Enum PathShapeViolation 

pub enum PathShapeViolation {
    Empty,
    Absolute,
    ParentEscape,
}

Tagged reason a caixa-author-supplied path can fail the sandboxed-relative shape gate every callback / script path must pass for the layout checker’s root.join(p) to stay inside the caixa root.

Returned by is_sandboxed_relative_path so each per-axis caller — crate::BehaviorSpec::validate on :behavior :on-* paths (b0c8389), crate::UpgradeInstruction::validate’s StateChange arm on :upgrade-from :state-change :script (26da2c7), every future axis admitting a user-supplied path — match-and-wraps the tag into its own typed *Invalid { slot, path } enum variant so the diagnostic still names which slot carried the malformed value. The tag is axis-agnostic; the wrapping per-axis variant carries the slot identity.

Sibling discriminator-style of the per-arm reason substrings every value-shape predicate already exposes (is_dns_1123_label, is_gateway_api_http_path, …) — but typed rather than string- shaped, because the per-axis variants for path violations were already split three ways (EmptyPath / AbsolutePath / ParentEscape in BehaviorError; EmptyScript / AbsoluteScript / ParentEscapeScript in UpgradeError), so collapsing them to a single *PathInvalid { reason } variant would regress the diagnostic shape rather than preserve it.

Variants

Empty

The path string is empty — PathBuf::new() or the canonical “I declared the slot but left the value blank” authoring footgun. root.join(PathBuf::new()) resolves to root itself, silently pointing the runtime’s LisleLoader at the project root rather than a file.

Absolute

The path is absolute — Path::join replaces the base with an absolute right-hand side, so root.join("/etc/passwd") resolves to "/etc/passwd" and escapes the project sandbox entirely. The Lunatic-style sandbox discipline (theory/INSPIRATIONS.md §III.1) requires every author-supplied path to live under the caixa root.

ParentEscape

The path contains a Component::ParentDir component anywhere — root.join("../sibling/x") traverses above the caixa root, the same sandbox-escape vector via parent-directory traversal. Caught regardless of where the .. component sits (leading, mid-path, trailing) so a future relaxation that only checks one position surfaces at this one predicate.

Implementations

impl PathShapeViolation

pub const fn is_empty(&self) -> bool

pub const fn is_absolute(&self) -> bool

pub const fn is_parent_escape(&self) -> bool

impl PathShapeViolation

pub const ALL: &'static [Self]

Exhaustive iteration surface for every consumer that walks the closed three-arm PathShapeViolation discriminator set — the paired byte-parity pin on the gen_platform::IsVariant-derived per-arm is_* predicate family, a future feira lint --explain-path-shape=<axis> per-arm listing of the accepted violation kinds, a future mesh.pleme.io/v1alpha1/Caixa CR materializer’s per-path admission-webhook rejection body naming the accepted-violation-tag set, any future property-test harness that sweeps every arm to compute per-arm diagnostic coverage. A future variant addition (a Symlink arm the future symlink-escape gate would carry once Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes) extends this slice as one edit and every consumer picks up the new entry by construction; the compiler-checked exhaustiveness on the sibling match arms in is_sandboxed_relative_path and require_sandboxed_lisp_path is the build-time guarantee that no arm forgets to grow.

Peer of the sibling closed-set fieldless typed enums’ crate::CaixaKind::ALL (6b1f4fb) / crate::CaixaDialeto::ALL (dd4f541) / crate::aplicacao::PlacementStrategy::ALL (18c7342) / crate::aplicacao::RateLimitUnit::ALL (6bce03d) / crate::dep::DepList::ALL (45ee563) / crate::supervisor::RestartStrategy::ALL (4eec29c) / crate::supervisor::RestartPolicy::ALL (dd32ccf) exhaustive-iteration surfaces — the tenth closed-set typed enum on the caixa surface to converge onto the same one-canonical-arm-list-per-enum discipline, and the first render-side path-shape-diagnostic axis (as distinct from an OTP-shape M2 slot or an M3 mesh slot) to reach it. Order matches variant declaration order verbatim (Empty → Absolute → ParentEscape) so the slice is the canonical ordering every exhaustive dispatch site (the Empty → Absolute → ParentEscape arm-ordering is_sandboxed_relative_path and every per-axis caller in crate::manifest::ManifestError preserve for diagnostic-precedence continuity) defers to.

pub const fn as_str(self) -> &'static str

Substrate-canonical per-PathShapeViolation lowercase-kebab-tag scalar accessor every consumer that renders the three-arm path-shape violation axis as user-facing text keys off — returns the per-arm byte-string ("empty" / "absolute" / "parent-escape") as a &'static str, the same lowercase tags a future feira lint --explain-path-shape=<axis> per-arm listing, a future mesh.pleme.io/v1alpha1/Caixa CR materializer’s per-path admission-webhook rejection body naming the accepted-violation-tag set, or a tracing::field::Value::Str-arm structured-log recorder on the caixa-build pipeline’s per-slot path-gate emission path would have otherwise reached via a format!("{:?}", violation).to_lowercase() round-trip through the std::fmt::Debug derive — with two silent drift footguns the substrate-canonical accessor closes at build time:

• the std::fmt::Debug derive’s per-arm output is not a stability guarantee (Rust’s own convention gives it as no guarantee at all), so a #[derive(Debug)] swap for a hand-rolled impl Debug that pretty-prints the arm with per-arm context ("Empty(no path supplied)", "Absolute(escapes sandbox)", "ParentEscape(traverses above root)") would silently reroute every diagnostic tag through a stale byte-string with no downstream signal until an operator scrolled the feira lint / feira build terminal output;
• format!("{:?}", violation).to_lowercase() also collapses ParentEscape to "parentescape" rather than the kebab-case "parent-escape" every other substrate-side kebab-slug axis (the sibling [caixa_provedor::FerriteRuntime::variant_slug]-emitted "ferrite-safe" / "ferrite-arena" tags, the crate::CaixaKind::as_str-emitted lowercase-single-word kind tags) already carries — allocating a fresh String per render pass on top of the tag drift.

Peer of the sibling substrate-wide closed-set fieldless typed- enum canonical-lowercase-tag scalar accessors [caixa_arch::ArchVerdict::as_str] (f3da79b — the paired proof-outcome axis on the sibling caixa-arch closed-set enum), [caixa_arch::InvariantKind::as_str] (87c875a — the sibling caixa-arch severity axis), [caixa_lint::Severity::as_str] / [caixa_lint::FixSafety::as_str] (72782f7 — caixa-lint), crate::CaixaKind::as_str / crate::CaixaDialeto::as_str / crate::CaixaVersion::as_str, and the sibling M2/M3 caixa-core closed-set typed-enum as_str family (crate::supervisor::RestartStrategy::as_str / crate::supervisor::RestartPolicy::as_str / crate::aplicacao::PlacementStrategy::as_str / crate::aplicacao::RateLimitUnit::as_suffix / crate::dep::DepList::as_str) — extends the substrate-wide “one canonical lowercase-tag accessor per closed-set fieldless typed enum” discipline onto the caixa-core render-side path-shape-diagnostic axis, the first render-side path-shape- diagnostic closed-set enum to reach it.

pub const fn — matches the sibling gen_platform::IsVariant-derive-generated per-arm is_* predicates’ const fn posture, so every future substrate-side const-context consumer (a const _: () = assert!(…) module- scope pin on a per-fixture typed PathShapeViolation, a future const fn per-violation rejection-body composer, a compile-time HashMap<&'static str, _>-shaped per-violation policy table) reaches the paired byte-string through one substrate-primitive dispatch at compile time as at runtime.

A future variant addition (a Symlink arm the future symlink-escape gate would carry once Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes) reaches the paired std::fmt::Display impl + AsRef<str> impl + every downstream .as_str() consumer through one match-arm edit here, not a coordinated rewrite of every open-coded format!("{:?}", …) re-inlining. Named as_str (not label / tag / slug) to match the sibling closed-set-enum as_str convention the substrate already carries verbatim across every peer typed enum whose canonical projection is a plain &'static str (as distinct from the sibling [caixa_provedor::FerriteRuntime::variant_slug] and crate::WitTarget::label domain-named projections on enums carrying a paired non-string projection axis).

Trait Implementations

impl AsRef<str> for PathShapeViolation

Route the standard-library AsRef<str> projection on PathShapeViolation through the substrate-canonical PathShapeViolation::as_str pub const fn accessor so every consumer that binds a PathShapeViolation through the trait- idiomatic .as_ref() (a future HashMap::get::<str>(violation.as_ref()) per-violation policy- table lookup, a Command::arg shell-out composing the canonical violation tag into a feira lint --path-shape=<tag> filter, any impl AsRef<str>-bound generic function) reaches the canonical byte-string through one substrate-primitive dispatch rather than an open-coded .as_str() re-inlining at every wire-up.

Peer of the substrate-wide sibling closed-set-enum AsRef<str>-through-as_str family already carried by [caixa_arch::ArchVerdict] (f3da79b), [caixa_arch::InvariantKind] (87c875a), [caixa_lint::Severity] (ce9d1e3), [caixa_lint::FixSafety] (72782f7), crate::CaixaKind, crate::CaixaDialeto, crate::aplicacao::PlacementStrategy, crate::aplicacao::RateLimitUnit, crate::supervisor::RestartStrategy, crate::supervisor::RestartPolicy, crate::dep::DepList, and crate::CaixaVersion, plus the peer [caixa_provedor::FerriteRuntime] AsRef<str>-through- variant_slug route (f919cda) — extends the axis onto the caixa- core render-side path-shape-diagnostic closed-set enum, closing the (as_str, Display, AsRef<str>) canonical-projection triple on the first render-side path-shape-diagnostic closed-set fieldless typed enum on the caixa surface to converge onto it.

fn as_ref(&self) -> &str

Converts this type into a shared reference of the (usually inferred) input type.

impl Clone for PathShapeViolation

fn clone(&self) -> PathShapeViolation

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for PathShapeViolation

impl Debug for PathShapeViolation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for PathShapeViolation

Route the derived-style std::fmt::Display impl on PathShapeViolation through the substrate-canonical PathShapeViolation::as_str pub const fn accessor so every consumer that binds a PathShapeViolation through the standard- library {} formatting axis (a future feira lint --explain-path-shape=<axis> per-arm listing line naming the violation, a tracing::field::Value::from(violation) structured- log recorder on the caixa-build pipeline’s per-slot path-gate emission path, any format!("{violation}") interpolation in a future audit surface) reaches the canonical byte-string through one substrate-primitive dispatch rather than an open-coded per-arm match at every wire-up.

Follows the same closed-set-typed-enum Display-through-as_str convention the substrate-wide siblings [caixa_arch::ArchVerdict] (f3da79b), [caixa_arch::InvariantKind] (87c875a), [caixa_lint::Severity] (6ad94f3), [caixa_lint::FixSafety] (72782f7), crate::CaixaKind, crate::aplicacao::PlacementStrategy, crate::supervisor::RestartStrategy, crate::supervisor::RestartPolicy, and crate::dep::DepList already carry, plus the peer [caixa_provedor::FerriteRuntime] Display-through-variant_slug route (f919cda) on the sibling caixa-provedor axis whose canonical projection is domain-named — closes the PathShapeViolation closed-set enum’s (as_str, Display, AsRef<str>) canonical-projection triple.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for PathShapeViolation

impl Hash for PathShapeViolation

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for PathShapeViolation

fn eq(&self, other: &PathShapeViolation) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for PathShapeViolation