lib/machine/src/fault/root.zig

daab053ee43316e1809a84551d573ddd1e5bf3d2

 1 //! Testing how a system survives failure means choosing, at a named place, whether
 2 //! the failure happens, and a replay has to make the same choices the recorded run
 3 //! made. The place has to be named by the state it was derived from, so that the
 4 //! same place in two runs is the same value. A run makes many such choices, and
 5 //! comparing two runs means comparing their whole histories of choices. The choices
 6 //! have to fall into one order together with the inputs the machines receive. Digests
 7 //! of different kinds must never collide, and a stored record can be altered after
 8 //! the fact.
 9 //!
10 //! The namespace names each place where a fault may occur (a *fault point*) by the
11 //! digest of the state it grew from, its kind, and a digest for whatever it targets,
12 //! plus an id that commits the other three. The outcome recorded at such a place
13 //! (a *choice*) is either bypass, which leaves execution untouched, or inject, which
14 //! applies the fault effect. The namespace binds one verified point to the choice
15 //! taken there and carries a digest over the pair (a *fault decision*).
16 //!
17 //! `advance` folds each decision into one running digest (the *fault chain digest*),
18 //! so a single digest stands for an entire fault history and two histories agree
19 //! exactly when their digests agree. Each decision also enters the ordered record
20 //! of every admitted input, settlement, and fault decision across a world's nodes
21 //! (the *ledger*, `Fabric` in the code). There it takes one entry, which advances
22 //! the entry frontier and counts against the same admission budget as an admitted
23 //! input.
24 //!
25 //! Digests are SHA-256, taken under three distinct constant strings hashed before
26 //! the value (each a *domain tag*): one tag each for points, decisions, and the
27 //! chain. Every check hashes the material again and refuses a record whose stored
28 //! digest disagrees with the rebuilt one.
29 //!
30 //! - *fault kind*: one of the eleven fault families a point can name, from a machine
31 //!   crash through a host service failure.
32 
33 const canon = @import("canon.zig");
34 const types = @import("types.zig");
35 
36 pub const Choice = types.Choice;
37 pub const Decision = types.Decision;
38 pub const Dialect = types.Dialect;
39 pub const Error = canon.Error;
40 pub const Kind = types.Kind;
41 pub const Point = types.Point;
42 pub const advance = canon.advance;
43 pub const decide = canon.decide;
44 pub const prepare = canon.prepare;
45 pub const verifyDecision = canon.verifyDecision;
46 pub const verifyPoint = canon.verifyPoint;