Module rollouts

Expand description

Stateless distributor for pre-signed rollout manifests; CP holds no signing key.

Structs§

derive_terminal 🔒: Map a host_rollout_records row to the CLI’s (terminal_state, terminal_at) pair. Open = None.
events 🔒: GET /v1/rollouts/{rolloutId}/events — chronological event-log stream for a rollout (RFC-0005 §10.5 + Plan 04 §“Event log schema”).
hosts 🔒: GET /v1/rollouts/{rolloutId}/hosts — per-host summary for a rollout.
lifecycle 🔒: GET /v1/rollouts/{rolloutId}/lifecycle - supersession state for the rollout, sourced solely from the rollouts table. Returns 404 for any rid not tracked there.
list_active 🔒: GET /v1/rollouts - enumerate active (non-superseded) rollouts with per-host state pulled from host_rollout_state (DB-authoritative, independent of the journal event window).
load_pair 🔒
looks_like_rollout_id 🔒: LOADBEARING: validates the canonical RFC-0008 §6.3 RolloutId shape "{channel}@{channel_ref}" and blocks path-traversal smuggling (/, .., whitespace, multi-@ all fail the character classes). Channel is locked to lowercase ASCII to match the cycle’s convention and avoid case-insensitive-filesystem collisions on macOS hosts; the ref tracks the git SHA shape upstream of the producer.
manifest 🔒: GET /v1/rollouts/{rolloutId} - manifest bytes; mTLS via router-level require_cn_layer.
manifest_paths 🔒
signature 🔒: GET /v1/rollouts/{rolloutId}/sig - raw signature bytes.
try_load_from_dir 🔒