Crate agentstategraph_taint 

Taint / quarantine / watch substrate for AgentStateGraph (see spec/TAINT_SPEC.md).

Dynamic runtime markers that bridge passive observation into enforcement. Every taint is a first-class commit (auditable, blameable, full intent metadata) and the pre-commit hook consults evaluate_access to gate writes.

This crate ships the types + the pure check algorithm. Storage lives in agentstategraph-storage; commit-pipeline wiring lives in agentstategraph (the main repository crate).

Structs

QuarantineParams

Parameters for Repository::quarantine.

Taint

A taint record. Persisted to the taints table in storage and round-tripped across the MCP / FFI / binding surfaces.

TaintCheck

Result of crate::evaluate_access. Consumed by the pre-commit hook + policy_evaluate_change integration.

TaintMetadata

Flat string-to-JSON map for kind-specific metadata. Wrapped so we can control the on-disk shape without bleeding HashMap<String, serde_json::Value> through every API.

TaintParams

Parameters for Repository::taint.

UntaintParams

Parameters for Repository::untaint.

UnwatchParams

Parameters for Repository::unwatch. Watches are lightweight so reason is optional.

WatchParams

Parameters for Repository::watch.

Enums

TaintEffect

Pre-commit-hook behavior for this taint.

TaintError

TaintKind

Discriminator between the three taint kinds.

TaintSeverity

Advisory severity. Does not change pre-commit semantics; used by consumers for triage ordering.

WatchDirection

Direction a watch threshold fires in.

Constants

REVIEW_CONFIDENCE_THRESHOLD

Required minimum commit confidence to pass a review-effect taint. Hardcoded at 0.9 per spec/TAINT_SPEC.md §“Effects”.

VERSION

Crate version exposed for downstream MCP / FFI introspection.

Functions

ancestor_candidates

Filter a candidate set down to taints whose path is either equal to request_path or a propagating ancestor of it.

evaluate_access

Evaluate access for (request_path, agent_id, confidence) against a candidate taint list. Returns the aggregated TaintCheck.

Type Aliases

UnquarantineParams

Parameters for Repository::unquarantine. Same shape as untaint.