Struct Gate 

pub struct Gate { /* private fields */ }

The leash enforcer. One gate backs a session (or a sub-delegation); it tracks the remaining call budget and the generation it is valid for.

The gate is interior-mutable on its budget (an AtomicU64) so authorize takes &self — a registry can hold one shared gate behind an Arc.

Implementations

impl Gate

pub fn new(generation: u64) -> Gate

A gate at generation, with no independent budget cap of its own (the grant’s max_calls still applies on the first authorize) and the honest P0 sandbox kind (SandboxKind::None).

pub fn with_budget(generation: u64, max_calls: CountBound) -> Gate

A gate whose call budget is seeded from a CountBound — typically the max_calls of the session grant — so the budget persists across multiple authorize calls on this gate. Unlimited ⇒ no cap.

pub fn with_sandbox(self, sandbox: &dyn Sandbox) -> Gate

Record the OS-level sandbox this gate’s contexts run under. A tool reads it back via ToolContext::sandbox_kind. (P3 wires a real Sandbox.)

pub fn with_strength_floor(self, floor: AxisEnforcement) -> Gate

Set the required fence-strength floor for every context this gate mints (ADR 0012 D3) — the weakest per-axis enforcement the principal accepts before a confinement site refuses to spawn. A strong principal raises it to AxisEnforcement::Kernel (fail closed on any restricted axis the real backend cannot kernel-confine); the default is the permissive AxisEnforcement::Advisory. The floor only ever raises on delegation (it cannot be lowered from inside a running tool — it has no setter on the minted ToolContext).

pub fn generation(&self) -> u64

The generation this gate embodies.

pub fn authorize( &self, tool: &dyn Tool, granted: &Caveats, ) -> Result<ToolContext, ToolError>

The only path to a ToolContext.

See the module docs for the four enforcement steps. Order matters: we deny on authority/generation before charging the budget, so a denied request does not consume a call.

impl Gate

Step-up admission (human-presence capabilities) — see [crate::step_up].

Gate::evaluate is the pure entry point; when a step-up is owed it returns Decision::NeedsDischarge without minting or charging. The caller obtains a proof and re-presents it to Gate::authorize_with_discharge. The gate only ever verifies a proof — it never performs the gesture (that is a host capability, a sibling of Sandbox).

pub fn evaluate( &self, tool: &dyn Tool, granted: &Caveats, request: &CallRequest, policy: &StepUpPolicy, ) -> Decision

Evaluate a call under a StepUpPolicy without performing any gesture.

Decision::Allow (minted and charged) when no step-up is owed, Decision::NeedsDischarge (nothing minted or charged) when one is, and Decision::Deny on a generation or budget failure.

pub fn authorize_with_discharge( &self, tool: &dyn Tool, granted: &Caveats, request: &CallRequest, policy: &StepUpPolicy, attempt: &DischargeAttempt<'_>, ) -> Result<(ToolContext, Option<Attestation>), ToolError>

Admit a call that owes a step-up by verifying a [Discharge].

Recomputes the bound Challenge from request, the gate’s generation, and nonce, then asks verifier to check the proof. On success mints the context (least authority, exactly as Gate::authorize) and — when the policy demanded a record — returns a content-addressed Attestation. Ordering matches authorize: deny on generation or verification before charging, so a rejected discharge consumes no call. With no step-up owed this degenerates to an ordinary authorize.

pub fn authorize_step_up( &self, tool: &dyn Tool, granted: &Caveats, request: &CallRequest, policy: &StepUpPolicy, provider: &dyn DischargeProvider, verifier: &dyn DischargeVerifier, nonce: [u8; 32], ) -> Result<(ToolContext, Option<Attestation>), ToolError>

Orchestrate the whole step-up sequence — evaluate, run the host ceremony, and authorize — so a host needs one call for the gated path.

Computes the requirement for request; if no gesture is owed this degenerates to an ordinary Gate::authorize (with None for the attestation). Otherwise it runs the host’s provider ceremony, supplying the gate’s generation and the caller’s single-use nonce, then forwards the produced proof to Gate::authorize_with_discharge — reusing that single verified mint path (this adds no second mint site).

Fail-closed: a provider error (the human declined, no authenticator, a transport failure) returns ToolError::denied and mints/charges nothing. The gate still verifies the proof itself via verifier (the presence floor and the challenge binding); the provider is never trusted to self-attest (ADR 0007 D5), so a verifier that rejects a too-weak or mismatched proof still denies even when the provider returned Ok.