Struct Fence 

pub struct Fence { /* private fields */ }

Session-level L3 enforcement over a FencePolicy.

The policy value stays shareable and pure; one Fence per session owns the mutable observed-set and the audit ring behind a mutex.

Implementations

impl Fence

pub fn new(policy: FencePolicy) -> Self

pub fn policy(&self) -> &FencePolicy

The immutable layer policy this fence enforces.

pub fn fence_read(&self, raw: &Path) -> Result<(Option<Metadata>, u64), FsError>

Observe a path for a future guarded write. Runs L0-L2 first; a denied observation never enters the observed-set. Existing files record their version fingerprint; missing paths record version 0.

Returns (metadata, version); metadata is None for missing paths.

pub fn fence_write( &self, raw: &Path, guard: WriteGuard, contents: &[u8], ) -> Result<(), FsError>

Write file contents under the L0-L2 layers plus the L3 guards.

• Every write names a guard contract (WriteGuard).
• In modes without blind-write allowance (ReadOnly, WorkspaceWrite) the canonical path must have been observed through Fence::fence_read first, or the write fails with FS_NOT_OBSERVED. This covers every contract, including WriteGuard::Unconditional and creating brand-new files: only a mode that allows blind writes skips the ledger.
• WriteGuard::CreateIfAbsent fails with FS_EXISTS when the canonical path already exists.
• WriteGuard::ReplaceIfVersion fails with FS_VERSION_CONFLICT when the file is gone or its fingerprint differs from the version captured at observation time.
• Bytes land in a sibling temporary file renamed into place, so an interrupted write leaves no torn file behind.

pub fn audit_log(&self) -> Vec<AuditEntry>

Snapshot of the bounded audit ring, oldest first.

Trait Implementations

impl Debug for Fence

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.