orchestrator: Add the LockdownLatch terminal capability trait - #432
Open
chrysh wants to merge 1 commit into
Open
orchestrator: Add the LockdownLatch terminal capability trait#432chrysh wants to merge 1 commit into
chrysh wants to merge 1 commit into
Conversation
chrysh
force-pushed
the
add-lockdown
branch
2 times, most recently
from
August 19, 2026 19:12
c27dcce to
4276bb1
Compare
chrysh
marked this pull request as ready for review
August 19, 2026 19:37
rusty1968
reviewed
Aug 19, 2026
| /// unlatches it, and latching an already-latched platform succeeds. `Ok` | ||
| /// means the safe state is in force, not merely requested. A failed latch | ||
| /// is a hard fault: the orchestrator has nothing stronger to emit, so the | ||
| /// caller must halt or reset rather than continue. |
Collaborator
There was a problem hiding this comment.
Halt or reset implies we are acting on the eRoT CPU. We are not.
chrysh
force-pushed
the
add-lockdown
branch
2 times, most recently
from
August 20, 2026 10:32
65cc0a4 to
12236a1
Compare
The Effect::LatchLockdown executor has no capability seam. Add LockdownLatch: a one-way latch into the platform safe state, a sticky bit rather than an acquire/release lock. Ok only when the safe state is in force; a failed latch is a hard fault the caller must treat as terminal. Trait only; the platform driver composition follows separately. Assisted-by: Claude:claude-fable-5 Signed-off-by: Christina Quast <christina.quast@9elements.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Effect::LatchLockdownis the one SM effect at the top of the escalation ladder with no capability seam. AddLockdownLatch: a one-way latch into the platform safe state, a sticky bit rather than an acquire/release lock.Contract:
Okmeans the safe state is in force (not queued), a failed latch is a hard fault the caller must treat as terminal, latching an already-latched platform isOk, and only a platform reset exits.Trait only; the platform driver composition follows now that the driver crate (#418) has landed.
Part of 9elements#3
Related: #385 — whether Locked should be terminal.