operations-device-safety

Shared privileged-device-access substrate: stable device identity (never /dev/sdX), per-device locks, TOCTOU revalidation immediately before destructive ops, policy-gated actuation

Tier	operations
Role	unclassified (baselined)
Path	`crates/operations/device-safety`
Edition	2021
Targets	operations_device_safety
Public items	30 across 0 modules
Tests	24

What it is for

operations-device-safety — shared privileged-device-access substrate.

The hardware, block-imaging, drive-sanitize, and boot-media library crates all compose this so none of them re-implements device identity, locking, TOCTOU safety, or destructive-op policy. Its central invariant (Gate-1.5 consensus) is wrong-device rejection: a destructive operation bound to a DeviceId must re-check that the device at its path STILL matches that identity immediately before execution, or the operation is refused — defeating the TOCTOU window where a /dev/sdX name re-points to a different disk.

Testability

Device identity is resolved through the DeviceResolver seam; unit tests drive it with a fixture so the safety logic is proven without touching real hardware.

Capabilities

`crate root`

operations-device-safety — shared privileged-device-access substrate.

Item
`fn carries_critical_mount(device : & str, proc_mounts : & str) -> bool`
`fn usb_attached(udev_properties : & str) -> bool`
`fn permit_destructive_target(path : & str, udev_properties : & str, proc_mounts : & str, allowlist : & TargetAllowlist,) -> Result <(), DeviceSafetyError>`
`fn revalidate <R : DeviceResolver>(expected : & DeviceId, path : & str, resolver : & R,) -> Result <(), DeviceSafetyError>`
`fn actuate <A : Actuator>(policy : & WritePolicy, path : & str, value : & u8, actuator : & mut A,) -> Result <(), DeviceSafetyError>`

`Actuator`

operations-device-safety — shared privileged-device-access substrate.

Item
`pub trait Actuator`

`CommandEvidence`

operations-device-safety — shared privileged-device-access substrate.

Item
`pub struct CommandEvidence`
`fn evidence_for(path : & str, value : & u8, sensitive : bool) -> CommandEvidence`

`DeviceId`

operations-device-safety — shared privileged-device-access substrate.

Item
`pub struct DeviceId`
`DeviceId :: fn from_wwn(wwn : impl Into <String>) -> Self`
`DeviceId :: fn from_usb_serial(serial : impl Into <String>) -> Self`
`DeviceId :: fn kind(& self) -> IdentityKind`
`DeviceId :: fn value(& self) -> & str`
`DeviceId :: fn wwn(& self) -> Option <& str>`
`DeviceId :: fn from_udev_properties(properties : & str) -> Result <Self, DeviceSafetyError>`

`DeviceLockGuard`

operations-device-safety — shared privileged-device-access substrate.

Item
`pub struct DeviceLockGuard<'a>`

`DeviceLockGuard<'_>`

operations-device-safety — shared privileged-device-access substrate.

Item
`DeviceLockGuard<'_> :: fn drop(& mut self)`

`DeviceLocks`

operations-device-safety — shared privileged-device-access substrate.

Item
`pub struct DeviceLocks`
`DeviceLocks :: fn new() -> Self`
`DeviceLocks :: fn acquire(& self, id : & DeviceId) -> Result <DeviceLockGuard <'_>, DeviceSafetyError>`

`DeviceResolver`

operations-device-safety — shared privileged-device-access substrate.

Item
`pub trait DeviceResolver`

`DeviceSafetyError`

operations-device-safety — shared privileged-device-access substrate.

Item
`pub enum DeviceSafetyError`

`IdentityKind`

operations-device-safety — shared privileged-device-access substrate.

Item
`pub enum IdentityKind`

`TargetAllowlist`

operations-device-safety — shared privileged-device-access substrate.

Item
`pub struct TargetAllowlist`
`TargetAllowlist :: fn for_case(devices : impl IntoIterator <Item = DeviceId>) -> Self`
`TargetAllowlist :: fn permits(& self, device : & DeviceId) -> bool`

`WritePolicy`

operations-device-safety — shared privileged-device-access substrate.

Item
`pub struct WritePolicy`
`WritePolicy :: fn deny_all() -> Self`
`WritePolicy :: fn allow_prefix(mut self, prefix : impl Into <String>) -> Self`
`WritePolicy :: fn permits(& self, path : & str) -> bool`

How to use it

No examples/ target and no doctest in this crate's rustdoc. The tests listed under Verification are the closest executable usage.

Module structure

No public modules: the crate root is its whole surface.

Public surface

`crate root`

Item	What it is
`pub enum IdentityKind`	Which namespace a `DeviceId`'s value was drawn from
`pub struct DeviceId`	A stable device identity — bound to the physical device, NOT a racy `/dev/sdX` name
`DeviceId :: fn from_wwn(wwn : impl Into <String>) -> Self`	Construct from a World Wide Name (the stable storage identifier).
`DeviceId :: fn from_usb_serial(serial : impl Into <String>) -> Self`	Construct from a USB bridge's reported serial, for devices that expose no WWN.
`DeviceId :: fn kind(& self) -> IdentityKind`	Which namespace this identity came from.
`DeviceId :: fn value(& self) -> & str`	The identifying value, without its namespace
`DeviceId :: fn wwn(& self) -> Option <& str>`	The underlying WWN, when this identity is one.
`DeviceId :: fn from_udev_properties(properties : & str) -> Result <Self, DeviceSafetyError>`	Resolve an identity from `udevadm info --query=property` output
`pub trait DeviceResolver`	Resolves the CURRENT identity of the device at a path — the seam a caller uses to re-check identity immediately before a destructive op
`pub enum DeviceSafetyError`	Errors from the device-safety substrate.
`fn carries_critical_mount(device : & str, proc_mounts : & str) -> bool`	Whether `device` (a disk or one of its partitions) carries a mount the running system depends on, given the contents of `/proc/mounts`
`fn usb_attached(udev_properties : & str) -> bool`	Whether udev reports this device as USB-attached
`pub struct TargetAllowlist`	The devices an engagement is allowed to write to, named one by one
`TargetAllowlist :: fn for_case(devices : impl IntoIterator <Item = DeviceId>) -> Self`	The devices this engagement may write to
`TargetAllowlist :: fn permits(& self, device : & DeviceId) -> bool`	Whether `device` was named for this engagement.
`fn permit_destructive_target(path : & str, udev_properties : & str, proc_mounts : & str, allowlist : & TargetAllowlist,) -> Result <(), DeviceSafetyError>`	The gate every destructive target passes, or does not
`fn revalidate <R : DeviceResolver>(expected : & DeviceId, path : & str, resolver : & R,) -> Result <(), DeviceSafetyError>`	Re-check that the device at `path` STILL matches `expected`, immediately before a destructive operation
`pub struct WritePolicy`	Governs what the `Actuator` may write
`WritePolicy :: fn deny_all() -> Self`	A policy that permits nothing — the safe default.
`WritePolicy :: fn allow_prefix(mut self, prefix : impl Into <String>) -> Self`	Permit writes whose path starts with `prefix`.
`WritePolicy :: fn permits(& self, path : & str) -> bool`	Whether `path` is permitted by this policy.
`pub trait Actuator`	Seam that performs the actual privileged write
`fn actuate <A : Actuator>(policy : & WritePolicy, path : & str, value : & u8, actuator : & mut A,) -> Result <(), DeviceSafetyError>`	Perform a policy-gated write
`pub struct DeviceLocks`	Per-device exclusive locks
`DeviceLocks :: fn new() -> Self`	A new, empty lock registry.
`DeviceLocks :: fn acquire(& self, id : & DeviceId) -> Result <DeviceLockGuard <'_>, DeviceSafetyError>`	Acquire an exclusive lock on `id`
`pub struct DeviceLockGuard<'a>`	Releases its device lock when dropped.
`DeviceLockGuard<'_> :: fn drop(& mut self)`	—
`pub struct CommandEvidence`	Structured, audit-safe record of a device operation
`fn evidence_for(path : & str, value : & u8, sensitive : bool) -> CommandEvidence`	Build audit evidence for a write

No pub use re-exports: every item above is declared in this crate.

Boundary

Depends on no other workspace tier.

Shares tier operations with 40 other crates: operations-approval-workflow, operations-assessments, operations-block-imaging, operations-boot-media, operations-browser-agent-worker, operations-camera-discovery, operations-camera-liveview, operations-camera-registry, … (40 total).

_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._

Where it sits

Tier (ontology)	`operations`
Architectural role (taxonomy)	`unclassified (baselined)`
Location	`crates/operations/device-safety`
Vocabulary in force (lexicon)	`current`

Dependencies

Runtime, from outside the workspace.

Crate	Requirement	Features	Optional	Only on
`serde`	`^1`	`derive`	no	always
`thiserror`	`^2`	—	no	always

Development. None.

Build. None.

Depended on by. 3 workspace crates.

Signal flow — what reaches this crate, and what it reaches.

flowchart LR
  n_operations_block_imaging["operations-block-imaging"] -->|uses| SELF
  n_operations_boot_media["operations-boot-media"] -->|uses| SELF
  n_tools_ir_triage["tools-ir-triage"] -->|uses| SELF
  SELF["operations-device-safety"]
  classDef self fill:#1f883d,stroke:#1f883d,color:#fff;
  class SELF self;

Feature flags

No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.

Targets

Kind	Name	Source
lib	`operations_device_safety`	`src/lib.rs`

Error model

Error type	Named by
`DeviceSafetyError`	`actuate`, `permit_destructive_target`, `revalidate`

Operational characteristics

Property	Evidence
async public surface	none detected
async runtime	none detected
database access	none detected
network I/O	none detected
unsafe code	none detected
environment variables	none detected

No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.

Configuration

No environment variable is read with a literal name anywhere in this crate. A variable whose key is computed at run time cannot be listed here, and is not claimed to be absent.

3 workspace crates depend on this one: operations-block-imaging, operations-boot-media, tools-ir-triage.

Verification

Kind	Count
Unit tests	24
Integration tests	0
Examples	0
Doctests	0

Evidence by module. How often each public module is named by something executable.

Module	Tests	Examples	Consumers
`crate root`	16	0	8

What the tests establish, by name:

a_device_that_reports_no_usable_identity_is_refused_not_guessed — src/lib.rs
a_device_with_no_wwn_falls_back_to_its_serial_rather_than_failing — src/lib.rs
a_prefix_that_merely_looks_similar_does_not_borrow_the_refusal — src/lib.rs
a_serial_is_trimmed_because_udev_really_does_pad_it — src/lib.rs
a_target_disk_that_carries_nothing_critical_is_allowed — src/lib.rs
a_usb_device_is_not_a_target_merely_because_it_is_usb — src/lib.rs
a_wwn_wins_when_the_device_has_one — src/lib.rs
actuate_permits_an_allowlisted_path — src/lib.rs
actuate_refuses_a_path_outside_the_allowlist — src/lib.rs
all_three_gates_must_pass_before_a_target_is_permitted — src/lib.rs
an_empty_allowlist_permits_nothing — src/lib.rs
an_identity_says_which_namespace_it_came_from — src/lib.rs
an_unreadable_mount_table_refuses_rather_than_permits — src/lib.rs
different_devices_lock_independently — src/lib.rs
evidence_redacts_a_sensitive_value — src/lib.rs
evidence_shows_a_nonsensitive_value — src/lib.rs
lock_is_reacquirable_after_release — src/lib.rs
only_a_usb_device_may_be_a_destructive_target — src/lib.rs
revalidate_accepts_the_matching_device — src/lib.rs
revalidate_rejects_a_mismatched_device — src/lib.rs
second_lock_on_same_device_is_refused_while_first_is_held — src/lib.rs
the_allowlist_is_keyed_on_identity_not_on_a_path — src/lib.rs
the_disk_carrying_a_critical_mount_is_refused_as_a_destructive_target — src/lib.rs
the_same_string_in_two_namespaces_is_two_different_devices — src/lib.rs

Documentation coverage

Measure	Documented	Total
Public items with rustdoc	29	30
Public modules with a `//!` block	0	0

pie showData
    title Public items with rustdoc
    "Documented" : 29
    "No rustdoc detected" : 1

Metrics

Metric	Value
Rust source files	1
Source lines	890
Code lines	577
Public API items	30
Public modules	0
Tests	24
Examples	0
Cargo features	0
Direct runtime dependencies	2
Workspace reverse dependencies	3

pie showData
    title Public API by kind
    "enum" : 2
    "function" : 6
    "method" : 14
    "struct" : 6
    "trait" : 2

pie showData
    title Rust source composition
    "Code" : 577
    "Blank or comment" : 313

Generation

Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.

What it is for

Testability

Capabilities

crate root

Actuator

CommandEvidence

DeviceId

DeviceLockGuard

DeviceLockGuard<'_>

DeviceLocks

DeviceResolver

DeviceSafetyError

IdentityKind

TargetAllowlist

WritePolicy

How to use it

Module structure

Public surface

Boundary

Where it sits

Dependencies

Feature flags

Targets

Error model

Operational characteristics

Configuration

Related capabilities

Verification

Documentation coverage

Metrics

Generation

`crate root`

`Actuator`

`CommandEvidence`

`DeviceId`

`DeviceLockGuard`

`DeviceLockGuard<'_>`

`DeviceLocks`

`DeviceResolver`

`DeviceSafetyError`

`IdentityKind`

`TargetAllowlist`

`WritePolicy`