Arcane.firewall.install()

This focused page is derived from the mechanically checked full member inventory.

Syntax

Arcane.firewall.install(expectation)

Parameters

{expectedPolicyGeneration, expectedStateGeneration}

Return value

Promise<FirewallOperationResult>

Description

After separate user confirmation, stages the reviewed global-deny projection in deterministic development simulation. Domain projection may use bounded system DNS and admits at most 4,096 domain rules; status disables Install before confirmation when the canonical policy exceeds that native ceiling. Live mutation is unavailable. Requires firewall.manage.

Overview

Arcane.firewall.install(expectation) resolves and stages the reviewed canonical deny-policy projection. It requires firewall.manage, app id firewall, elevated Core authority, the exclusive mutation boundary, and a separate user confirmation. It is non-idempotent and currently succeeds only in deterministic development simulation; live mutation fails explicitly.

expectation must be an exact plain object containing the current positive expectedPolicyGeneration and nonnegative expectedStateGeneration from one fresh firewall.status() result. Unknown, missing, stale, fractional, or negative values are rejected.

Install may use bounded system DNS to project domain rules to addresses. One projection admits at most 4,096 domain rules. It stages Arcane-owned state with enforcement disabled; an enabled generation must be disabled first.

Result, side effects, and events

Every firewall mutation resolves to exactly {status, receipt, operation}. status is the full fresh status object. receipt is exactly {schemaVersion, operation, ownedNamespace, backend, policyGeneration, projectionSha256, completedAt, transactionId}. operation is the completed standard operation record; its type is "firewall.install", progress is 100, credentials is empty, and error is null. Standard operation events are emitted.

Errors and recovery

Bad JavaScript input throws TypeError; stale snapshots use FIREWALL_POLICY_GENERATION_STALE or FIREWALL_STATE_GENERATION_STALE. FIREWALL_HOST_AUTHENTICATION_UNAVAILABLE identifies the current live-host boundary. Other important failures include FIREWALL_MUTATION_BUSY, OPERATION_BUSY, FIREWALL_RECOVERY_REQUIRED, FIREWALL_DISABLE_REQUIRED, bounded DNS/projection failures, and cancellation. Refresh status after any failure; do not reuse old generations.

Example

async function installFirewallAfterConfirmation(confirmInstall) {
    const status = await Arcane.firewall.status();
    if (!status.simulation || !status.supported || !status.state.installReady) {
        return null;
    }
    if (!confirmInstall(status)) {
        return null;
    }
    return Arcane.firewall.install({
        expectedPolicyGeneration: status.policy.generation,
        expectedStateGeneration: status.state.generation
    });
}

Reference group

Platform, installation, users, and system