tools-ir-triage — IMP FORGE

The binary that ships on the IR boot stick: gate a target, capture a disk under a verified write-block, verify the artifact into a signed receipt, and run the registry and event-log rules against a mounted image. Composes operations-block-imaging, operations-device-safety and infrastructure-registry-forensics -- it wires them, it does not reimplement them.

Tier	tools
Role	tooling
Path	`crates/tools/ir-triage`
Edition	2021
Targets	ir-triage, tools_ir_triage
Public items	8 across 0 modules
Tests	11

What it is for

The decidable parts of ir-triage, split from the binary so they can be tested.

Everything here is a pure function over values the caller already has. The binary reads the world — udev, /proc/mounts, files — and hands it in. That split is why the reverse-tunnel naming rule and the observation rendering are testable at all.

Capabilities

`crate root`

The decidable parts of ir-triage, split from the binary so they can be tested.

Item
`pub const IR_PORT_RANGE: std::ops::RangeInclusive <u16>`
`fn render_observations(observations : & Observation) -> Vec <String>`
`fn normalize_esp_path(path : & str) -> String`

`EspEntry`

The decidable parts of ir-triage, split from the binary so they can be tested.

Item
`pub struct EspEntry`
`fn boot_binary_observations(entries : & EspEntry) -> Vec <Observation>`

`TriageError`

The decidable parts of ir-triage, split from the binary so they can be tested.

Item
`pub enum TriageError`
`fn hostname_for(port : u16) -> Result <String, TriageError>`
`fn port_for(hostname : & str) -> Result <u16, TriageError>`

How to use it

No examples/ target and no doctest in this crate's rustdoc. The tests listed under Verification are the closest executable usage.

Module structure

No public modules: the crate root is its whole surface.

Public surface

`crate root`

Item	What it is
`pub const IR_PORT_RANGE: std::ops::RangeInclusive <u16>`	The reverse-tunnel port range reserved for IR sticks
`pub enum TriageError`	Errors from the decidable layer.
`fn hostname_for(port : u16) -> Result <String, TriageError>`	The one identity a stick carries: system hostname, cdmx account, usd `node_id` and DNS alias are all this string, so reading it tells you the port without a lookup.
`fn port_for(hostname : & str) -> Result <u16, TriageError>`	The inverse
`fn render_observations(observations : & Observation) -> Vec <String>`	Render observations as cited lines
`pub struct EspEntry`	One executable found on an EFI System Partition, as the binary read it: the path relative to the ESP root, its size, its SHA-256, and whether its bytes carry a Microsoft publisher string
`fn normalize_esp_path(path : & str) -> String`	Normalize an ESP-relative path for comparison: backslashes to slashes, trimmed leading slash, lowercased
`fn boot_binary_observations(entries : & EspEntry) -> Vec <Observation>`	Turn an ESP inventory into cited `Observation`s

No pub use re-exports: every item above is declared in this crate.

Boundary

Reaches into foundation, infrastructure, operations.

Shares tier tools with 84 other crates: tools-advisory-reach, tools-archive-guard, tools-artifact-scaffold, tools-ask-ai-core, tools-ask-ais, tools-ask-gemini, tools-book, tools-book-report, … (84 total).

_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._

Where it sits

Tier (ontology)	`tools`
Architectural role (taxonomy)	`tooling`
Location	`crates/tools/ir-triage`
Vocabulary in force (lexicon)	`current`

Tier flow. Which tiers this crate's own edges cross.

flowchart LR
  n_tools["tools"] --> n_foundation["foundation"]
  n_tools["tools"] --> n_infrastructure["infrastructure"]
  n_tools["tools"] --> n_operations["operations"]

Dependencies

Runtime, in this workspace.

Crate	Tier	Optional	Only on
`foundation-audit-log`	foundation	no	always
`foundation-crypto-sign`	foundation	no	always
`infrastructure-bitlocker-forensics`	infrastructure	no	always
`infrastructure-host-forensics`	infrastructure	no	always
`infrastructure-registry-forensics`	infrastructure	no	always
`operations-block-imaging`	operations	no	always
`operations-device-safety`	operations	no	always

Runtime, from outside the workspace.

Crate	Requirement	Features	Optional	Only on
`anyhow`	`^1`	—	no	always
`clap`	`^4`	`derive`	no	always
`rand_core`	`^0.6`	`getrandom`	no	always
`serde_json`	`^1`	—	no	always
`thiserror`	`^2`	—	no	always

Development, in this workspace.

Crate	Tier	Optional	Only on
`tools-cli-conformance`	tools	no	always

Build. None.

Depended on by. Nothing in this workspace.

Signal flow — what reaches this crate, and what it reaches.

flowchart LR
  SELF["tools-ir-triage"]
  SELF -->|development| n_tools_cli_conformance["tools-cli-conformance"]
  SELF -->|runtime| n_foundation_audit_log["foundation-audit-log"]
  SELF -->|runtime| n_foundation_crypto_sign["foundation-crypto-sign"]
  SELF -->|runtime| n_infrastructure_bitlocker_forensics["infrastructure-bitlocker-forensics"]
  SELF -->|runtime| n_infrastructure_host_forensics["infrastructure-host-forensics"]
  SELF -->|runtime| n_infrastructure_registry_forensics["infrastructure-registry-forensics"]
  SELF -->|runtime| n_operations_block_imaging["operations-block-imaging"]
  SELF -->|runtime| n_operations_device_safety["operations-device-safety"]
  classDef self fill:#1f883d,stroke:#1f883d,color:#fff;
  class SELF self;

Feature flags

No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.

Targets

Kind	Name	Source
bin	`ir-triage`	`src/main.rs`
lib	`tools_ir_triage`	`src/lib.rs`

Error model

Error type	Named by
`TriageError`	`hostname_for`, `port_for`

Operational characteristics

Property	Evidence
async public surface	none detected
async runtime	none detected
database access	none detected
network I/O	none detected
unsafe code	none detected
environment variables	none detected

No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.

Configuration

No environment variable is read with a literal name anywhere in this crate. A variable whose key is computed at run time cannot be listed here, and is not claimed to be absent.

No workspace crate depends on this one.

Verification

Kind	Count
Unit tests	11
Integration tests	0
Examples	0
Doctests	0

Evidence by module. How often each public module is named by something executable.

Module	Tests	Examples	Consumers
`crate root`	8	0	0

What the tests establish, by name:

a_critical_loader_without_a_microsoft_string_is_flagged — src/lib.rs
a_hostname_states_its_port_and_round_trips — src/lib.rs
a_hostname_that_is_not_an_ir_name_is_refused_rather_than_guessed — src/lib.rs
a_loader_at_a_path_windows_never_writes_is_flagged — src/lib.rs
a_stock_windows_esp_yields_only_inventory_no_flags — src/lib.rs
non_efi_files_are_not_inventoried_as_loaders — src/lib.rs
path_comparison_is_separator_and_case_insensitive — src/lib.rs
ports_outside_the_reserved_band_are_refused — src/lib.rs
rendering_cites_and_does_not_conclude — src/lib.rs
cli_definition_conforms — src/main.rs
the_binary_can_say_which_version_it_is — src/main.rs

Documentation coverage

Measure	Documented	Total
Public items with rustdoc	8	8
Public modules with a `//!` block	0	0

pie showData
    title Public items with rustdoc
    "Documented" : 8
    "No rustdoc detected" : 0

Metrics

Metric	Value
Rust source files	2
Source lines	723
Code lines	528
Public API items	8
Public modules	0
Tests	11
Examples	0
Cargo features	0
Direct runtime dependencies	12
Workspace reverse dependencies	0

pie showData
    title Public API by kind
    "constant" : 1
    "enum" : 1
    "function" : 5
    "struct" : 1

pie showData
    title Rust source composition
    "Code" : 528
    "Blank or comment" : 195

Generation

Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.

What it is for

Capabilities

crate root

EspEntry

TriageError

How to use it

Module structure

Public surface

Boundary

Where it sits

Dependencies

Feature flags

Targets

Error model

Operational characteristics

Configuration

Related capabilities

Verification

Documentation coverage

Metrics

Generation

`crate root`

`EspEntry`

`TriageError`