pulp::inspect::ControlHostEnrollmentStore Class Reference

Bounded, process-local enrollment registry. More...

#include <control_host_enrollment.hpp>

Public Types
using	Clock = std::function<std::chrono::steady_clock::time_point()>
	Invoked under the store mutex; it must be bounded, non-blocking, and non-reentrant.

Public Member Functions
	ControlHostEnrollmentStore (ControlHostEnrollmentStoreConfig config={}, Clock clock=[] { return std::chrono::steady_clock::now();})
	~ControlHostEnrollmentStore ()
	ControlHostEnrollmentStore (const ControlHostEnrollmentStore &)=delete
ControlHostEnrollmentStore &	operator= (const ControlHostEnrollmentStore &)=delete
ControlHostEnrollmentResult	create (ControlTrustedHostSnapshot snapshot, const VerifiedControlPeerIdentity &preobserved_child, std::uint64_t current_broker_generation, std::chrono::steady_clock::time_point expires_at)
	preobserved_child must come from kernel evidence on an endpoint-owned private rendezvous.
std::optional< ControlHostEnrollmentPlan >	consume (std::string_view enrollment_id)
std::size_t	sweep ()
std::size_t	size () const

Detailed Description

Bounded, process-local enrollment registry.

create() accepts only a previously consumed trusted inventory snapshot, and consume() burns the claim atomically before any live peer validation occurs. The endpoint never holds this store's mutex while observing a peer or entering broker, admission-store, or router coordination.

Member Typedef Documentation

Clock

using pulp::inspect::ControlHostEnrollmentStore::Clock = std::function<std::chrono::steady_clock::time_point()>

Invoked under the store mutex; it must be bounded, non-blocking, and non-reentrant.

Constructor & Destructor Documentation

ControlHostEnrollmentStore() [1/2]

pulp::inspect::ControlHostEnrollmentStore::ControlHostEnrollmentStore ( ControlHostEnrollmentStoreConfig config = {}, Clock clock = [] { return std::chrono::steady_clock::now();} )

explicit

~ControlHostEnrollmentStore()

pulp::inspect::ControlHostEnrollmentStore::~ControlHostEnrollmentStore

(

)

ControlHostEnrollmentStore() [2/2]

pulp::inspect::ControlHostEnrollmentStore::ControlHostEnrollmentStore ( const ControlHostEnrollmentStore & )

delete

Member Function Documentation

consume()

std::optional< ControlHostEnrollmentPlan > pulp::inspect::ControlHostEnrollmentStore::consume

(

std::string_view

enrollment_id

)

create()

ControlHostEnrollmentResult pulp::inspect::ControlHostEnrollmentStore::create	(	ControlTrustedHostSnapshot	snapshot,
		const VerifiedControlPeerIdentity &	preobserved_child,
		std::uint64_t	current_broker_generation,
		std::chrono::steady_clock::time_point	expires_at )

preobserved_child must come from kernel evidence on an endpoint-owned private rendezvous.

A PID-only post-spawn callback cannot satisfy this contract because macOS audit pidversion is available only from the connected peer's audit token.

operator=()

ControlHostEnrollmentStore & pulp::inspect::ControlHostEnrollmentStore::operator= ( const ControlHostEnrollmentStore & )

delete

size()

std::size_t pulp::inspect::ControlHostEnrollmentStore::size

(

)

const

sweep()

std::size_t pulp::inspect::ControlHostEnrollmentStore::sweep

(

)

---

The documentation for this class was generated from the following file:

• /home/runner/work/pulp/pulp/inspect/include/pulp/inspect/control_host_enrollment.hpp