Struct RuleEngine 

pub struct RuleEngine { /* private fields */ }

Refactor Wave-2 Tier-A2 (issue #850) — unified rule engine consumed by every governance entry point.

Before this refactor each of the three callsites that consult governance_rules (the substrate GOVERNANCE_PRE_WRITE hook, the wire_check agent-external hook, and the audited check_agent_action MCP / CLI surface) duplicated the rule-load + first-refusal-wins loop in its own function (check_agent_action, check_agent_action_no_audit, check_agent_action_deferred). Adding a new severity variant or matcher field meant touching three near-identical loops. The RuleEngine collapses the load + routing logic into one place; the three legacy free functions remain as thin wrappers so the public API is wire-stable.

rules holds the snapshot of enabled rules of the target kind (the engine is constructed per-action, not per-table — kind-scoped loading matches the existing list_enabled_by_kind shape and preserves the signature-verification side effects in crate::governance::rules_store::list_enabled_by_kind).

The combinator is first-refusal-wins with warn falling through and log being silent — identical semantics to the pre-refactor inline loops.

Implementations

impl RuleEngine

pub fn load_for_action(conn: &Connection, action: &AgentAction) -> Result<Self>

Construct an engine scoped to a single AgentAction’s kind without consulting any cache. Equivalent to load_for_action_cached(conn, None, action).

Reads the enabled rule rows of matching kind from governance_rules via crate::governance::rules_store::list_enabled_by_kind; the signature-verification gate (L1-6 bypass-impossibility invariant) runs inside that helper and is preserved verbatim.

Errors

Propagates any SQLite error from list_enabled_by_kind.

pub fn load_for_action_cached( conn: &Connection, cache: Option<&RuleCache>, action: &AgentAction, ) -> Result<Self>

Cached variant of Self::load_for_action (#991).

When cache is Some, consults the per-instance RuleCache — cache hit returns the cached Arc<Vec<Rule>> without re-running the SQL + Ed25519-verify path; cache miss loads via crate::governance::rules_store::list_enabled_by_kind and inserts. When cache is None, behaves exactly like Self::load_for_action (no cache consultation, fresh load).

Errors

Propagates any SQLite error from list_enabled_by_kind.

pub fn from_rules(rules: Vec<Rule>) -> Self

Construct an engine directly from a pre-loaded rules slice. Useful for tests that want to skip the SQLite round-trip or for future callsites that already hold a cached rule list.

pub fn evaluate(&self, _agent_id: &str, action: &AgentAction) -> Decision

Evaluate action against the loaded rules. Returns the first-refusal-wins Decision.

agent_id is unused by the matcher today but threaded through so future agent-scoped matchers (operator allow-lists, agent quotas) can consult it without an API break.

pub fn rules(&self) -> &[Rule]

Borrow the loaded rule slice. Used by count_matching_rules and by tests that want to assert load-side behaviour without running the matcher.