Enum PathShapeViolation 

pub enum PathShapeViolation {
    Empty,
    Absolute,
    ParentEscape,
}

Tagged reason a caixa-author-supplied path can fail the sandboxed-relative shape gate every callback / script path must pass for the layout checker’s root.join(p) to stay inside the caixa root.

Returned by is_sandboxed_relative_path so each per-axis caller — crate::BehaviorSpec::validate on :behavior :on-* paths (b0c8389), crate::UpgradeInstruction::validate’s StateChange arm on :upgrade-from :state-change :script (26da2c7), every future axis admitting a user-supplied path — match-and-wraps the tag into its own typed *Invalid { slot, path } enum variant so the diagnostic still names which slot carried the malformed value. The tag is axis-agnostic; the wrapping per-axis variant carries the slot identity.

Sibling discriminator-style of the per-arm reason substrings every value-shape predicate already exposes (is_dns_1123_label, is_gateway_api_http_path, …) — but typed rather than string- shaped, because the per-axis variants for path violations were already split three ways (EmptyPath / AbsolutePath / ParentEscape in BehaviorError; EmptyScript / AbsoluteScript / ParentEscapeScript in UpgradeError), so collapsing them to a single *PathInvalid { reason } variant would regress the diagnostic shape rather than preserve it.

Variants

Empty

The path string is empty — PathBuf::new() or the canonical “I declared the slot but left the value blank” authoring footgun. root.join(PathBuf::new()) resolves to root itself, silently pointing the runtime’s LisleLoader at the project root rather than a file.

Absolute

The path is absolute — Path::join replaces the base with an absolute right-hand side, so root.join("/etc/passwd") resolves to "/etc/passwd" and escapes the project sandbox entirely. The Lunatic-style sandbox discipline (theory/INSPIRATIONS.md §III.1) requires every author-supplied path to live under the caixa root.

ParentEscape

The path contains a Component::ParentDir component anywhere — root.join("../sibling/x") traverses above the caixa root, the same sandbox-escape vector via parent-directory traversal. Caught regardless of where the .. component sits (leading, mid-path, trailing) so a future relaxation that only checks one position surfaces at this one predicate.

Implementations

impl PathShapeViolation

pub const fn is_empty(&self) -> bool

pub const fn is_absolute(&self) -> bool

pub const fn is_parent_escape(&self) -> bool

impl PathShapeViolation

pub const ALL: &'static [Self]

Exhaustive iteration surface for every consumer that walks the closed three-arm PathShapeViolation discriminator set — the paired byte-parity pin on the gen_platform::IsVariant-derived per-arm is_* predicate family, a future feira lint --explain-path-shape=<axis> per-arm listing of the accepted violation kinds, a future mesh.pleme.io/v1alpha1/Caixa CR materializer’s per-path admission-webhook rejection body naming the accepted-violation-tag set, any future property-test harness that sweeps every arm to compute per-arm diagnostic coverage. A future variant addition (a Symlink arm the future symlink-escape gate would carry once Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes) extends this slice as one edit and every consumer picks up the new entry by construction; the compiler-checked exhaustiveness on the sibling match arms in is_sandboxed_relative_path and require_sandboxed_lisp_path is the build-time guarantee that no arm forgets to grow.

Peer of the sibling closed-set fieldless typed enums’ crate::CaixaKind::ALL (6b1f4fb) / crate::CaixaDialeto::ALL (dd4f541) / crate::aplicacao::PlacementStrategy::ALL (18c7342) / crate::aplicacao::RateLimitUnit::ALL (6bce03d) / crate::dep::DepList::ALL (45ee563) / crate::supervisor::RestartStrategy::ALL (4eec29c) / crate::supervisor::RestartPolicy::ALL (dd32ccf) exhaustive-iteration surfaces — the tenth closed-set typed enum on the caixa surface to converge onto the same one-canonical-arm-list-per-enum discipline, and the first render-side path-shape-diagnostic axis (as distinct from an OTP-shape M2 slot or an M3 mesh slot) to reach it. Order matches variant declaration order verbatim (Empty → Absolute → ParentEscape) so the slice is the canonical ordering every exhaustive dispatch site (the Empty → Absolute → ParentEscape arm-ordering is_sandboxed_relative_path and every per-axis caller in crate::manifest::ManifestError preserve for diagnostic-precedence continuity) defers to.

pub const fn as_str(self) -> &'static str

Substrate-canonical per-PathShapeViolation lowercase-kebab-tag scalar accessor every consumer that renders the three-arm path-shape violation axis as user-facing text keys off — returns the per-arm byte-string ("empty" / "absolute" / "parent-escape") as a &'static str, the same lowercase tags a future feira lint --explain-path-shape=<axis> per-arm listing, a future mesh.pleme.io/v1alpha1/Caixa CR materializer’s per-path admission-webhook rejection body naming the accepted-violation-tag set, or a tracing::field::Value::Str-arm structured-log recorder on the caixa-build pipeline’s per-slot path-gate emission path would have otherwise reached via a format!("{:?}", violation).to_lowercase() round-trip through the std::fmt::Debug derive — with two silent drift footguns the substrate-canonical accessor closes at build time:

• the std::fmt::Debug derive’s per-arm output is not a stability guarantee (Rust’s own convention gives it as no guarantee at all), so a #[derive(Debug)] swap for a hand-rolled impl Debug that pretty-prints the arm with per-arm context ("Empty(no path supplied)", "Absolute(escapes sandbox)", "ParentEscape(traverses above root)") would silently reroute every diagnostic tag through a stale byte-string with no downstream signal until an operator scrolled the feira lint / feira build terminal output;
• format!("{:?}", violation).to_lowercase() also collapses ParentEscape to "parentescape" rather than the kebab-case "parent-escape" every other substrate-side kebab-slug axis (the sibling [caixa_provedor::FerriteRuntime::variant_slug]-emitted "ferrite-safe" / "ferrite-arena" tags, the crate::CaixaKind::as_str-emitted lowercase-single-word kind tags) already carries — allocating a fresh String per render pass on top of the tag drift.

Peer of the sibling substrate-wide closed-set fieldless typed- enum canonical-lowercase-tag scalar accessors [caixa_arch::ArchVerdict::as_str] (f3da79b — the paired proof-outcome axis on the sibling caixa-arch closed-set enum), [caixa_arch::InvariantKind::as_str] (87c875a — the sibling caixa-arch severity axis), [caixa_lint::Severity::as_str] / [caixa_lint::FixSafety::as_str] (72782f7 — caixa-lint), crate::CaixaKind::as_str / crate::CaixaDialeto::as_str / crate::CaixaVersion::as_str, and the sibling M2/M3 caixa-core closed-set typed-enum as_str family (crate::supervisor::RestartStrategy::as_str / crate::supervisor::RestartPolicy::as_str / crate::aplicacao::PlacementStrategy::as_str / crate::aplicacao::RateLimitUnit::as_suffix / crate::dep::DepList::as_str) — extends the substrate-wide “one canonical lowercase-tag accessor per closed-set fieldless typed enum” discipline onto the caixa-core render-side path-shape-diagnostic axis, the first render-side path-shape- diagnostic closed-set enum to reach it.

pub const fn — matches the sibling gen_platform::IsVariant-derive-generated per-arm is_* predicates’ const fn posture, so every future substrate-side const-context consumer (a const _: () = assert!(…) module- scope pin on a per-fixture typed PathShapeViolation, a future const fn per-violation rejection-body composer, a compile-time HashMap<&'static str, _>-shaped per-violation policy table) reaches the paired byte-string through one substrate-primitive dispatch at compile time as at runtime.

A future variant addition (a Symlink arm the future symlink-escape gate would carry once Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes) reaches the paired std::fmt::Display impl + AsRef<str> impl + every downstream .as_str() consumer through one match-arm edit here, not a coordinated rewrite of every open-coded format!("{:?}", …) re-inlining. Named as_str (not label / tag / slug) to match the sibling closed-set-enum as_str convention the substrate already carries verbatim across every peer typed enum whose canonical projection is a plain &'static str (as distinct from the sibling [caixa_provedor::FerriteRuntime::variant_slug] and crate::WitTarget::label domain-named projections on enums carrying a paired non-string projection axis).

pub fn from_wire(s: &str) -> Option<Self>

Substrate-canonical reverse projection on the PathShapeViolation closed-set render-side path-shape-diagnostic axis — parses the lowercase-kebab per-arm byte-string Self::as_str emits back to the typed variant, or None when s is outside the closed three-arm accept-set ("empty" / "absolute" / "parent-escape"). Walks exactly the same three byte-strings the sibling Self::as_str forward emitter returns, so the parse and emit halves of the round-trip migrate through one caixa-core edit on any future arm addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes): the compiler-checked exhaustiveness on Self::as_str’s match self arms and the round-trip pin [tests::path_shape_violation_from_wire_accepts_every_as_str_output] together lock the two halves mutually.

Prior to this lift the substrate carried only the forward Self → &str projection on the path-shape-violation axis (the Self::as_str emitter, the paired std::fmt::Display impl routed through it, the paired AsRef<str> impl routed through it) — every future consumer that wanted to promote the render- side path-shape-violation tag back to the typed enum (a future feira lint --explain-path-shape=<empty|absolute|parent-escape> CLI arg-parse that binds the wire byte-string into the typed enum before dispatching to the per-arm listing body, a future M4 mesh.pleme.io/v1alpha1/Caixa CR materializer’s admission- webhook rejection-body parser that re-binds a prior audit’s Self::as_str output to the typed enum before threading it into the per-slot diagnostic-precedence table, a future tracing::field::Value::Str-arm structured-log re-loader that hydrates a prior caixa-build pipeline’s per-slot path-gate emission back to the typed enum for cross-run violation-histogram diff) would have had to re-inline a three- arm match s cascade that expressed no compile-time link back to the typed PathShapeViolation enum.

Same closed-set-reverse-projection discipline the sibling crate::CaixaKind::from_wire (2aa6d23), crate::CaixaDialeto::from_wire (d0e65ea), crate::supervisor::RestartStrategy::from_wire (4eec29c), crate::supervisor::RestartPolicy::from_wire (dd32ccf), crate::aplicacao::PlacementStrategy::from_wire (18c7342), crate::dep::DepList::from_wire (45ee563), and [caixa_arch::InvariantKind::from_wire] (b9e4e61) typed enums carry on the peer wire-side str → Self axes — extends the substrate-wide (as_str, from_wire) round-trip family onto the caixa-core render-side path-shape-diagnostic closed-set enum (the first render-side path-shape-diagnostic axis to reach it), matching the same two-way str ↔ Self round-trip every sibling closed-set enum already carries. Method-named from_wire (not from_str) to match the peer shapes verbatim and side-step a clippy::should_implement_trait lint that a plain from_str name would otherwise trigger without paired std::str::FromStr impl scaffolding this axis does not carry today. Returns Option<Self> (rather than Result<Self, _>) to match the peer shapes: the caller picks the diagnostic form appropriate for its use site (a feira lint --explain-path-shape CLI arg-parse renders its own per-verb error message; an admission-webhook rejection body wraps the None outcome with the accepted-set enumeration PathShapeViolation::ALL.iter(). map(PathShapeViolation::as_str) for operator diagnostics).

Trait Implementations

impl AsRef<str> for PathShapeViolation

Route the standard-library AsRef<str> projection on PathShapeViolation through the substrate-canonical PathShapeViolation::as_str pub const fn accessor so every consumer that binds a PathShapeViolation through the trait- idiomatic .as_ref() (a future HashMap::get::<str>(violation.as_ref()) per-violation policy- table lookup, a Command::arg shell-out composing the canonical violation tag into a feira lint --path-shape=<tag> filter, any impl AsRef<str>-bound generic function) reaches the canonical byte-string through one substrate-primitive dispatch rather than an open-coded .as_str() re-inlining at every wire-up.

Peer of the substrate-wide sibling closed-set-enum AsRef<str>-through-as_str family already carried by [caixa_arch::ArchVerdict] (f3da79b), [caixa_arch::InvariantKind] (87c875a), [caixa_lint::Severity] (ce9d1e3), [caixa_lint::FixSafety] (72782f7), crate::CaixaKind, crate::CaixaDialeto, crate::aplicacao::PlacementStrategy, crate::aplicacao::RateLimitUnit, crate::supervisor::RestartStrategy, crate::supervisor::RestartPolicy, crate::dep::DepList, and crate::CaixaVersion, plus the peer [caixa_provedor::FerriteRuntime] AsRef<str>-through- variant_slug route (f919cda) — extends the axis onto the caixa- core render-side path-shape-diagnostic closed-set enum, closing the (as_str, Display, AsRef<str>) canonical-projection triple on the first render-side path-shape-diagnostic closed-set fieldless typed enum on the caixa surface to converge onto it.

fn as_ref(&self) -> &str

Converts this type into a shared reference of the (usually inferred) input type.

impl Clone for PathShapeViolation

fn clone(&self) -> PathShapeViolation

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for PathShapeViolation

impl Debug for PathShapeViolation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for PathShapeViolation

Route the derived-style std::fmt::Display impl on PathShapeViolation through the substrate-canonical PathShapeViolation::as_str pub const fn accessor so every consumer that binds a PathShapeViolation through the standard- library {} formatting axis (a future feira lint --explain-path-shape=<axis> per-arm listing line naming the violation, a tracing::field::Value::from(violation) structured- log recorder on the caixa-build pipeline’s per-slot path-gate emission path, any format!("{violation}") interpolation in a future audit surface) reaches the canonical byte-string through one substrate-primitive dispatch rather than an open-coded per-arm match at every wire-up.

Follows the same closed-set-typed-enum Display-through-as_str convention the substrate-wide siblings [caixa_arch::ArchVerdict] (f3da79b), [caixa_arch::InvariantKind] (87c875a), [caixa_lint::Severity] (6ad94f3), [caixa_lint::FixSafety] (72782f7), crate::CaixaKind, crate::aplicacao::PlacementStrategy, crate::supervisor::RestartStrategy, crate::supervisor::RestartPolicy, and crate::dep::DepList already carry, plus the peer [caixa_provedor::FerriteRuntime] Display-through-variant_slug route (f919cda) on the sibling caixa-provedor axis whose canonical projection is domain-named — closes the PathShapeViolation closed-set enum’s (as_str, Display, AsRef<str>) canonical-projection triple.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for PathShapeViolation

impl Hash for PathShapeViolation

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for PathShapeViolation

fn eq(&self, other: &PathShapeViolation) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for PathShapeViolation