orchestrator: Device table is the single source of the chain of trust - #26
Draft
chrysh wants to merge 3 commits into
Draft
orchestrator: Device table is the single source of the chain of trust#26chrysh wants to merge 3 commits into
chrysh wants to merge 3 commits into
Conversation
Kind and failure policy are per-device board policy, so their vocabulary belongs to the device-table schema crate, where boards declare the rest of their boot behavior; the state machine depends on the schema crate and re-exports both types, keeping the reducer's API unchanged while giving the classification a single home next to the table that will declare it. Assisted-by: Claude:claude-fable-5
One fact, one home: what a device is (ComponentKind), what its failure means for the platform (FailurePolicy), and which earlier device it cascades with (depends_on, by name) are board facts, so they belong in the board's device table next to its reset wiring and checkpoints. The new const DeviceTable wrapper is the single place cross-entry invariants are checked — non-empty, within the orchestrator's cursor bound, unique device names, and every dependency naming a strictly earlier entry — so an invalid table is unconstructible and fails the build; per-entry constructors cannot see the whole table, which is why the wrapper owns these checks. The mock board declares its archetypes accordingly: the direct-flash bmc is Passive and Required, the self-updating nic is Active and Isolable. Assisted-by: Claude:claude-fable-5
Holding a DeviceTable is proof of the chain invariants — its const constructor already rejected every malformed table at build time — so Chain::from_table is infallible and ChainError with its TryFrom impl, a second copy of the same rules that could drift into disagreement, is deleted; each invariant now has exactly one checker and the type system carries the proof across the crate boundary. The conversion derives everything: table index becomes the component id (declaration order is walk order), kind and policy are copied, and depends_on names resolve to the ids of their earlier entries. The mock board derives its chain capacity and effect-buffer size from the table and declares the one underivable board fact, the retry budget; its new host test drives table, chain, and orchestrator end to end, checking that the passive bmc release advances the walk speculatively. Reducer tests keep building ad-hoc chains through a cfg(test)-only constructor, so no unchecked door exists in production builds. Assisted-by: Claude:claude-fable-5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR devices.rs config addition to provide chain information to orchestrator-sm
Stacked on
add-boot-walk(PR OpenPRoT#397's branch).Makes the board device table the single source of truth for the orchestrator's chain of trust, and gives every invariant exactly one checker:
ComponentKind/FailurePolicymove intoorchestrator-config; the SM re-exports them (API unchanged).DeviceConfigdeclares kind, failure policy, anddepends_on(by device name); the new constDeviceTablewrapper is the only place cross-entry invariants are checked, so an invalid table fails the build.Chain::from_tablederives the chain from the table (index = id, declaration order = walk order) and is infallible — holding aDeviceTableis the proof — soChainErrorand theTryFromimpl are deleted.DEVICE_COUNT/EFFECT_CAPfrom its table, declaresMAX_RETRY, and gains a host test driving table → chain → orchestrator end to end.https://claude.ai/code/session_014on9N5gJLKpARXtNh4Wzib