routing

Module: routing

Contents

Structs

• AutostartFlags - Inputs to [prepare_network_runtime] that gate autostart behaviour.
• EnvOverrides
• NetworkRuntime - Runtime-side network artifacts that must live while the wrapped process runs.
• ResolveAuthorityRequest - Inputs used to resolve the Authority for one firma run invocation.
• ResolvedAuthority - Resolved Authority for the current run.

Functions

• prepare_network_runtime - Prepare network runtime artifacts for a sandbox launch.
• resolve_authority - Step 0: resolve the Authority before any sidecar work.

---

firma_run::routing::AutostartFlags

Struct

Inputs to [prepare_network_runtime] that gate autostart behaviour.

Fields:

• sidecar_autostart: bool - true when the selection resolved to local autostart.
• no_autostart: bool
• template_path: Option<std::path::PathBuf>
• startup_timeout: std::time::Duration
• authority_url: Option<String> - Effective Authority URL — set by resolve_authority and threaded
• authority_ca_cert: Option<std::path::PathBuf> - Path to the CA cert that signed the authority’s TLS cert — injected
• authority_pub_key: Option<std::path::PathBuf> - Path to the authority’s Ed25519 public key — injected into
• authority_credentials: Option<firma_sidecar::authority_credentials::SidecarCredentialsConfig> - Sidecar credential config injected into [sidecar.authority.credentials]
• capability_seed_path: Option<std::path::PathBuf> - Path of the per-session capability seed minted by firma run.
• use_http_proxy_sidecar: bool - When true, the autostarted sidecar is started in HTTP proxy
• monitor_mode: bool - When true, inject mode = "monitor" into the synthesized sidecar

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Default
  • fn default() -> Self
• Clone
  • fn clone(self: &Self) -> AutostartFlags

firma_run::routing::EnvOverrides

Struct

Tuple Struct: ()

Trait Implementations:

• From
  • fn from(value: BTreeMap<String, String>) -> Self
• Default
  • fn default() -> EnvOverrides
• Deref
  • fn deref(self: &Self) -> &<Self as >::Target

firma_run::routing::NetworkRuntime

Struct

Runtime-side network artifacts that must live while the wrapped process runs.

firma_run::routing::ResolveAuthorityRequest

Struct

Inputs used to resolve the Authority for one firma run invocation.

Generic Parameters:

• ‘a

Fields:

• identity: &'a crate::identity::RunIdentity - Identity assigned to this run.
• flags: &'a AutostartFlags - Autostart behavior selected for this run.
• cli: &'a crate::authority::AuthorityCli - Authority selection supplied by the CLI.
• profile_name: &'a str - Authority profile used when autostarting a local Authority.
• user_config_path: Option<&'a std::path::Path> - Resolved firma.toml path, when one exists.
• user_config_dir: Option<&'a std::path::Path> - Directory containing the resolved firma.toml, when one exists.
• firma_exe: &'a std::path::Path - Current firma executable used to autostart the Authority.
• capability_public_key_path: Option<&'a std::path::Path> - Capability-specific verification key, which takes precedence over the
• working_dir: &'a std::path::Path - Working directory used to resolve a relative capability-specific key.

Traits: Copy

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> ResolveAuthorityRequest<'a>

firma_run::routing::ResolvedAuthority

Struct

Resolved Authority for the current run.

Fields:

• url: String
• ca_cert_path: Option<std::path::PathBuf> - CA cert path from [sidecar.authority], if present.
• pub_key_path: Option<std::path::PathBuf> - Effective Authority public key used to verify issued capabilities.
• credentials: Option<firma_sidecar::authority_credentials::ResolvedSidecarCredentials> - Resolved credentials used by firma run when issuing a capability.
• credentials_config: Option<firma_sidecar::authority_credentials::SidecarCredentialsConfig> - Unresolved credentials config passed to an autostarted Sidecar.

firma_run::routing::prepare_network_runtime

Function

Prepare network runtime artifacts for a sandbox launch.

When flags.sidecar_autostart == true (local selection), autostarts a per-run Sidecar through firma-process-orchestrator and substitutes its readiness-validated endpoint into the returned [NetworkRuntime]. The running stack is retained until explicit shutdown after the agent exits.

Errors

• [RunError::SidecarUnreachable] when the endpoint is unreachable and autostart is disabled.
• [RunError::RunComponentOrchestration] when the autostarted Sidecar fails to publish readiness or orchestration otherwise fails.
• [RunError::UnsupportedPlatform] when autostart is required on a platform that does not support it.
• [RunError::Backend] for adapter socket failures.

fn prepare_network_runtime(runtime_layout: &firma_runtime_state::RuntimeLayout, handle: &crate::backend::SandboxHandle, proof: &crate::backend::EnforcementProof, sidecar_endpoint: &crate::config::SidecarEndpoint, identity: &crate::identity::RunIdentity, flags: &AutostartFlags, authority: ResolvedAuthority, capability_lease: &crate::config::CapabilityLeaseConfig) -> Result<NetworkRuntime, crate::error::RunError>

firma_run::routing::resolve_authority

Function

Step 0: resolve the Authority before any sidecar work.

CLI > persisted > prompt (only when both empty and TTY). On Local selection, probe [authority].listen_addr (default [::1]:50051); on miss, retain a lazy owned-Authority plan for the run component orchestrator. Local mode is a dev convenience path and intentionally uses plaintext loopback (http://), not TLS/mTLS.

Errors

Propagates any RunError raised by selection or spawn paths.

fn resolve_authority(request: ResolveAuthorityRequest, prompt: & mut dyn crate::authority::AuthorityPromptIo) -> Result<ResolvedAuthority, crate::error::RunError>