId) -> Submitted

pub fn expire(&mut self) -> Vec<TxnId>

Tokens expire after 24 h (§12 step 4); the parked transaction ends Rejected.

pub fn is_waiting(&self, txn: TxnId) -> bool

The transaction waits in Built for an activation window (§12f).

pub fn waiting_since(&self, txn: TxnId) -> Option<Timestamp>

When the transaction began waiting in Built (CLOCK_BOOTTIME).

pub fn keep_waiting_since(&mut self, txn: TxnId, since: Timestamp)

§12f, I12: a change withdrawn for a rollback and prepared again keeps the parking limit it had, from the earlier of the two times.

pub fn expire_waiting(&mut self) -> Vec<(TxnId, Transition)>

§12f, I12: parking in Built is bounded. A transaction that has waited longer than the parking limit is Cancelled(Daemon); returns each one with the change it would have made, for the notice.

pub fn cancel(&mut self, txn: TxnId, by: Actor) -> Submitted

A user withdraws a parked proposal (§12 step 5).