Struct Disclosure 

pub struct Disclosure {
    pub unbridled: bool,
    pub normalizations_disabled: Vec<String>,
    pub net_over_delivery: bool,
    pub backend_forced: Option<String>,
    pub engine: Option<String>,
    pub human_gate: HumanGate,
}

Operator-facing disclosure — what an operator should know about how this run was shaped, kept strictly separate from the EnforcementReport (ADR 0016 precedent / ADR 0017 D6). Disclosure is informational: it records over-delivery, disabled normalizations, a forced backend, and the loud unbridled opt-in. It never participates in crate::fence_strength or the enforcement claim — a run can never raise its confinement claim by disclosing something, and disclosing something can never lower it either.

Quiet by default: the whole block is omitted from JSON when nothing is worth disclosing (the common bridled path). The one field that always surfaces when set is Self::unbridled — an unbridled run is never quietly hidden.

Fields

unbridled: bool

The run was explicitly unbridled (confinement off — Caveats::top() + advisory floor + SandboxKind::None), an acknowledged operator opt-in (#151/I12). Always emitted when true; never reachable by omission.

normalizations_disabled: Vec<String>

Automatic normalizations the operator turned off, by name (e.g. ldd_closure, nss_closure_fallback) — so a degraded run is legible.

net_over_delivery: bool

A restricted net allow-list is enforced above the reported floor — the loopback egress proxy admits exactly the granted hosts while the report honestly keeps the axis advisory (proxy-, not kernel-, enforced; #124/#128, ADR 0016). Discloses the over-delivery without raising the claim.

backend_forced: Option<String>

A sandbox backend was overridden from the default selection (downgrade / select-available only; #149/I10). Names the backend actually applied.

engine: Option<String>

Which shell engine ran this operation (ADR 0019 D4 / #194) — e.g. "safe-subset" or "sandbox-host". Lets an embedder log which engine a dispatch used when more than one is registered. None when unset.

human_gate: HumanGate

The human step-up gate still in force (ADR 0018 D11 / R5). Distinguishes an unbridled run’s two postures — passkey/prompt = Supervised-free (a gesture still gates HIGH-consequence acts), none = Autonomous (no human in the loop). Shown whenever the block is emitted (i.e. when unbridled), so a consumer can never confuse “free but FIDO-gated” with “no human at all”.

Implementations

impl Disclosure

pub fn is_quiet(&self) -> bool

true when there is nothing to disclose — the whole block is then omitted from JSON. (An unbridled run is not quiet, so it always surfaces.)

Trait Implementations

impl Clone for Disclosure

fn clone(&self) -> Disclosure

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Disclosure

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for Disclosure

fn default() -> Disclosure

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Disclosure

fn deserialize<__D>( __deserializer: __D, ) -> Result<Disclosure, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Disclosure

impl PartialEq for Disclosure

fn eq(&self, other: &Disclosure) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Disclosure

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Disclosure