Module grants 

The grants an agent never used, read from an export.

Per manifest digest, each tool grant with the runs and calls that exercised it; the menu values chosen; observed outbound bytes against the egress ceiling; and a proposed manifest with the unused grants removed, for a person to review, sign and publish. Nothing here applies it.

A grant is named only where a call’s arguments were readable: on an unsealed export always, on a sealed one only with a caller-supplied ring and a standing key. Where any call under a digest could not be read, unused is not established for that digest and the report says so.

Reads one export and the manifests it is handed. It opens no store and holds no client.

Structs

DigestRow

One manifest digest’s runs.

EgressRow

Observed outbound bytes against the declared ceiling.

GrantReport

The grant exercise report.

GrantRow

One tool grant under one digest.

Grants

The manifests to measure, and the ring that opens sealed arguments.

Proposal

A proposed manifest: the input less whole unused grants.

Window

The runs read and whether the file was whole.

Enums

Declaration

Which declaration governed a group of runs.

GrantsError

Why the report could not answer at all.

Mark

What one grant’s record of use establishes.

MenuRow

The values one protected field’s menu saw.