Crate allow_core 

Core data model for cargo-allow source-tree exception governance.

This crate defines the shared finding, policy-entry, selector, lifecycle, match-outcome, path-normalization, and stable fingerprint primitives used by the cargo-allow crate family. It does not scan source files, invoke Cargo, compile code, or execute repository artifacts.

Structs

AllowConfig

AllowEntry

CargoAllowActionV1

One typed next action bound to a diagnostic.

CargoAllowDiagnostic

Structured validation or execution detail.

CargoAllowDiagnosticBatchV1

A versioned batch of diagnostics computed against one repository snapshot.

CargoAllowDiagnosticV1

One semantic diagnostic. Its four judgment dimensions are independent fields; none is derived from another.

CargoAllowError

The unified error type for the cargo-allow workspace.

CargoAllowErrorLocation

One-based source location attached to a parse or validation diagnostic.

FileFamilyRule

Finding

LaneConfig

LastSeen

LedgerPosture

Orthogonal movement and posture delta for a ledger-state projection.

LedgerProvenance

Lifecycle

MatchOutcome

PartialDataBoundary

Whether a diagnostic batch covers the intended scope or was bounded by partial data / an instrument limit.

RelatedLocation

A typed related location (e.g. the requirement, seam, test subject, or receipt connected to this diagnostic).

RequiredProof

The proof a caller should rerun after applying an action.

Requirements

Per-ledger requirements toggles. Defaults are intentionally strict on ownership/accountability (owner/reason/classification/lifecycle required) and on unsafe findings (unsafe_evidence_required: true) while ordinary evidence is advisory by default (evidence_required: false).

Selector

SimpleDate

SourcePosition

A line/column position. column == None is an explicit line-only (degraded) location rather than a fabricated precise column.

SourceRange

An exact source location. A None range with a path is a file-level location; a Some start with a line-only SourcePosition is an explicit degraded result, not a precise range pretending to be one.

Span

StructuralIdentity

WorkspaceConfig

Enums

ActionApplicability

How an action may be applied.

ActionKind

The closed vocabulary of what the next action is. Only deterministic, non-inventive changes may be ActionApplicability::Automatic.

CappedReadError

Why a capped text read failed.

CargoAllowDiagnosticSeverity

Severity for a machine-readable diagnostic carried by a command error.

CargoAllowErrorKind

Structured kind for CargoAllowError, enabling programmatic consumers (CI tooling, sibling tools) to branch on error class instead of string-matching the rendered message.

DiagnosticConfidence

How sure the judgment is, independent of severity and posture.

DiagnosticResultClass

What kind of result this is. An instrument crash is not a repository defect, and unsupported capability is not a clean pass — each stays distinct.

DiagnosticSeverity

Likely defect / user impact of a diagnostic. Independent of RulePosture: a high-severity judgment recommendation is not automatically blocking.

FindingKind

LaneEnforcementMode

MatchStatus

MissingObligation

The closed vocabulary of why a diagnostic’s obligation is unmet. Each names what remains unproven after structural repair.

NetPosture

Aggregate PR diff net posture for summary surfaces (diff.net_posture).

PositionBase

Whether line/column offsets are zero- or one-based. Explicit so conversions are contractual rather than assumed.

PostureDelta

Canonical posture quality delta for a retained ledger entry or finding.

PresenceMovement

Canonical presence movement for ledger entries and findings in a diff context.

RelatedRole

The typed role a related location plays relative to the primary diagnostic.

RulePosture

How the rule gates, independent of severity. Shadow observes without affecting exit posture; Blocking is a deterministic gate.

SourceEncoding

Column-offset encoding for a source position. Made explicit so an LSP (UTF-16) and CLI (UTF-8) never silently disagree on a column number.

SourceProvenance

Whether the source is authored or a generated artifact. A generated location carries different repair semantics (regenerate vs. edit).

WorkspaceMode

The supported workspace default check modes, mirroring the CLI --mode flag and the [workspace] default_mode policy field. A typo’d or unsupported value (e.g. "no_new") is rejected at validation time rather than silently treated as a string that never matches a real mode.

Constants

BUILTIN_FILE_FAMILY_CODES

Built-in non-Rust family codes that repository rules must not redefine.

DIAGNOSTIC_KERNEL_SCHEMA

Semantic schema/generation tag for the diagnostic kernel.

GLOB_MATCH_MAX_STEPS

Maximum recursive match steps for one glob evaluation.

MAX_IDENTITY_FIELD_LEN

Maximum length (bytes) of any source-derived string field in a StructuralIdentity. Caps the DoS / noisy-diff surface from a scanned file with a megabyte-long identifier (#1919). Generous enough for realistic Rust paths/identifiers (e.g. deeply-qualified module paths), small enough that an artifact cannot be inflated by a single field.

POLICY_NAME

The only recognized policy name.

REPOSITORY_WIDE_FAMILIES

Finding families whose evidence is derived from repository-wide context.

SOURCE_FILE_READ_MAX_BYTES

Maximum bytes cargo-allow will load from one source-tree text file.

STRUCTURAL_IDENTITY_SCHEMA_ID

SUPPORTED_SCHEMA_VERSION

Supported policy schema versions. "1" is accepted as a legacy alias.

SUPPORTED_SCHEMA_VERSION_ALIAS

Functions

allow_entry_broad_scope

allow_entry_content_fingerprint

Deterministic content fingerprint of an allow entry’s full state, for mutation-receipt provenance (CARGO-ALLOW-SPEC-0008 “Mutation Receipt Envelope”). The v1 canonical serialization is length-prefixed and has a fixed field order, so it is independent of Rust’s Debug formatting and platform path separators — path, glob, and selector.glob are all slash-normalized before hashing, so semantically identical entries authored on Windows and Unix fingerprint identically. The SHA-256 digest is provenance evidence, not an identity or matching key.

effective_lane_posture_for_findings

finding_identity_key

glob_matches

glob_matches_str

is_repository_wide_family

json_escape

lane_enforcement_mode_for_kind

normalize_path

Normalize a path for source-tree identity and matching.

normalize_snippet

read_file_capped

Read arbitrary file bytes within the source-tree per-file limit.

read_file_capped_with_limit

Read arbitrary file bytes only when the file stays within limit.

read_text_file_capped

Read a UTF-8 text file only when its size is within SOURCE_FILE_READ_MAX_BYTES.

read_text_file_capped_with_limit

Read a UTF-8 text file only when its size is within limit bytes.

sha256_v1_bytes

Versioned SHA-256 digest for exact artifact byte bindings.

source_tree_path_is_ignored

source_tree_path_matches_filter

source_tree_scope_has_wildcard

stable_hash_hex

strip_win32_verbatim_prefix

Strip Win32 verbatim path prefixes (\\?\ and \\?\UNC\) from a path string for clean display in error messages and JSON output (#3180-#3187).

Type Aliases

CargoAllowResult