Skip to content

Add the runtime trust-generation accept path with the epoch floor (#50) #52

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sehkone merged 3 commits into from
Aug 9, 2026
+1,475 −13
Merged

Add the runtime trust-generation accept path with the epoch floor (#50) #52

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
516d40d
Add the runtime trust-generation accept path
sehkone Aug 9, 2026
09dcda6
Pin the adjacent duplicate as a no-op
sehkone Aug 9, 2026
4cf2d0b
Record the runtime accept path in the changelog
sehkone Aug 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,15 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm

## [Unreleased]

### Added

- The runtime release-trust accept path, which judges a delivered generation
against the **active** generation's trust set and applies the `epoch` floor:
`release_trust::accept_generation` for one delivered generation,
`release_trust::accept_generation_chain` for the ordered replay that catches a
lagging host up, and `release_trust::read_generation_state` for the question a
caller asks before it pushes. A byte-identical redelivery of the active
generation is an unchanged no-op rather than a refusal; anything else must be
strictly newer than the active generation to activate.

[Unreleased]: https://github.com/aicers/deploy-core/commits/main
8 changes: 6 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,12 @@ Product-neutral deploy primitives shared by an installer and an on-host root age
trust set, and the two install-time admission doors — a seed that refuses a
tree already carrying a generation and an operator-mediated replace that does
not — which verify a delivered container against the trust set it carries
before the tree's one crate-internal installer stages it. There is no other
way for a dependent crate to write the tree.
before the tree's one crate-internal installer stages it. Separately it
exports the runtime accept path the control plane pushes over, which judges a
delivered generation against the **active** one's trust set and applies the
`epoch` floor: the state query a caller asks before it pushes, the accept for
one delivered generation, and the ordered chain replay that catches a lagging
host up. There is no other way for a dependent crate to write the tree.
- **engine** — the install/update diff engine (compute what changed).
- **apply** — the apply primitives that actuate a diff on a host (place files,
create directories, run root commands, load images, extract bundles).
Expand Down
Loading
Loading