platform tier

`platform-privacy-scan-api`

HTTP API server for browser extension scan result ingestion

HTTP API server for browser extension scan result ingestion

Tier	platform
Role	unclassified (baselined)
Path	`crates/platform/privacy-scan-api`
Edition	2021
Targets	platform-privacy-scan-api, platform_privacy_scan_api, capability_bridge_live, outbound_gate, policy_profiles
Public items	74 across 5 modules
Tests	338

What it is for

platform-privacy-scan-api — the AI-bridge HTTP server, packaged as a library so integration tests (tests/) can spin the EXACT production router in-process via tower oneshot, never binding the operator's live :3333. The platform-privacy-scan-api binary is a thin run() wrapper (src/main.rs).

Capabilities

`crate root`

platform-privacy-scan-api — the AI-bridge HTTP server, packaged as a library so

Item
`async fn run()`

`AppState`

platform-privacy-scan-api — the AI-bridge HTTP server, packaged as a library so

Item
`pub struct AppState`
`AppState :: fn new(pool : PgPool, api_key : String, gate : gate::DlpGate) -> Self`
`AppState :: fn with_capability_keyring(mut self, ring : capability::KeyRing) -> Self`
`AppState :: fn with_sighting_pool(mut self, pool : PgPool) -> Self`
`AppState :: async fn connected_agents(& self,) -> std::collections::HashMap <String, chrono::DateTime <chrono::Utc>>`
`AppState :: async fn queued_commands(& self) -> Vec <String>`
`fn app_router(state : Arc <AppState>) -> Router`

`capability (other)`

The capability a signed command carries (sprint 4.44.2, task 5).

Item
`pub const CAPABILITY_VERSION: & str`
`pub const MAX_TTL_SECS: i64`
`fn mint(ctx : & MintContext <'_>, command : & serde_json::Value,) -> Result <CapabilityEnvelope, MintError>`
`fn verify(envelope : & CapabilityEnvelope, key : & VerifyingKey, agent_id : & str, now_unix : i64, skew_secs : i64,) -> Result <SignedCommandV1, VerifyError>`
`fn fresh_key_bytes(rng : & mut impl rand_core::CryptoRngCore) -> u8; SIGNING_KEY_BYTES`
`fn choose_key(configured : Option <& str>, persisted : Option <& u8>,) -> Result <KeyChoice, KeyLoadError>`
`fn derive_key_id(published_verifying_key : & str) -> String`

`CapabilityEnvelope`

The capability a signed command carries (sprint 4.44.2, task 5).

Item
`pub struct CapabilityEnvelope`

`KeyChoice`

The capability a signed command carries (sprint 4.44.2, task 5).

Item
`pub enum KeyChoice`

`KeyLoadError`

The capability a signed command carries (sprint 4.44.2, task 5).

Item
`pub enum KeyLoadError`
`KeyLoadError :: fn fmt(& self, f : & mut std::fmt::Formatter <'_>) -> std::fmt::Result`

`KeyOrigin`

The capability a signed command carries (sprint 4.44.2, task 5).

Item
`pub enum KeyOrigin`

`KeyRing`

The capability a signed command carries (sprint 4.44.2, task 5).

Item
`pub struct KeyRing`
`KeyRing :: fn from_bytes(key_id : & str, bytes : & u8) -> Result <Self, foundation_crypto_sign::Error>`
`KeyRing :: fn generated(rng : & mut impl rand_core::CryptoRngCore) -> Self`
`KeyRing :: fn with_derived_id(self) -> Self`
`KeyRing :: fn published_verifying_key(& self) -> String`

`MintContext`

The capability a signed command carries (sprint 4.44.2, task 5).

Item
`pub struct MintContext<'a>`

`MintError`

The capability a signed command carries (sprint 4.44.2, task 5).

Item
`pub enum MintError`
`MintError :: fn fmt(& self, f : & mut std::fmt::Formatter <'_>) -> std::fmt::Result`

`SignedCommandV1`

The capability a signed command carries (sprint 4.44.2, task 5).

Item
`pub struct SignedCommandV1`
`fn to_bytes(cap : & SignedCommandV1) -> Result <Vec <u8>, serde_json::Error>`

`VerifyError`

The capability a signed command carries (sprint 4.44.2, task 5).

Item
`pub enum VerifyError`

`gate (other)`

Outbound DLP gate (Sprint 3.6 T5/T6/T7/T8).

Item
`pub const VERDICT_SCHEMA_VERSION: u32`
`pub const SERVER_ORIGINATED: & str`
`fn build_envelopes(findings : & Finding, tenant_id : & str, device_id : & str, seq_start : u64, occurred_at_ms : i64,) -> Vec <infrastructure_dlp::envelope::DlpFindingEnvelope>`

`AuditSink`

Outbound DLP gate (Sprint 3.6 T5/T6/T7/T8).

Item
`pub struct AuditSink`
`AuditSink :: fn from_env() -> Result <Option <Self>, String>`

`DlpGate`

Outbound DLP gate (Sprint 3.6 T5/T6/T7/T8).

Item
`pub struct DlpGate`
`DlpGate :: fn new(policy : ScreenPolicy) -> Self`
`DlpGate :: fn with_bypass_until(mut self, until_unix : i64) -> Self`
`DlpGate :: fn from_env() -> Result <Self, String>`
`DlpGate :: fn policy_version(& self) -> String`
`DlpGate :: fn reload(& self) -> Result <String, String>`
`DlpGate :: fn reload_from_str(& self, source : & str) -> Result <String, PolicyError>`
`DlpGate :: fn record_warn_findings(& self, findings : & Finding)`

`DlpStats`

Outbound DLP gate (Sprint 3.6 T5/T6/T7/T8).

Item
`pub struct DlpStats`
`DlpStats :: fn snapshot(& self) -> serde_json::Value`
`DlpStats :: fn warns_total(& self) -> u64`
`DlpStats :: fn blocks_total(& self) -> u64`
`DlpStats :: fn bypasses_total(& self) -> u64`

`GateRefusal`

Outbound DLP gate (Sprint 3.6 T5/T6/T7/T8).

Item
`pub struct GateRefusal`
`async fn enqueue_command(state : & AppState, cmd : & mut serde_json::Value, principal : & str,) -> Result <(), GateRefusal>`
`async fn enqueue_command_targeted(state : & AppState, cmd : & mut serde_json::Value, target : & str, principal : & str,) -> Result <(), GateRefusal>`

`QueuedCommand`

Outbound DLP gate (Sprint 3.6 T5/T6/T7/T8).

Item
`pub struct QueuedCommand`

`principal (other)`

Who asked, and which browser may answer (sprint 4.44.2, B-070 option B).

Item
`fn agent_id_for(installation_id : Uuid) -> String`
`fn installation_of_agent(agent_id : & str) -> Option <Uuid>`
`fn registration_allowed(principal : & AuthenticatedPrincipal, claimed_agent_id : & str, profiles_installation : Option <Uuid>,) -> Result <Uuid, RegistrationRefusal>`

`AuthenticatedPrincipal`

Who asked, and which browser may answer (sprint 4.44.2, B-070 option B).

Item
`pub enum AuthenticatedPrincipal`
`AuthenticatedPrincipal :: fn label(& self) -> String`
`AuthenticatedPrincipal :: fn profile_id(& self) -> Option <Uuid>`

`RegistrationRefusal`

Who asked, and which browser may answer (sprint 4.44.2, B-070 option B).

Item
`pub enum RegistrationRefusal`

`TargetRefusal`

Who asked, and which browser may answer (sprint 4.44.2, B-070 option B).

Item
`pub enum TargetRefusal`
`fn resolve_target(requested : Option <& str>, connected : & String,) -> Result <String, TargetRefusal>`

`protocol (other)`

Which command protocol a connection speaks (sprint 4.44.2, task 4).

Item
`pub const SERVER_MAX_PROTOCOL: u8`
`pub const SERVER_MIN_PROTOCOL: u8`
`fn negotiate(advertised : & u8) -> Option <u8>`
`fn advertised_from_register(frame : & serde_json::Value) -> Vec <u8>`

`provider_lease (other)`

Per-provider mutual exclusion for the browser bridge (B-029).

Item
`fn provider_for_command(cmd_type : & str) -> Option <& 'static str>`

`Busy`

Per-provider mutual exclusion for the browser bridge (B-029).

Item
`pub struct Busy`

`Lease`

Per-provider mutual exclusion for the browser bridge (B-029).

Item
`pub struct Lease`

`ProviderLeases`

Per-provider mutual exclusion for the browser bridge (B-029).

Item
`pub struct ProviderLeases`
`ProviderLeases :: fn new() -> Self`
`ProviderLeases :: fn try_acquire(& mut self, provider : & str, owner : & str, ttl : Duration, now : Instant,) -> Result <(), Busy>`
`ProviderLeases :: fn release(& mut self, provider : & str, owner : & str) -> bool`
`ProviderLeases :: fn holder(& self, provider : & str, now : Instant) -> Option <& Lease>`

How to use it

No examples/ target and no doctest in this crate's rustdoc. The tests listed under Verification are the closest executable usage.

Module structure

platform_privacy_scan_api

capability
gate
principal
protocol
provider_lease

flowchart TD
  n_platform_privacy_scan_api["platform_privacy_scan_api"]
  n_platform_privacy_scan_api --> n_capability["capability"]
  n_platform_privacy_scan_api --> n_gate["gate"]
  n_platform_privacy_scan_api --> n_principal["principal"]
  n_platform_privacy_scan_api --> n_protocol["protocol"]
  n_platform_privacy_scan_api --> n_provider_lease["provider_lease"]

Public surface

`crate root`

Item	What it is
`pub struct AppState`	Shared server state
`AppState :: fn new(pool : PgPool, api_key : String, gate : gate::DlpGate) -> Self`	Build a fresh server state around `gate`
`AppState :: fn with_capability_keyring(mut self, ring : capability::KeyRing) -> Self`	Sign with this ring instead of the one generated at construction
`AppState :: fn with_sighting_pool(mut self, pool : PgPool) -> Self`	Point the sightings routes at their own database
`AppState :: async fn connected_agents(& self,) -> std::collections::HashMap <String, chrono::DateTime <chrono::Utc>>`	Currently-connected agent ids and when each registered
`AppState :: async fn queued_commands(& self) -> Vec <String>`	Read-only snapshot of the queued command JSON strings
`async fn run()`	Full server startup: env/config, DB connect, DLP gate arming, bind, serve
`fn app_router(state : Arc <AppState>) -> Router`	—

`capability`

Item	What it is
`pub const CAPABILITY_VERSION: & str`	The protocol tag inside the signed bytes
`pub const MAX_TTL_SECS: i64`	The longest life a capability may claim, in seconds
`pub struct SignedCommandV1`	What the server signs, and what the extension executes.
`pub struct CapabilityEnvelope`	The frame that goes on the wire: the signed bytes and the signature over them
`pub enum MintError`	Why a capability could not be minted.
`MintError :: fn fmt(& self, f : & mut std::fmt::Formatter <'_>) -> std::fmt::Result`	—
`fn to_bytes(cap : & SignedCommandV1) -> Result <Vec <u8>, serde_json::Error>`	Serialize a capability the one time it is ever serialized
`pub struct MintContext<'a>`	Everything a mint needs except the command: the key that signs, who it signs for, and when
`fn mint(ctx : & MintContext <'_>, command : & serde_json::Value,) -> Result <CapabilityEnvelope, MintError>`	Mint a capability for `command`, addressed to `agent_id`, on behalf of `principal`
`pub enum VerifyError`	Why a capability was refused
`fn verify(envelope : & CapabilityEnvelope, key : & VerifyingKey, agent_id : & str, now_unix : i64, skew_secs : i64,) -> Result <SignedCommandV1, VerifyError>`	Verify an envelope against `key` and return the capability it carries
`pub struct KeyRing`	The signing key this server mints with, and the id it publishes for it
`KeyRing :: fn from_bytes(key_id : & str, bytes : & u8) -> Result <Self, foundation_crypto_sign::Error>`	Load from raw key bytes (32 for Ed25519), as the server's configuration supplies them
`KeyRing :: fn generated(rng : & mut impl rand_core::CryptoRngCore) -> Self`	A fresh key, with the id derived from it
`KeyRing :: fn with_derived_id(self) -> Self`	The same ring with its id derived from its key rather than whatever was passed in.
`KeyRing :: fn published_verifying_key(& self) -> String`	What the extension pins: the algorithm-tagged public key.
`pub enum KeyOrigin`	Where the key the server signs with came from
`pub enum KeyChoice`	What `choose_key` decided.
`pub enum KeyLoadError`	Why a supplied key could not be used.
`KeyLoadError :: fn fmt(& self, f : & mut std::fmt::Formatter <'_>) -> std::fmt::Result`	—
`fn fresh_key_bytes(rng : & mut impl rand_core::CryptoRngCore) -> u8; SIGNING_KEY_BYTES`	Bytes for a new signing key
`fn choose_key(configured : Option <& str>, persisted : Option <& u8>,) -> Result <KeyChoice, KeyLoadError>`	Decide which key the server signs with, given what configuration and disk offer
`fn derive_key_id(published_verifying_key : & str) -> String`	The id published beside a public key: the first 16 hex characters of its SHA-256

`gate`

Item	What it is
`pub const VERDICT_SCHEMA_VERSION: u32`	Version of the machine-readable verdict JSON contract (both the 403 and 503 bodies)
`pub struct GateRefusal`	A refused enqueue: HTTP status + the exact verdict JSON contract body.
`pub struct DlpStats`	In-memory gate telemetry (T8 dogfood counters).
`DlpStats :: fn snapshot(& self) -> serde_json::Value`	JSON snapshot for `GET /api/dlp/stats`.
`DlpStats :: fn warns_total(& self) -> u64`	—
`DlpStats :: fn blocks_total(& self) -> u64`	—
`DlpStats :: fn bypasses_total(& self) -> u64`	—
`pub struct DlpGate`	The server-side DLP gate: loaded policy + telemetry + operator bypass.
`DlpGate :: fn new(policy : ScreenPolicy) -> Self`	Gate with an explicit policy (tests / embedded use).
`DlpGate :: fn with_bypass_until(mut self, until_unix : i64) -> Self`	Set an operator bypass expiry (unix seconds) — test seam for the `DLP_GATE_BYPASS_UNTIL` env path.
`DlpGate :: fn from_env() -> Result <Self, String>`	Build the gate from the server environment
`DlpGate :: fn policy_version(& self) -> String`	Current policy version (sha256 hex of the loaded TOML source).
`DlpGate :: fn reload(& self) -> Result <String, String>`	Reload the policy from `DLP_POLICY_PATH`
`DlpGate :: fn reload_from_str(& self, source : & str) -> Result <String, PolicyError>`	Replace the policy from TOML text; on parse failure the last valid policy is kept
`DlpGate :: fn record_warn_findings(& self, findings : & Finding)`	Record warn-grade findings that accompanied an allowed send.
`pub struct QueuedCommand`	A command waiting for a browser, and who asked for it
`pub const SERVER_ORIGINATED: & str`	The principal for a command no external caller asked for: a retry, a lease sweep, a flow this server drives itself
`async fn enqueue_command(state : & AppState, cmd : & mut serde_json::Value, principal : & str,) -> Result <(), GateRefusal>`	Screen `cmd` against the gate policy and, if it passes, push it onto the command queue and wake the WebSocket send loop
`async fn enqueue_command_targeted(state : & AppState, cmd : & mut serde_json::Value, target : & str, principal : & str,) -> Result <(), GateRefusal>`	Like `enqueue_command`, but addressed to one specific connected agent (by the `agent_id` it sent at `register`) instead of racing whichever connected agent grabs it first
`fn build_envelopes(findings : & Finding, tenant_id : & str, device_id : & str, seq_start : u64, occurred_at_ms : i64,) -> Vec <infrastructure_dlp::envelope::DlpFindingEnvelope>`	Build masked audit envelopes (Source::AiPrompt) for gate findings
`pub struct AuditSink`	DB-gated audit sink: masked envelopes through `application_dlp::record_capture`
`AuditSink :: fn from_env() -> Result <Option <Self>, String>`	Build from env

`principal`

Item	What it is
`pub enum AuthenticatedPrincipal`	The caller behind a request, as authentication resolved it
`AuthenticatedPrincipal :: fn label(& self) -> String`	The string that goes on a signed capability and into the audit row
`AuthenticatedPrincipal :: fn profile_id(& self) -> Option <Uuid>`	The browser profile this principal speaks for, when it has one.
`fn agent_id_for(installation_id : Uuid) -> String`	The `agent_id` an installation registers under
`fn installation_of_agent(agent_id : & str) -> Option <Uuid>`	The installation an `agent_id` names, or `None` when it is not that shape (an `anon:` id, or anything a client made up).
`pub enum RegistrationRefusal`	Why a registration was refused
`fn registration_allowed(principal : & AuthenticatedPrincipal, claimed_agent_id : & str, profiles_installation : Option <Uuid>,) -> Result <Uuid, RegistrationRefusal>`	Whether this principal may register as `claimed`, given the installation its own profile owns (looked up by the caller; `None` when the principal has no profile)
`pub enum TargetRefusal`	Why a command could not be addressed to one browser.
`fn resolve_target(requested : Option <& str>, connected : & String,) -> Result <String, TargetRefusal>`	The one agent a command is for: the caller's choice when it named one, otherwise the only connected agent

`protocol`

Item	What it is
`pub const SERVER_MAX_PROTOCOL: u8`	The highest protocol this server can speak.
`pub const SERVER_MIN_PROTOCOL: u8`	The lowest protocol this server will speak (sprint 4.44.2, task 8)
`fn negotiate(advertised : & u8) -> Option <u8>`	The version to speak with a client that advertised `advertised`, or `None` to refuse it
`fn advertised_from_register(frame : & serde_json::Value) -> Vec <u8>`	The versions an extension advertised in its `register` frame, read defensively: a missing field is an old extension (empty), and a value that is not a list of small integers is not a version claim.

`provider_lease`

Item	What it is
`fn provider_for_command(cmd_type : & str) -> Option <& 'static str>`	Which bridge commands drive a shared provider tab, and the key each maps to
`pub struct Lease`	—
`pub struct Busy`	Why a claim was refused — carries what the caller needs to act.
`pub struct ProviderLeases`	—
`ProviderLeases :: fn new() -> Self`	—
`ProviderLeases :: fn try_acquire(& mut self, provider : & str, owner : & str, ttl : Duration, now : Instant,) -> Result <(), Busy>`	Claim `provider` for `owner` until `now + ttl`
`ProviderLeases :: fn release(& mut self, provider : & str, owner : & str) -> bool`	Release only if `owner` still holds it
`ProviderLeases :: fn holder(& self, provider : & str, now : Instant) -> Option <& Lease>`	—

No pub use re-exports: every item above is declared in this crate.

Boundary

Reaches into application, content, domain, foundation, identity, infrastructure, operations.

Shares tier platform with 9 other crates: platform-api, platform-corpus-console, platform-customer-ui, platform-disclosure-lab, platform-dto, platform-html-components, platform-leptos-components, platform-staff-ui, … (9 total).

_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._

Where it sits

Tier (ontology)	`platform`
Architectural role (taxonomy)	`unclassified (baselined)`
Location	`crates/platform/privacy-scan-api`
Vocabulary in force (lexicon)	`current`

Tier flow. Which tiers this crate's own edges cross.

flowchart LR
  n_platform["platform"] --> n_application["application"]
  n_platform["platform"] --> n_content["content"]
  n_platform["platform"] --> n_domain["domain"]
  n_platform["platform"] --> n_foundation["foundation"]
  n_platform["platform"] --> n_identity["identity"]
  n_platform["platform"] --> n_infrastructure["infrastructure"]
  n_platform["platform"] --> n_operations["operations"]

Dependencies

Runtime, in this workspace.

Crate	Tier	Optional	Only on
`application-dlp`	application	no	always
`content-assets`	content	no	always
`domain-catalog`	domain	no	always
`domain-geo`	domain	no	always
`domain-notifications`	domain	no	always
`domain-pricing-rules`	domain	no	always
`domain-privacy-research`	domain	no	always
`domain-reviews`	domain	no	always
`domain-taxonomy`	domain	no	always
`foundation-audit-log`	foundation	no	always
`foundation-crypto-sign`	foundation	no	always
`foundation-money`	foundation	no	always
`identity-tenant`	identity	no	always
`infrastructure-ai`	infrastructure	no	always
`infrastructure-dlp`	infrastructure	no	always
`infrastructure-dlp-detect`	infrastructure	no	always
`infrastructure-fetcher`	infrastructure	no	always
`infrastructure-jobs`	infrastructure	no	always
`infrastructure-search`	infrastructure	no	always
`infrastructure-storage`	infrastructure	no	always
`infrastructure-tenant-pool`	infrastructure	no	always
`operations-assessments`	operations	no	always
`operations-rate-limit`	operations	no	always
`platform-html-components`	platform	no	always

Runtime, from outside the workspace.

Crate	Requirement	Features	Optional	Only on
`axum`	`^0.7`	`multipart`, `ws`	no	always
`base64`	`^0.22`	—	no	always
`chrono`	`^0.4`	`serde`	no	always
`dotenvy`	`^0.15`	—	no	always
`futures`	`^0.3`	—	no	always
`hex`	`^0.4`	—	no	always
`image`	`^0.25`	—	no	always
`once_cell`	`^1`	—	no	always
`rand`	`^0.8`	—	no	always
`rand_core`	`^0.6`	`getrandom`	no	always
`regex`	`^1`	—	no	always
`reqwest`	`^0.12`	`json`	no	always
`serde`	`^1`	`derive`	no	always
`serde_json`	`^1`	—	no	always
`sha2`	`^0.10`	—	no	always
`sqlx`	`^0.8`	`runtime-tokio`, `postgres`, `chrono`, `uuid`, `json`	no	always
`tokio`	`^1`	`full`	no	always
`tokio-tungstenite`	`^0.26`	—	no	always
`tower-http`	`^0.6`	`fs`, `trace`, `cors`, `request-id`	no	always
`tracing`	`^0.1`	—	no	always
`tracing-subscriber`	`^0.3`	`env-filter`	no	always
`url`	`^2`	—	no	always
`urlencoding`	`^2`	—	no	always
`uuid`	`^1`	`v4`, `v7`, `serde`, `js`	no	always

Development, from outside the workspace.

Crate	Requirement	Features	Optional	Only on
`tower`	`^0.5`	`util`	no	always

Build. None.

Depended on by. Nothing in this workspace.

Signal flow — what reaches this crate, and what it reaches.

flowchart LR
  SELF["platform-privacy-scan-api"]
  SELF -->|runtime| n_application_dlp["application-dlp"]
  SELF -->|runtime| n_content_assets["content-assets"]
  SELF -->|runtime| n_domain_catalog["domain-catalog"]
  SELF -->|runtime| n_domain_geo["domain-geo"]
  SELF -->|runtime| n_domain_notifications["domain-notifications"]
  SELF -->|runtime| n_domain_pricing_rules["domain-pricing-rules"]
  SELF -->|runtime| n_domain_privacy_research["domain-privacy-research"]
  SELF -->|runtime| n_domain_reviews["domain-reviews"]
  SELF -->|runtime| n_domain_taxonomy["domain-taxonomy"]
  SELF -->|runtime| n_foundation_audit_log["foundation-audit-log"]
  SELF -->|runtime| n_foundation_crypto_sign["foundation-crypto-sign"]
  SELF -->|runtime| n_foundation_money["foundation-money"]
  SELF -->|runtime| n_identity_tenant["identity-tenant"]
  SELF -->|runtime| n_infrastructure_ai["infrastructure-ai"]
  SELF -->|runtime| n_infrastructure_dlp["infrastructure-dlp"]
  SELF -->|runtime| n_infrastructure_dlp_detect["infrastructure-dlp-detect"]
  SELF -->|runtime| n_infrastructure_fetcher["infrastructure-fetcher"]
  SELF -->|runtime| n_infrastructure_jobs["infrastructure-jobs"]
  SELF -->|runtime| n_infrastructure_search["infrastructure-search"]
  SELF -->|runtime| n_infrastructure_storage["infrastructure-storage"]
  SELF -->|runtime| n_infrastructure_tenant_pool["infrastructure-tenant-pool"]
  SELF -->|runtime| n_operations_assessments["operations-assessments"]
  SELF -->|runtime| n_operations_rate_limit["operations-rate-limit"]
  SELF -->|runtime| n_platform_html_components["platform-html-components"]
  classDef self fill:#1f883d,stroke:#1f883d,color:#fff;
  class SELF self;

Feature flags

No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.

Targets

Kind	Name	Source
bin	`platform-privacy-scan-api`	`src/main.rs`
lib	`platform_privacy_scan_api`	`src/lib.rs`
test	`capability_bridge_live`	`tests/capability_bridge_live.rs`
test	`outbound_gate`	`tests/outbound_gate.rs`
test	`policy_profiles`	`tests/policy_profiles.rs`

Error model

Error type	Named by
`KeyLoadError`	`choose_key`
`MintError`	`mint`
`VerifyError`	`verify`

Operational characteristics

Property	Evidence
async public surface	yes
async runtime	yes
database access	yes
network I/O	yes
unsafe code	none detected
environment variables	yes

No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.

Configuration

Variable	Read in
`ALLOW_DEV_KEY`	`src/lib.rs`
`ANTHROPIC_API_KEY`	`src/lib.rs`
`API_KEY`	`src/lib.rs`
`BIND_ADDR`	`src/lib.rs`
`CAPABILITY_KEY_FILE`	`src/lib.rs`
`CAPABILITY_SIGNING_KEY`	`src/lib.rs`
`CAPABILITY_VECTORS_WRITE`	`src/capability.rs`
`CARGO_MANIFEST_DIR`	`src/capability.rs`
`DATABASE_URL`	`src/lib.rs`
`DLP_AUDIT_ACTOR_ID`	`src/gate.rs`
`DLP_AUDIT_DATABASE_URL`	`src/gate.rs`
`DLP_AUDIT_DEVICE_ID`	`src/gate.rs`
`DLP_AUDIT_TENANT_ID`	`src/gate.rs`
`DLP_CLASSIFIER`	`src/classifier.rs`
`DLP_GATE_BYPASS_UNTIL`	`src/gate.rs`
`DLP_GATE_POLICY`	`src/gate.rs`
`DLP_POLICY_PATH`	`src/gate.rs`
`EBAY_APP_ID`	`src/lib.rs`
`EBAY_CERT_ID`	`src/lib.rs`
`HOME`	`src/basemap.rs`
`IDENTITY_SPINE_DATABASE_URL`	`src/lib.rs`
`PSA_ALLOWED_HOSTS`	`src/lib.rs`
`SIGHTING_ARCHIVE_DATABASE_URL`	`src/lib.rs`
`SIGHTING_ARCHIVE_MEDIA_ROOT`	`src/basemap.rs`

No workspace crate depends on this one.

Verification

Kind	Count
Unit tests	326
Integration tests	12
Examples	0
Doctests	0

Evidence by module. How often each public module is named by something executable.

Module	Tests	Examples	Consumers
`crate root`	3	0	0
`capability`	17	0	0
`gate`	10	0	0
`principal`	7	0	0
`protocol`	4	0	0
`provider_lease`	4	0	0

What the tests establish, by name:

a_queued_command_arrives_signed_and_leaves_an_audit_row — tests/capability_bridge_live.rs
an_extension_that_cannot_verify_is_told_to_upgrade_rather_than_served — tests/capability_bridge_live.rs
ask_ais_secret_prompt_is_403_blocked — tests/outbound_gate.rs
ask_chatgpt_secret_prompt_is_403_blocked — tests/outbound_gate.rs
browser_origin_post_is_rejected — tests/outbound_gate.rs
clean_prompt_passes_gate_within_latency_budget — tests/outbound_gate.rs
extension_command_handcrafted_ask_is_403_blocked — tests/outbound_gate.rs
poisoned_policy_fails_closed_with_503_contract — tests/outbound_gate.rs
redacted_resend_passes_the_gate — tests/outbound_gate.rs
laptop_profile_loads_and_matches_documented_posture — tests/policy_profiles.rs
laptop_profile_matches_builtin_default_actions — tests/policy_profiles.rs
strict_profile_loads_and_blocks_everything — tests/policy_profiles.rs
a_bad_link_is_named_as_the_link — src/annotations.rs
a_link_longer_than_the_cap_is_refused — src/annotations.rs
a_link_that_is_script_is_not_a_link — src/annotations.rs
a_well_formed_annotation_is_accepted — src/annotations.rs
an_annotation_needs_a_label_and_a_profile — src/annotations.rs
ordinary_links_and_no_link_are_both_fine — src/annotations.rs
oversized_fields_are_named_rather_than_truncated — src/annotations.rs
a_backwards_range_is_refused_rather_than_reordered — src/basemap.rs
a_bounded_range_is_inclusive_at_both_ends — src/basemap.rs
a_multi_range_request_is_not_answered_with_one_of_them — src/basemap.rs
a_suffix_longer_than_the_file_is_the_whole_file — src/basemap.rs
a_suffix_range_is_the_end_of_the_file_and_not_the_start — src/basemap.rs
an_end_past_the_file_is_clamped_to_it — src/basemap.rs
an_open_ended_range_runs_to_the_last_byte — src/basemap.rs
no_range_header_is_not_a_range — src/basemap.rs
nonsense_is_not_a_range — src/basemap.rs
only_the_three_vendored_files_are_reachable — src/basemap.rs
a_capability_for_another_installation_is_refused_here — src/capability.rs
_… 308 more_

Documentation coverage

Measure	Documented	Total
Public items with rustdoc	64	74
Public modules with a `//!` block	5	5

pie showData
    title Public items with rustdoc
    "Documented" : 64
    "No rustdoc detected" : 10

Metrics

Metric	Value
Rust source files	26
Source lines	28395
Code lines	21894
Public API items	74
Public modules	5
Tests	338
Examples	0
Cargo features	0
Direct runtime dependencies	48
Workspace reverse dependencies	0

pie showData
    title Public API by kind
    "constant" : 6
    "enum" : 8
    "function" : 18
    "method" : 29
    "struct" : 13

pie showData
    title Rust source composition
    "Code" : 21894
    "Blank or comment" : 6501

Generation

Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.

All platform · Manual