Opsmaru.Incus.Operations (opsmaru_incus v0.1.0)

Shared, protocol-neutral Incus operations for agents and direct callers.

Each operation is an Opsmaru.Incus.Operations.Descriptor with a canonical incus_<resource>_<verb> name, input/output JSON schemas, a required scope, a destructive-confirmation rule and bounds. all/0 lists the exported operations; one whose client methods lack recorded evidence is never exported and appears in unavailable/0 instead.

run/3 executes one operation synchronously in the caller's process:

the host-verified :scopes must include the operation's scope;
input must match the input schema and byte bounds;
destructive operations require confirm to repeat the affected resource;
restricted create/update input needs the host's allow_restricted?/3;
the host's binding/2 and authorize/3 must succeed.

Only then does the operation contact the backend, through the public Opsmaru.Incus client. A denial at any step makes no backend request. Nothing here starts a process, opens a connection or stores state; see Opsmaru.Incus.Operations.Host for the host contract.

Summary

Functions

all()

Exported descriptors in canonical name order.

describe(descriptor)

Public contract of a descriptor as JSON-safe data: name, title, description, scope, destructive flag, confirmation rule, bounds, schemas and evidence.

fetch(name)

Fetch an exported descriptor by canonical name.

output_schema(descriptor)

The full output schema: the success result or an error object.

run(name, input, opts)

Run an exported operation. Options (all host-supplied, never tool input)

scopes()

The four scopes operations require.

unavailable()

Operations not exported: deferred by scope, or missing client evidence (with the missing requirements).