pulp::inspect::ControlBroker Class Reference

Dormant composition root for the local capability-control broker. More...

#include <control_broker.hpp>

Public Types
using	Clock = ControlIdentityRegistry::Clock

Public Member Functions
	ControlBroker (ControlBrokerConfig config={}, std::shared_ptr< ControlSecurityAuditLog > audit_log={}, Clock clock=[] { return std::chrono::steady_clock::now();})
	The steady clock has the same trusted callback contract as ControlBrokerConfig::wall_clock.
	~ControlBroker ()
	ControlBroker (const ControlBroker &)=delete
ControlBroker &	operator= (const ControlBroker &)=delete
const ControlBrokerId &	broker_id () const
bool	is_listening () const
ControlBootstrapResult	issue_bootstrap (const VerifiedControlPeerIdentity &client_peer)
ControlClientResult	redeem_bootstrap (std::string_view ticket_id, std::span< const std::uint8_t > secret, const VerifiedControlPeerIdentity &client_peer, std::string_view durable_principal={}, ControlDurableClientLifetime durable_lifetime=ControlDurableClientLifetime::Broker)
bool	refresh_client (const ControlClientId &client_id, const VerifiedControlPeerIdentity &client_peer)
ControlBrokerLifecycleResult	disconnect_client (const ControlClientId &client_id, const VerifiedControlPeerIdentity &client_peer, std::string_view decision_id)
ControlRegistrationResult	register_instance (const VerifiedControlPeerIdentity &host_peer, ControlRegistrationRequest request, bool publish=true)
bool	publish_instance (const ControlRegistrationId &registration_id, const VerifiedControlPeerIdentity &host_peer)
bool	heartbeat (const ControlRegistrationId &registration_id, const VerifiedControlPeerIdentity &host_peer)
ControlBrokerLifecycleResult	unregister_instance (const ControlRegistrationId &registration_id, const VerifiedControlPeerIdentity &host_peer, std::string_view decision_id)
ControlGrantResult	issue_grant (const VerifiedControlPeerIdentity &client_peer, ControlGrantRequest request, ControlConsentDecision consent)
ControlGrantStatus	revoke_grant (const ControlGrantId &grant_id, std::string_view decision_id)
bool	is_granted (const ControlGrantId &grant_id, const ControlClientId &client_id, const ControlRegistrationId &registration_id, InspectorCapability capability)
ControlAdmissionResult	admit_operation (const VerifiedControlPeerIdentity &client_peer, const ControlRequestEnvelope &request)
	Atomically resolves every permission term from broker-owned state.
ControlAdmissionResult	replay_operation (const VerifiedControlPeerIdentity &client_peer, const ControlRequestEnvelope &request)
	Reauthorizes and resolves an existing idempotent receipt without creating a fresh admission.
bool	revalidate_operation (const VerifiedControlPeerIdentity &client_peer, const ControlAdmissionPlan &plan)
bool	operation_store_ready () const
bool	artifact_store_ready () const
ControlOperationStoreResult	begin_operation (const VerifiedControlPeerIdentity &client_peer, const ControlAdmissionPlan &plan)
ControlOperationStoreResult	finish_operation (const VerifiedControlPeerIdentity &client_peer, const ControlAdmissionPlan &plan, ControlReceiptState terminal_state, ControlOperationResult result={})
ControlOperationStoreResult	cancel_operation (const VerifiedControlPeerIdentity &client_peer, const ControlClientId &client_id, std::string_view request_id, std::string_view reason)
bool	operation_cancellation_requested (const VerifiedControlPeerIdentity &client_peer, const ControlAdmissionPlan &plan) const
ControlExecutionCheckpoint	execution_checkpoint (const VerifiedControlPeerIdentity &client_peer, const ControlAdmissionPlan &plan)
std::optional< ControlOperationReceipt >	operation_receipt (const ControlReceiptId &receipt_id) const
ControlArtifactStoreResult	store_operation_artifact (const VerifiedControlPeerIdentity &client_peer, const ControlAdmissionPlan &plan, std::span< const std::uint8_t > bytes, ControlArtifactProperties properties)
	Publishes blob and immutable lineage metadata while the producer receipt is Running.
ControlArtifactStoreResult	store_operation_artifact (const VerifiedControlPeerIdentity &client_peer, const ControlAdmissionPlan &plan, std::span< const std::uint8_t > bytes, std::string content_type, ControlArtifactSensitivity sensitivity, ControlArtifactRedactionState redaction_state, std::chrono::milliseconds lifetime)
	Broker-timestamped publication used by trusted operation adapters.
std::size_t	artifact_maximum_blob_bytes () const noexcept
ControlArtifactReadResult	read_artifact (const VerifiedControlPeerIdentity &client_peer, const ControlClientId &requesting_client_id, std::string_view artifact_id, std::uint64_t offset, std::size_t maximum_bytes)
	Retrieves an artifact by opaque ID after broker-side reauthorization of its original producer grant, exact receipt lineage, and exact producing client.
std::optional< ControlClientIdentity >	client (const ControlClientId &client_id) const
std::optional< ControlRegistration >	registration (const ControlRegistrationId &registration_id) const
std::vector< ControlRegistration >	registrations () const
std::optional< ControlGrant >	grant (const ControlGrantId &grant_id)
void	sweep_expired ()

Detailed Description

Dormant composition root for the local capability-control broker.

This object owns identity and grant state, but deliberately owns no listener, service-manager integration, dispatch loop, or runtime activation. Callers must first obtain VerifiedControlPeerIdentity from the credential-bearing local carrier; request payloads cannot construct that type.

Member Typedef Documentation

Clock

using pulp::inspect::ControlBroker::Clock = ControlIdentityRegistry::Clock

Constructor & Destructor Documentation

ControlBroker() [1/2]

pulp::inspect::ControlBroker::ControlBroker ( ControlBrokerConfig config = {}, std::shared_ptr< ControlSecurityAuditLog > audit_log = {}, Clock clock = [] { return std::chrono::steady_clock::now();} )

explicit

The steady clock has the same trusted callback contract as ControlBrokerConfig::wall_clock.

It may run inside broker coordination and must not call this broker or any of its owned stores.

~ControlBroker()

pulp::inspect::ControlBroker::~ControlBroker

(

)

ControlBroker() [2/2]

pulp::inspect::ControlBroker::ControlBroker ( const ControlBroker & )

delete

Member Function Documentation

admit_operation()

ControlAdmissionResult pulp::inspect::ControlBroker::admit_operation	(	const VerifiedControlPeerIdentity &	client_peer,
		const ControlRequestEnvelope &	request )

Atomically resolves every permission term from broker-owned state.

Artifact reads use their producer-lineage reauthorization path instead and can never be admitted by minting an ArtifactRead grant.

artifact_maximum_blob_bytes()

std::size_t pulp::inspect::ControlBroker::artifact_maximum_blob_bytes ( ) const

noexcept

artifact_store_ready()

bool pulp::inspect::ControlBroker::artifact_store_ready

(

)

const

begin_operation()

ControlOperationStoreResult pulp::inspect::ControlBroker::begin_operation	(	const VerifiedControlPeerIdentity &	client_peer,
		const ControlAdmissionPlan &	plan )

broker_id()

const ControlBrokerId & pulp::inspect::ControlBroker::broker_id

(

)

const

cancel_operation()

ControlOperationStoreResult pulp::inspect::ControlBroker::cancel_operation	(	const VerifiedControlPeerIdentity &	client_peer,
		const ControlClientId &	client_id,
		std::string_view	request_id,
		std::string_view	reason )

client()

std::optional< ControlClientIdentity > pulp::inspect::ControlBroker::client

(

const ControlClientId &

client_id

)

const

disconnect_client()

ControlBrokerLifecycleResult pulp::inspect::ControlBroker::disconnect_client	(	const ControlClientId &	client_id,
		const VerifiedControlPeerIdentity &	client_peer,
		std::string_view	decision_id )

execution_checkpoint()

ControlExecutionCheckpoint pulp::inspect::ControlBroker::execution_checkpoint	(	const VerifiedControlPeerIdentity &	client_peer,
		const ControlAdmissionPlan &	plan )

finish_operation()

ControlOperationStoreResult pulp::inspect::ControlBroker::finish_operation	(	const VerifiedControlPeerIdentity &	client_peer,
		const ControlAdmissionPlan &	plan,
		ControlReceiptState	terminal_state,
		ControlOperationResult	result = {} )

grant()

std::optional< ControlGrant > pulp::inspect::ControlBroker::grant

(

const ControlGrantId &

grant_id

)

heartbeat()

bool pulp::inspect::ControlBroker::heartbeat	(	const ControlRegistrationId &	registration_id,
		const VerifiedControlPeerIdentity &	host_peer )

is_granted()

bool pulp::inspect::ControlBroker::is_granted	(	const ControlGrantId &	grant_id,
		const ControlClientId &	client_id,
		const ControlRegistrationId &	registration_id,
		InspectorCapability	capability )

is_listening()

bool pulp::inspect::ControlBroker::is_listening ( ) const

inline

issue_bootstrap()

ControlBootstrapResult pulp::inspect::ControlBroker::issue_bootstrap

(

const VerifiedControlPeerIdentity &

client_peer

)

issue_grant()

ControlGrantResult pulp::inspect::ControlBroker::issue_grant	(	const VerifiedControlPeerIdentity &	client_peer,
		ControlGrantRequest	request,
		ControlConsentDecision	consent )

operation_cancellation_requested()

bool pulp::inspect::ControlBroker::operation_cancellation_requested	(	const VerifiedControlPeerIdentity &	client_peer,
		const ControlAdmissionPlan &	plan ) const

operation_receipt()

std::optional< ControlOperationReceipt > pulp::inspect::ControlBroker::operation_receipt

(

const ControlReceiptId &

receipt_id

)

const

operation_store_ready()

bool pulp::inspect::ControlBroker::operation_store_ready

(

)

const

operator=()

ControlBroker & pulp::inspect::ControlBroker::operator= ( const ControlBroker & )

delete

publish_instance()

bool pulp::inspect::ControlBroker::publish_instance	(	const ControlRegistrationId &	registration_id,
		const VerifiedControlPeerIdentity &	host_peer )

read_artifact()

ControlArtifactReadResult pulp::inspect::ControlBroker::read_artifact	(	const VerifiedControlPeerIdentity &	client_peer,
		const ControlClientId &	requesting_client_id,
		std::string_view	artifact_id,
		std::uint64_t	offset,
		std::size_t	maximum_bytes )

Retrieves an artifact by opaque ID after broker-side reauthorization of its original producer grant, exact receipt lineage, and exact producing client.

Peer identity alone is insufficient because one peer may own multiple client identities.

redeem_bootstrap()

ControlClientResult pulp::inspect::ControlBroker::redeem_bootstrap	(	std::string_view	ticket_id,
		std::span< const std::uint8_t >	secret,
		const VerifiedControlPeerIdentity &	client_peer,
		std::string_view	durable_principal = {},
		ControlDurableClientLifetime	durable_lifetime = ControlDurableClientLifetime::Broker )

refresh_client()

bool pulp::inspect::ControlBroker::refresh_client	(	const ControlClientId &	client_id,
		const VerifiedControlPeerIdentity &	client_peer )

register_instance()

ControlRegistrationResult pulp::inspect::ControlBroker::register_instance	(	const VerifiedControlPeerIdentity &	host_peer,
		ControlRegistrationRequest	request,
		bool	publish = true )

registration()

std::optional< ControlRegistration > pulp::inspect::ControlBroker::registration

(

const ControlRegistrationId &

registration_id

)

const

registrations()

std::vector< ControlRegistration > pulp::inspect::ControlBroker::registrations

(

)

const

replay_operation()

ControlAdmissionResult pulp::inspect::ControlBroker::replay_operation	(	const VerifiedControlPeerIdentity &	client_peer,
		const ControlRequestEnvelope &	request )

Reauthorizes and resolves an existing idempotent receipt without creating a fresh admission.

revalidate_operation()

bool pulp::inspect::ControlBroker::revalidate_operation	(	const VerifiedControlPeerIdentity &	client_peer,
		const ControlAdmissionPlan &	plan )

revoke_grant()

ControlGrantStatus pulp::inspect::ControlBroker::revoke_grant	(	const ControlGrantId &	grant_id,
		std::string_view	decision_id )

store_operation_artifact() [1/2]

ControlArtifactStoreResult pulp::inspect::ControlBroker::store_operation_artifact	(	const VerifiedControlPeerIdentity &	client_peer,
		const ControlAdmissionPlan &	plan,
		std::span< const std::uint8_t >	bytes,
		ControlArtifactProperties	properties )

Publishes blob and immutable lineage metadata while the producer receipt is Running.

finish_operation rejects every artifact handle that was not published through this store first.

store_operation_artifact() [2/2]

ControlArtifactStoreResult pulp::inspect::ControlBroker::store_operation_artifact	(	const VerifiedControlPeerIdentity &	client_peer,
		const ControlAdmissionPlan &	plan,
		std::span< const std::uint8_t >	bytes,
		std::string	content_type,
		ControlArtifactSensitivity	sensitivity,
		ControlArtifactRedactionState	redaction_state,
		std::chrono::milliseconds	lifetime )

Broker-timestamped publication used by trusted operation adapters.

sweep_expired()

void pulp::inspect::ControlBroker::sweep_expired

(

)

unregister_instance()

ControlBrokerLifecycleResult pulp::inspect::ControlBroker::unregister_instance	(	const ControlRegistrationId &	registration_id,
		const VerifiedControlPeerIdentity &	host_peer,
		std::string_view	decision_id )

---

The documentation for this class was generated from the following file:

• /home/runner/work/pulp/pulp/inspect/include/pulp/inspect/control_broker.hpp