Shared command parser and dispatch router.
The engine owns the single argv grammar and returns only sealed terminal outcomes. Cohesive acquisition, doctor, destination, and run-dispatch components own their respective phase ranges. Shared code never writes process streams, halts the VM, or renders arbitrary failures.
Frontend-owned switches such as --envelope are accepted only through a
CommandEntry; the direct prepare/1 and dispatch/1 APIs reject them.
Provider-free and provider-backed run commands complete through the same
owner-backed execution and publication path. Provider-free runs retain
ExecutionSessionOwner while omitting only the provider session.
doctor --connect remains its own active operation. models projects only
public installation declarations and invokes no provider runtime service.
init validates its fixed memory scaffold before atomically publishing a
complete directory without replacing an existing target.
Summary
Functions
Executes one stable command and returns its sealed terminal outcome.
Authorizes a prepared run's destinations at the phase-6 boundary.
Types
@type prepared() :: PtcRunner.Kernel.CommandPreparation.t() | PtcRunner.Kernel.CommandOutcome.t()
Functions
@spec dispatch([binary()]) :: {:ok, PtcRunner.Kernel.CommandOutcome.t()} | {:error, PtcRunner.Kernel.CommandOutcome.t()} | {:envelope_publication_failed, PtcRunner.Kernel.CommandOutcome.t()} | {:envelope_publication_partial, PtcRunner.Kernel.CommandOutcome.t(), [{binary(), term()}]}
Executes one stable command and returns its sealed terminal outcome.
A project run whose envelope reached no destination answers
{:envelope_publication_failed, outcome} instead: the outcome is the run's
own, so a run that already executed is not described as never started, and
the distinct tag is what tells a caller its audit envelope is missing even
when the run itself failed for an unrelated reason. When the run's envelope
reached at least one destination and failed at another, the answer is
{:envelope_publication_partial, outcome, failures}, carrying one
{path, reason} per destination that could not be written: the audit record
survives, so the run's own status is not replaced, and the caller still
learns which copy is missing.
@spec preflight(PtcRunner.Kernel.CommandPreparation.t()) :: {:ok, PtcRunner.Kernel.PublicationAuthority.t()} | {:error, PtcRunner.Kernel.CommandOutcome.t()}
Authorizes a prepared run's destinations at the phase-6 boundary.
@spec prepare([binary()]) :: {:ok, prepared()} | {:error, PtcRunner.Kernel.CommandOutcome.t() | :entropy_unavailable}