Crate boundgraph_check 

Layer 5 of BoundGraph: the checkers, and the signatures that make them evidence.

This is where Law III is cashed in. A reasoner proposes; a tool acts; a slicer condenses. None of that is allowed to commit anything. A state change commits only on Evidence — a verdict from a model-free checker, signed, naming exactly what it looked at.

The two guarantees, and where they live

Model-free. Checker::check refuses to run a checker whose declared capability set is not within checker_ceiling, which omits net and secret. A checker therefore cannot reach an inference API — not by convention, by authority. The same ceiling omits time and rand, which is what makes the determinism requirement enforceable rather than aspirational.

Unforgeable. Checker::check puts the digests of the work order and the condensate into the evidence itself and then signs the whole thing, so a passing verdict cannot be harvested and reattached to a patch that failed. Both steps are in the trait’s provided method, so no implementation can skip either.

Status

Feature 08, milestone M3. Built in dependency order rather than story order: signing has no dependency on the trait, and check returns signed evidence, so signing comes first.

Story	Module
US-0802 evidence signing	sign
US-0801 checker trait	checker
US-0803 JSON Schema checker	schema
US-0804 compile checker	sandbox, compile
US-0805 test-run checker	testrun
US-0806 diff-scope checker	scope

Re-exports

pub use checker::CheckError;

pub use checker::Checker;

pub use checker::Constant;

pub use checker::Judgement;

pub use checker::checker_ceiling;

pub use checker::ensure_model_free;

pub use compile::CompileChecker;

pub use compile::CompileConfig;

pub use compile::ProbeError;

pub use compile::SandboxedCompile;

pub use sandbox::Command;

pub use sandbox::Outcome;

pub use sandbox::Sandbox;

pub use sandbox::SandboxError;

pub use sandbox::workspace_grant;

pub use scope::Change;

pub use scope::ChangeKind;

pub use scope::DiffScope;

pub use scope::PatchError;

pub use scope::parse_patch;

pub use testrun::SandboxedTests;

pub use testrun::TestConfig;

pub use testrun::failing_tests;

pub use sandbox::Unconfined;

pub use schema::DEFAULT_BUDGET;

pub use schema::MAX_DEPTH;

pub use schema::SUPPORTED_KEYWORDS;

pub use schema::Schema;

pub use schema::SchemaChecker;

pub use schema::SchemaError;

pub use schema::Validation;

pub use schema::Violation;

pub use sign::KeyRing;

pub use sign::LocalKey;

pub use sign::PUBLIC_KEY_LEN;

pub use sign::PublicKey;

pub use sign::SEED_LEN;

pub use sign::Sign;

pub use sign::SignError;

pub use sign::VerifyError;

pub use sign::sign_evidence;

pub use sign::verify;

Modules

checker

The contract every checker meets, and the machinery that makes it hold.

compile

Does it build?

sandbox

Where a checker runs something it did not write.

schema

The cheapest deterministic check there is: does this output match its declared shape?

scope

Did the patch touch anything it had no business touching?

sign

Signing a verdict, and verifying one without asking anybody.

testrun

“I fixed the bug”, made checkable.

Structs

CheckerId

Re-exported so a consumer holding evidence does not also depend on boundgraph-core just for the types it is made of. Which checker produced a verdict, and at what version.

Evidence

Re-exported so a consumer holding evidence does not also depend on boundgraph-core just for the types it is made of. ε — a signed verdict from a checker or a quorum.

Signature

Re-exported so a consumer holding evidence does not also depend on boundgraph-core just for the types it is made of. An ed25519 signature over the canonical encoding of an Evidence.

SigningKeyId

Re-exported so a consumer holding evidence does not also depend on boundgraph-core just for the types it is made of. Identifies the key a signature was made with.

Enums

EvidenceKind

Re-exported so a consumer holding evidence does not also depend on boundgraph-core just for the types it is made of. How a verdict was reached.

Verdict

Re-exported so a consumer holding evidence does not also depend on boundgraph-core just for the types it is made of. The outcome of a check.