managed

Module: runtime::managed

Contents

Structs

• ManagedRunInput - A run the Control Plane reserved and activated: the Agent, the run

Functions

• execute_managed_run - Runs input.command as the run the Control Plane activated.
• preflight_managed_run - Checks the managed profile’s effective backend before reserving a run.

---

firma_run::runtime::managed::ManagedRunInput

Struct

A run the Control Plane reserved and activated: the Agent, the run it runs as, and what the Sidecar needs to authenticate to the Authority.

Fields:

• agent_id: firma_identifiers::AgentId - The Agent being run.
• profile: firma_config_loader::AgentProfile - The OpenFirma profile the Control Plane configured for it.
• run_id: firma_identifiers::RunId - The reserved run; the run’s session id.
• sidecar_id: firma_identifiers::SidecarId - The Sidecar identity activation issued for this run alone.
• workspace_id: firma_identifiers::WorkspaceId - The Workspace the Agent belongs to.
• authority_grpc_uri: url::Url - Where the Sidecar and the capability mint reach the Authority’s gRPC
• capability_public_key: [u8; 32] - The Workspace’s Ed25519 capability verifying key, raw 32 bytes.
• credential: secrecy::SecretString - The runtime credential activation issued; the Sidecar alone receives
• command: Vec<String> - The workload command.

firma_run::runtime::managed::execute_managed_run

Function

Runs input.command as the run the Control Plane activated.

Everything execute_run does with a project firma.toml, except that the Agent identity, the profile, the Authority and the credential come from the Control Plane, and nothing under .firma/ is read or written.

The [RunCompletion] keeps the command’s result apart from cleanup, so the caller can report how the run ended even when cleanup failed.

fn execute_managed_run(input: ManagedRunInput, hooks: &super::LaunchHooks) -> super::RunCompletion

firma_run::runtime::managed::preflight_managed_run

Function

Checks the managed profile’s effective backend before reserving a run. No sandbox or run marker is created.

Errors

Returns profile, host-support, or network opt-in errors.

fn preflight_managed_run(profile: firma_config_loader::AgentProfile) -> Result<(), crate::error::RunError>