Module security 

Security helpers shared by providers and transports.

Three rules, enforced here so no provider has to remember them:

1. Secrets never cross the boundary as content. An evaluated secret becomes Value::Secret, a marker; there is no variant that carries the bytes.
2. Redaction is monotone. A redacting capability sees paths but not secret-cone labels; a non-redacting one still never sees values.
3. Diagnostics are value-free. Provider errors carry stable codes.

Constants

SECRET_MARKER

Marker used wherever a secret would otherwise appear.

Functions

assert_no_secret_material

Ensure a response carries no secret material.

check_module_payload

Validate an outgoing module payload before it is handed to a transport or a tool.

from_active_value

Convert an evaluated Active value into an RPC value.

redact_cone_labels

Redact labels that name nodes in the secret cone.

redact_value

Redact a value tree that may contain secret markers because a path is tainted (used when a capability is redacting but a provider already built labels).