[ac-pplx]

Summary

crates/libs/metrics/src/sandbox/worker.rs (1,406 code lines) is keyed by emitter: every sandbox-manager feature appends its metric family here. This moves each family into its own module, so new families get a module of their own instead of growing this file. worker.rs drops to 66 code lines; the largest new file is route_authorization.rs at 239.

This is a pure move, generated by scripts/split_rust_module.py (#562) from the spec below and proved by its verify. It is part of splitting the largest production modules into smaller ones with one job each.

What moved where

Module	Holds	Code lines
guest_bridge	The spaced guest bridge: RPC results, latency and timeouts, guest readiness, the activation environment, guest flushes on stop, and observed guest specs.	126
route_authorization	Route authorization: Space API route tokens, endpoint attestation, route streams and route identity adoption.	239
net_gateway	The net-gateway as sbx-mgr sees it: route verification bundles, route security pushes, liveness, inventory and sync cycles.	200
teardown_suspend	Teardown suspend: prepare outcomes and driver capacity.	42
auto_lifecycle	The auto-lifecycle scheduler and its delete admission and outbox.	214
cleanup	Cleanup: the cleanup queue, activation cleanup, runtime stops, cgroups and local artifact metadata.	59
quarantine_recovery	Quarantine entry and recovery.	107
inventory	Inventory: list budgets, lifecycle counts, orphan rows and inventory reconciliation.	172
health	Sandbox health: probes, status, transitions, raw vsock checks and evidence reports.	168
ingress	Ingress protection and admission, including service-port ingress rejections.	43
worker.rs (parent)	the execution_release_decision family, which has no caller (a separate deletion)	66

How to check it

The spec (item names, not lines):

file = "crates/libs/metrics/src/sandbox/worker.rs"

[[module]]
name = "guest_bridge"
doc = "The spaced guest bridge: RPC results, latency and timeouts, guest readiness, the activation environment, guest flushes on stop, and observed guest specs."
items = [
  "enum SpacedBridgeRpcResult",
  "impl SpacedBridgeRpcResult",
  "impl * for SpacedBridgeRpcResult",
  "fn spaced_guest_ready",
  "fn activation_env_attempt",
  "fn spaced_guest_readiness_wait",
  "fn spaced_bridge_rpc_latency",
  "fn stop_guest_flush",
  "fn spaced_bridge_rpc_timeout",
  "fn guest_observed_specs",
]

[[module]]
name = "route_authorization"
doc = "Route authorization: Space API route tokens, endpoint attestation, route streams and route identity adoption."
items = [
  "enum SpaceApiRouteTokenAuthorizationResult",
  "impl SpaceApiRouteTokenAuthorizationResult",
  "impl * for SpaceApiRouteTokenAuthorizationResult",
  "enum SpaceApiRouteTokenAuthorizationDisposition",
  "impl SpaceApiRouteTokenAuthorizationDisposition",
  "enum SpacedEndpointAttestationResult",
  "impl SpacedEndpointAttestationResult",
  "enum RouteStreamCloseReason",
  "impl RouteStreamCloseReason",
  "enum RouteIdentityAdoptionOutcome",
  "impl RouteIdentityAdoptionOutcome",
  "enum RouteIdentityAdoptionReason",
  "impl RouteIdentityAdoptionReason",
  "impl * for RouteIdentityAdoptionReason",
  "struct RouteIdentityAdoptionReasonParseError",
  "fn space_api_route_token_authorization",
  "fn spaced_endpoint_attestation",
  "fn route_stream_closed",
  "fn route_identity_adoption",
]

[[module]]
name = "net_gateway"
doc = "The net-gateway as sbx-mgr sees it: route verification bundles, route security pushes, liveness, inventory and sync cycles."
items = [
  "enum RouteVerificationBundleReloadResult",
  "impl RouteVerificationBundleReloadResult",
  "impl * for RouteVerificationBundleReloadResult",
  "enum NetGatewayRouteVerificationStatus",
  "impl NetGatewayRouteVerificationStatus",
  "impl * for NetGatewayRouteVerificationStatus",
  "enum NetGatewayRouteSecurityPushOperation",
  "impl NetGatewayRouteSecurityPushOperation",
  "impl * for NetGatewayRouteSecurityPushOperation",
  "enum NetGatewayRouteSecurityPushOutcome",
  "impl NetGatewayRouteSecurityPushOutcome",
  "impl * for NetGatewayRouteSecurityPushOutcome",
  "enum NetGatewayTlsInterceptionMode",
  "impl NetGatewayTlsInterceptionMode",
  "enum NetGatewayCycleResult",
  "impl NetGatewayCycleResult",
  "impl * for NetGatewayCycleResult",
  "fn route_verification_bundle_reload",
  "fn route_verification_bundle_generation",
  "fn net_gateway_route_verification",
  "fn net_gateway_route_security_push",
  "const NET_GATEWAY_SHA_UNKNOWN",
  "const NET_GATEWAY_INVENTORY_UNKNOWN",
  "fn net_gateway_live",
  "fn net_gateway_inventory",
  "fn net_gateway_cycle",
]

[[module]]
name = "teardown_suspend"
doc = "Teardown suspend: prepare outcomes and driver capacity."
items = [
  "enum TeardownSuspendPrepareOutcome",
  "impl TeardownSuspendPrepareOutcome",
  "impl * for TeardownSuspendPrepareOutcome",
  "fn teardown_suspend_prepare",
  "fn teardown_suspend_driver_capacity",
  "fn teardown_suspend_driver_saturated",
]

[[module]]
name = "auto_lifecycle"
doc = "The auto-lifecycle scheduler and its delete admission and outbox."
items = [
  "enum AutoLifecycleDeleteAdmissionDisposition",
  "impl AutoLifecycleDeleteAdmissionDisposition",
  "impl * for AutoLifecycleDeleteAdmissionDisposition",
  "enum AutoLifecycleDeleteAdmissionReason",
  "impl AutoLifecycleDeleteAdmissionReason",
  "impl * for AutoLifecycleDeleteAdmissionReason",
  "enum AutoLifecycleDeleteOutboxState",
  "impl AutoLifecycleDeleteOutboxState",
  "impl * for AutoLifecycleDeleteOutboxState",
  "struct AutoLifecycleDeleteAdmissionDispositionParseError",
  "struct AutoLifecycleDeleteAdmissionReasonParseError",
  "struct AutoLifecycleDeleteOutboxStateParseError",
  "fn auto_lifecycle_scheduler_saturated",
  "fn auto_lifecycle_transition_lateness",
  "fn auto_lifecycle_retries_exhausted",
  "fn auto_lifecycle_delete_admission",
  "fn auto_lifecycle_delete_outbox_depth",
  "fn auto_lifecycle_delete_outbox_oldest_age_secs",
  "fn auto_lifecycle_delete_outbox_max_attempt_count",
  "fn auto_lifecycle_delete_blocked",
]

[[module]]
name = "cleanup"
doc = "Cleanup: the cleanup queue, activation cleanup, runtime stops, cgroups and local artifact metadata."
items = [
  "enum ActivationCleanupOutcome",
  "impl ActivationCleanupOutcome",
  "impl * for ActivationCleanupOutcome",
  "fn cleanup_active",
  "fn cleanup_queue_depth",
  "fn cleanup_retry",
  "fn activation_cleanup",
  "fn runtime_stop_failed",
  "fn leaked_cgroups",
  "fn cgroups_reclaimed",
  "fn local_artifact_metadata_pruned",
]

[[module]]
name = "quarantine_recovery"
doc = "Quarantine entry and recovery."
items = [
  "enum QuarantineRecoveryAttemptOutcome",
  "impl QuarantineRecoveryAttemptOutcome",
  "impl * for QuarantineRecoveryAttemptOutcome",
  "enum QuarantineRecoveryOutcome",
  "impl QuarantineRecoveryOutcome",
  "impl * for QuarantineRecoveryOutcome",
  "fn quarantine_entered",
  "fn quarantine_recovery_*",
]

[[module]]
name = "inventory"
doc = "Inventory: list budgets, lifecycle counts, orphan rows and inventory reconciliation."
items = [
  "enum OrphanRowDisposition",
  "impl OrphanRowDisposition",
  "impl * for OrphanRowDisposition",
  "enum OrphanRowDispositionParseError",
  "enum InventoryReconcileOperation",
  "impl InventoryReconcileOperation",
  "impl * for InventoryReconcileOperation",
  "enum InventoryReconcileOutcome",
  "impl InventoryReconcileOutcome",
  "impl * for InventoryReconcileOutcome",
  "enum InventoryReconcileReason",
  "impl InventoryReconcileReason",
  "impl * for InventoryReconcileReason",
  "fn unary_list_budget_exceeded",
  "fn lifecycle_count",
  "fn orphan_row_materialized",
  "fn inventory_reconcile",
]

[[module]]
name = "health"
doc = "Sandbox health: probes, status, transitions, raw vsock checks and evidence reports."
items = [
  "enum SandboxHealthComponent",
  "impl SandboxHealthComponent",
  "impl * for SandboxHealthComponent",
  "enum SandboxHealthProbeOutcome",
  "impl SandboxHealthProbeOutcome",
  "impl * for SandboxHealthProbeOutcome",
  "enum SandboxHealthStatus",
  "impl SandboxHealthStatus",
  "impl * for SandboxHealthStatus",
  "enum SandboxRawVsockCheckOutcome",
  "impl SandboxRawVsockCheckOutcome",
  "impl * for SandboxRawVsockCheckOutcome",
  "enum SandboxHealthEvidenceOutcome",
  "impl SandboxHealthEvidenceOutcome",
  "impl * for SandboxHealthEvidenceOutcome",
  "fn guest_health",
  "fn sandbox_health_probe",
  "fn sandbox_health_status",
  "fn sandbox_health_transition",
  "fn sandbox_health_raw_vsock_check",
  "fn sandbox_health_evidence_report",
]

[[module]]
name = "ingress"
doc = "Ingress protection and admission, including service-port ingress rejections."
items = [
  "enum ServicePortIngressRejectionReason",
  "impl ServicePortIngressRejectionReason",
  "fn service_port_ingress_rejected",
  "fn ingress_protection",
  "fn ingress_admission_wait",
  "fn ingress_lifecycle_deferred",
]

The tool is scripts/split_rust_module.py from #562 (not on main yet).

• Regenerate: on main at b9fc395e0, run split_rust_module.py apply spec.toml && cargo fmt --all. This reproduces the first commit.
• Proof: split_rust_module.py verify origin/main → regenerated and compared 11 files from 1 split parents: identical. verify derives the spec from the diff, regenerates the split from the merge base, and requires HEAD's Rust files to equal the rustfmt'd result byte for byte.
• Edits inside moved text: 10 private items, fields or methods → pub(super). Each keeps the reach the item had: one module deeper, pub(super) reaches exactly the old module.

Observable changes

• Log targets: none change; no moved event or span lacks an explicit target:.

• Diagnostics name new locations:

  • std::any::type_name of a moved type names its new module;

  The reviews found nothing in the repository that depends on these.

Validation

Run on a Linux development machine at the PR head:

• cargo check --workspace --all-targets --all-features --locked: pass, no warnings.
• Every clippy invocation in run_clippy_checks with -D warnings: pass.
• cargo check -p pplx-space-metrics --no-default-features --all-targets: pass.
• cargo nextest run -p pplx-space-metrics --all-features: 9/9 passed; the package needs no Postgres or privileges.
• archcheck as CI runs it: no required findings. The only new advisory finding is the stale file_size entry below.
• Callers in sbx-mgr, node-mgr and spaced-host-server use full pplx_space_metrics::sandbox::worker::X paths. The re-exports keep all of them, and the workspace check covers them.

Interactions

No open pull request touches sandbox/worker.rs. The execution_release_decision family left in the parent has had no caller since #254, so a separate PR can delete it.

Follow-ups, kept out of this PR because verify allows no other Rust edits: the parent's //! doc still describes families that moved (ingress, activation environment); and the unused execution_release_decision family can be deleted.

The archcheck file_size baseline entry for this file is now stale (an advisory finding). Split PRs leave that table alone, so they don't conflict with each other there; one follow-up prunes the stale entries after they land.

Rollback

Revert the commit(s). No data, configuration, wire or public API change.

🤖 Generated with Claude Code

[the-gigi-pplx]

Review

No findings.

Verified against 33c066828c0269125c82f086f3b7bdf5b515ec0d.

What I ran:

• scripts/split_rust_module.py verify origin/main, using the script from PR scripts: add split_rust_module.py for mechanical, verifiable Rust module splits #562's head: identical, exit 0.
• apply with the spec in this PR's body, run on the merge base and rustfmt'd: it reproduces every .rs file at the head byte for byte. So the glob patterns in the published spec select the same items as the expanded spec verify --print-spec derives.
• Each moved child file, grepped for self::/super:: in doc comments. The tool doesn't rewrite comments, so a link like that would point one module off after the move. There are none.
• The non-split files, grepped for comments that name the old file next to a moved item.
• Whether main has touched the split file since the merge base: it hasn't.

What I didn't check: whether the grouping is the right one. That's a design call, and I took the body's word for it. I also didn't rebuild or retest the crate; CI is green on this head.

[the-gigi-pplx]

Approved. No findings; details in the review comment above.