application-dlp — IMP FORGE

Forge module for DLP: the dlp_captures table (idempotent on tenant/device/event, tiered retention via confirmed+expires_at), masked-only capture persistence, retention purge, and RBAC codes. Consumes infrastructure-dlp envelopes; masked data only, never raw.

Tier	application
Role	unclassified (baselined)
Path	`crates/application/dlp`
Edition	2021
Targets	application_dlp, pg_agents, pg_live, pg_tenant_pool
Public items	20 across 3 modules
Tests	7

What it is for

application-dlp — Forge module for masked DLP captures.

Owns the dlp_captures + dlp_outbox tables in each tenant's OWN business DB (the per-tenant DB is the isolation boundary — no RLS here; sprint 2.6). Stores masked data only, never raw.

Two-database atomicity via a transactional outbox (Gate-1.5 consensus): record_capture writes the capture AND an outbox row in ONE business-DB transaction; deliver_outbox (run by a infrastructure-jobs relay) delivers dlp.detected to the SHARED-INFRA audit log and marks the outbox row delivered. No committed capture is ever permanently left un-audited.

Capabilities

`crate root`

application-dlp — Forge module for masked DLP captures.

Item
`async fn record_capture(business_pool : & PgPool, tenant_id : Uuid, actor_id : Uuid, env : & DlpFindingEnvelope, expires_at : Option <chrono::DateTime <chrono::Utc>>,) -> Result <Option <Uuid>, sqlx::Error>`
`async fn deliver_outbox(business_pool : & PgPool, audit_pool : & PgPool, batch : i64,) -> Result <u64, sqlx::Error>`
`pub const CONTROL_PLANE_MIGRATION: & str`
`pub const AUDIT_DEDUP_MIGRATION: & str`

`DlpModule`

application-dlp — Forge module for masked DLP captures.

Item
`pub struct DlpModule`
`DlpModule :: fn new() -> Self`
`DlpModule :: async fn migrate_audit_dedup(& self, pool : & PgPool) -> Result <u32, MigrationError>`
`DlpModule :: async fn migrate_control_plane(& self, pool : & PgPool) -> Result <u32, MigrationError>`
`DlpModule :: fn name(& self) -> & 'static str`
`DlpModule :: fn version(& self) -> & 'static str`
`DlpModule :: fn migrations(& self) -> Vec <MigrationSet>`
`DlpModule :: async fn migrate_pending(& self, pool : & PgPool) -> Result <u32, MigrationError>`
`DlpModule :: fn permission_codes(& self) -> Vec <String>`

`api (other)`

HTTP routes for application-dlp (free-function routers, staff-host pattern — there is

Item
`fn admin_router <S>() -> Router <S> where S : Clone + Send + Sync + 'static, PgPool : FromRef <S>, Arc <TenantPoolManager> : FromRef <S>,`
`fn ingest_router <S>() -> Router <S> where S : Clone + Send + Sync + 'static, PgPool : FromRef <S>, Arc <TenantPoolManager> : FromRef <S>,`

`ingest (other)`

Ingest authorization — the security core of the /api/dlp/ingest handler.

Item
`fn authorize_ingest(agent : & AgentIdentity, env : & DlpFindingEnvelope,) -> Result <(Uuid, String), IngestReject>`

`AgentIdentity`

Ingest authorization — the security core of the /api/dlp/ingest handler.

Item
`pub struct AgentIdentity`
`async fn resolve_agent <'e, E>(control : E, presented_key : & str,) -> Result <Option <AgentIdentity>, sqlx::Error> where E : PgExecutor <'e>,`

`IngestReject`

Ingest authorization — the security core of the /api/dlp/ingest handler.

Item
`pub enum IngestReject`

`notify (other)`

Operator notification on DLP detection (sprint 2.7, best-effort).

Item
`async fn notify_capture(control : & PgPool, tenant_id : Uuid, env : & DlpFindingEnvelope)`

How to use it

No examples/ target and no doctest in this crate's rustdoc. The tests listed under Verification are the closest executable usage.

Module structure

application_dlp

api
ingest
notify

flowchart TD
  n_application_dlp["application_dlp"]
  n_application_dlp --> n_api["api"]
  n_application_dlp --> n_ingest["ingest"]
  n_application_dlp --> n_notify["notify"]

Public surface

`crate root`

Item	What it is
`async fn record_capture(business_pool : & PgPool, tenant_id : Uuid, actor_id : Uuid, env : & DlpFindingEnvelope, expires_at : Option <chrono::DateTime <chrono::Utc>>,) -> Result <Option <Uuid>, sqlx::Error>`	Persist a masked capture + its outbox row in ONE business-DB transaction
`async fn deliver_outbox(business_pool : & PgPool, audit_pool : & PgPool, batch : i64,) -> Result <u64, sqlx::Error>`	Relay: deliver undelivered outbox rows to the SHARED-INFRA audit log, then mark them delivered
`pub const CONTROL_PLANE_MIGRATION: & str`	The control-plane migration (sensor-agent registration)
`pub const AUDIT_DEDUP_MIGRATION: & str`	The audit-side dedup migration (`dlp_audit_delivered`)
`pub struct DlpModule`	The mountable Forge DLP module.
`DlpModule :: fn new() -> Self`	Construct the module.
`DlpModule :: async fn migrate_audit_dedup(& self, pool : & PgPool) -> Result <u32, MigrationError>`	Apply the audit-side dedup migration (`dlp_audit_delivered`) to the SHARED audit pool
`DlpModule :: async fn migrate_control_plane(& self, pool : & PgPool) -> Result <u32, MigrationError>`	Apply the control-plane migration (`dlp_agents`) to the SHARED control-plane pool
`DlpModule :: fn name(& self) -> & 'static str`	—
`DlpModule :: fn version(& self) -> & 'static str`	—
`DlpModule :: fn migrations(& self) -> Vec <MigrationSet>`	—
`DlpModule :: async fn migrate_pending(& self, pool : & PgPool) -> Result <u32, MigrationError>`	—
`DlpModule :: fn permission_codes(& self) -> Vec <String>`	—

`api`

Item	What it is
`fn admin_router <S>() -> Router <S> where S : Clone + Send + Sync + 'static, PgPool : FromRef <S>, Arc <TenantPoolManager> : FromRef <S>,`	Masked-alert viewer routes
`fn ingest_router <S>() -> Router <S> where S : Clone + Send + Sync + 'static, PgPool : FromRef <S>, Arc <TenantPoolManager> : FromRef <S>,`	Agent ingest routes

`ingest`

Item	What it is
`pub struct AgentIdentity`	The tenant + device a presented agent credential is bound to (resolved from the agent registration by the handler, before authorization).
`pub enum IngestReject`	Why an ingest was rejected (maps to HTTP 403).
`fn authorize_ingest(agent : & AgentIdentity, env : & DlpFindingEnvelope,) -> Result <(Uuid, String), IngestReject>`	Authorize an envelope against the authenticated agent identity
`async fn resolve_agent <'e, E>(control : E, presented_key : & str,) -> Result <Option <AgentIdentity>, sqlx::Error> where E : PgExecutor <'e>,`	Resolve a presented plaintext agent key to its bound `AgentIdentity` via the control-plane `api_keys` + `dlp_agents` tables

`notify`

Item	What it is
`async fn notify_capture(control : & PgPool, tenant_id : Uuid, env : & DlpFindingEnvelope)`	Alert the tenant's active owners about a detection

Re-exports. Exported here, defined elsewhere.

Export	Defined in
`notify_capture`	`notify::notify_capture`
`{authorize_ingest,resolve_agent,AgentIdentity,IngestReject}`	`ingest::{authorize_ingest,resolve_agent,AgentIdentity,IngestReject}`
`{fetch_undelivered_outbox,insert_capture,insert_outbox,list_recent,mark_outbox_delivered,purge_expired_unconfirmed,CaptureRow,OutboxRow,}`	`repo::{fetch_undelivered_outbox,insert_capture,insert_outbox,list_recent,mark_outbox_delivered,purge_expired_unconfirmed,CaptureRow,OutboxRow,}`

Boundary

Reaches into identity, infrastructure.

Shares tier application with 120 other crates: application-agreements, application-ai, application-analytics, application-approvals, application-assessments, application-audit-log, application-auth, application-billing, … (120 total).

_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._

Where it sits

Tier (ontology)	`application`
Architectural role (taxonomy)	`unclassified (baselined)`
Location	`crates/application/dlp`
Vocabulary in force (lexicon)	`current`

Tier flow. Which tiers this crate's own edges cross.

flowchart LR
  n_application["application"] --> n_identity["identity"]
  n_application["application"] --> n_infrastructure["infrastructure"]

Dependencies

Runtime, in this workspace.

Crate	Tier	Optional	Only on
`application-audit-log`	application	no	always
`application-core`	application	no	always
`application-notifications`	application	no	always
`application-rbac`	application	no	always
`identity-auth`	identity	no	always
`identity-tenant`	identity	no	always
`infrastructure-dlp`	infrastructure	no	always
`infrastructure-tenant-pool`	infrastructure	no	always

Runtime, from outside the workspace.

Crate	Requirement	Features	Optional	Only on
`async-trait`	`^0.1`	—	no	always
`axum`	`^0.7`	`multipart`	no	always
`chrono`	`^0.4`	`serde`, `serde`	no	always
`serde`	`^1`	`derive`, `derive`	no	always
`serde_json`	`^1`	—	no	always
`sqlx`	`^0.8`	`runtime-tokio`, `postgres`, `chrono`, `uuid`, `json`, `migrate`	no	always
`tracing`	`^0.1`	—	no	always
`uuid`	`^1`	`v4`, `v7`, `serde`, `js`, `v4`, `serde`	no	always

Development, from outside the workspace.

Crate	Requirement	Features	Optional	Only on
`tokio`	`^1`	`full`, `macros`, `rt-multi-thread`	no	always
`uuid`	`^1`	`v4`, `v7`, `serde`, `js`, `v4`	no	always

Build. None.

Depended on by. 1 workspace crate.

Signal flow — what reaches this crate, and what it reaches.

flowchart LR
  n_platform_privacy_scan_api["platform-privacy-scan-api"] -->|uses| SELF
  SELF["application-dlp"]
  SELF -->|runtime| n_application_audit_log["application-audit-log"]
  SELF -->|runtime| n_application_core["application-core"]
  SELF -->|runtime| n_application_notifications["application-notifications"]
  SELF -->|runtime| n_application_rbac["application-rbac"]
  SELF -->|runtime| n_identity_auth["identity-auth"]
  SELF -->|runtime| n_identity_tenant["identity-tenant"]
  SELF -->|runtime| n_infrastructure_dlp["infrastructure-dlp"]
  SELF -->|runtime| n_infrastructure_tenant_pool["infrastructure-tenant-pool"]
  classDef self fill:#1f883d,stroke:#1f883d,color:#fff;
  class SELF self;

Feature flags

No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.

Targets

Kind	Name	Source
lib	`application_dlp`	`src/lib.rs`
test	`pg_agents`	`tests/pg_agents.rs`
test	`pg_live`	`tests/pg_live.rs`
test	`pg_tenant_pool`	`tests/pg_tenant_pool.rs`

Error model

No public error type was detected: no public item declares a type named *Error, and no public signature returns one.

Operational characteristics

Property	Evidence
async public surface	yes
async runtime	none detected
database access	yes
network I/O	yes
unsafe code	none detected
environment variables	yes

No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.

Configuration

Variable	Read in
`CARGO_PKG_VERSION`	`src/lib.rs`

1 workspace crate depends on this one: platform-privacy-scan-api.

Verification

Kind	Count
Unit tests	4
Integration tests	3
Examples	0
Doctests	0

Evidence by module. How often each public module is named by something executable.

Module	Tests	Consumers
`crate root`	5	1
`api`	2	0
`ingest`	4	0
`notify`	1	0

What the tests establish, by name:

resolve_agent_from_presented_key — tests/pg_agents.rs
outbox_flow_capture_then_relay_to_hardened_audit — tests/pg_live.rs
concurrent_ingest_never_cross_routes — tests/pg_tenant_pool.rs
authoritative_pair_is_the_credentials_even_when_body_matches — src/ingest.rs
foreign_tenant_body_is_rejected_not_silently_retargeted — src/ingest.rs
matching_envelope_returns_credential_authoritative_pair — src/ingest.rs
wrong_device_body_is_rejected — src/ingest.rs

Documentation coverage

Measure	Documented	Total
Public items with rustdoc	15	20
Public modules with a `//!` block	3	3

pie showData
    title Public items with rustdoc
    "Documented" : 15
    "No rustdoc detected" : 5

Metrics

Metric	Value
Rust source files	5
Source lines	723
Code lines	511
Public API items	20
Public modules	3
Tests	7
Examples	0
Cargo features	0
Direct runtime dependencies	16
Workspace reverse dependencies	1

pie showData
    title Public API by kind
    "constant" : 2
    "enum" : 1
    "function" : 7
    "method" : 8
    "struct" : 2

pie showData
    title Rust source composition
    "Code" : 511
    "Blank or comment" : 212

Generation

Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.

What it is for

Capabilities

crate root

DlpModule

api (other)

ingest (other)

AgentIdentity

IngestReject

notify (other)

How to use it

Module structure

Public surface

Boundary

Where it sits

Dependencies

Feature flags

Targets

Error model

Operational characteristics

Configuration

Related capabilities

Verification

Documentation coverage

Metrics

Generation

`crate root`

`DlpModule`

`api (other)`

`ingest (other)`

`AgentIdentity`

`IngestReject`

`notify (other)`