Trait UnitBackend 

pub trait UnitBackend {
    // Required methods
    fn observe(&self, id: &UnitId) -> Result<Observed, Outcome>;
    fn list(&self) -> Result<Vec<UnitId>, Outcome>;
    fn restart(&self, id: &UnitId, op: &OpId) -> Outcome;
    fn stop(&self, id: &UnitId, op: &OpId) -> Outcome;

    // Provided methods
    fn ended_by(&self, _id: &UnitId) -> Option<Ending> { ... }
    fn auto_restarts(&self, _id: &UnitId) -> Option<u32> { ... }
    fn foreign_units(&self) -> Vec<String> { ... }
    fn protecting(&self, _tools: &[UnitId]) -> Result<BTreeSet<UnitId>, Outcome> { ... }
    fn start_agent(
        &self,
        _name: &str,
        _argv: &[String],
        _limits: &AgentLimits,
    ) -> Result<InstanceId, Outcome> { ... }
    fn agent_running(&self, _name: &str) -> bool { ... }
    fn hold(&self, _unit: &UnitId, _wait: Millis) -> Outcome { ... }
    fn lift_hold(&self, _unit: &UnitId, _wait: Millis) -> Outcome { ... }
    fn held(&self) -> Result<BTreeSet<UnitId>, Outcome> { ... }
    fn release_hold(
        &self,
        _unit: &UnitId,
        _until: Option<Timestamp>,
        _wait: Millis,
    ) -> Outcome { ... }
    fn end_release(&self, _unit: &UnitId) -> Outcome { ... }
    fn hold_table_present(&self, _wait: Millis) -> Result<bool, Outcome> { ... }
    fn reapply_hold(&self, unit: &UnitId, wait: Millis) -> Outcome { ... }
}

Required Methods

fn observe(&self, id: &UnitId) -> Result<Observed, Outcome>

fn list(&self) -> Result<Vec<UnitId>, Outcome>

fn restart(&self, id: &UnitId, op: &OpId) -> Outcome

fn stop(&self, id: &UnitId, op: &OpId) -> Outcome

Provided Methods

fn ended_by(&self, _id: &UnitId) -> Option<Ending>

How the unit’s main process last ended; None if the backend cannot say.

fn auto_restarts(&self, _id: &UnitId) -> Option<u32>

How many times systemd itself restarted the unit (NRestarts); None if the backend cannot say.

fn foreign_units(&self) -> Vec<String>

The boot report’s unit check (§10): active units whose definition does not come from the running generation (a file outside the store that is not a generator’s).

fn protecting(&self, _tools: &[UnitId]) -> Result<BTreeSet<UnitId>, Outcome>

§12d “Which units”: which of the network tools tools are protecting traffic now, from netwatch’s kernel-attributed footprints, with every unknown counted as protecting (fail closed). Err means netwatch could not be read at all; a caller counts every tool as protecting then. The default is that error: a backend without netwatch never waives a hold.

fn start_agent( &self, _name: &str, _argv: &[String], _limits: &AgentLimits, ) -> Result<InstanceId, Outcome>

Start an agent (§11, §16): the transient unit planarian-agent-<name>, under a dynamic uid of its own. Returns the started unit’s instance (its InvocationID), read back once it has started (I24).

fn agent_running(&self, _name: &str) -> bool

Whether an agent’s unit under this name is loaded and running (I24: agent run refuses a name in use).

fn hold(&self, _unit: &UnitId, _wait: Millis) -> Outcome

§12d Network security fails closed: hold the traffic a failed network-security unit protected (planarian-hold@<unit>). A failure posture response, not a transition: no Prepared, no lease (it only ever restricts traffic; docs/bypasses.md). Idempotent. Unlike the other mutations here it takes no OpId; the daemon journals HoldApplied before calling it.

Every hold call here runs on the daemon’s tick (or a request on its core) and waits at most wait: past it the call returns Unknown (or, for hold_table_present, an error: cannot say), and what it started goes on in the host. A hold not confirmed within wait counts as held; the socket, approvals and repairs are never stalled for a stuck systemctl (reviewer, #61).

fn lift_hold(&self, _unit: &UnitId, _wait: Millis) -> Outcome

Lift a unit’s hold, once it is Running and its Readiness probes pass (journaled HoldLifted first). Idempotent. At most wait.

fn held(&self) -> Result<BTreeSet<UnitId>, Outcome>

The units whose traffic is held now, as the host says (§12d: the hold survives a restart of planariad). An error means “cannot say”, never “none”.

fn release_hold( &self, _unit: &UnitId, _until: Option<Timestamp>, _wait: Millis, ) -> Outcome

planarian hold release (an attested Override, decided before this): mark the unit’s hold released until until (None: the next boot), then lift it, waiting at most wait. While the mark stands, a new failure does not hold.

fn end_release(&self, _unit: &UnitId) -> Outcome

The release ended (expired, or the override lifted): remove the mark.

fn hold_table_present(&self, _wait: Millis) -> Result<bool, Outcome>

Whether the hold’s nftables table is in place. Anything else that flushes the ruleset (nft flush ruleset) removes it and would fail open; the daemon checks this while a hold is active. An error means “cannot say” (also past wait).

fn reapply_hold(&self, unit: &UnitId, wait: Millis) -> Outcome

Build a unit’s hold again (the table was removed under it): restart its hold unit, since starting an active one does nothing. At most wait.

Implementors