Enum PathShapeViolation 

pub enum PathShapeViolation {
    Empty,
    Absolute,
    ParentEscape,
}

Tagged reason a caixa-author-supplied path can fail the sandboxed-relative shape gate every callback / script path must pass for the layout checker’s root.join(p) to stay inside the caixa root.

Returned by is_sandboxed_relative_path so each per-axis caller — crate::BehaviorSpec::validate on :behavior :on-* paths (b0c8389), crate::UpgradeInstruction::validate’s StateChange arm on :upgrade-from :state-change :script (26da2c7), every future axis admitting a user-supplied path — match-and-wraps the tag into its own typed *Invalid { slot, path } enum variant so the diagnostic still names which slot carried the malformed value. The tag is axis-agnostic; the wrapping per-axis variant carries the slot identity.

Sibling discriminator-style of the per-arm reason substrings every value-shape predicate already exposes (is_dns_1123_label, is_gateway_api_http_path, …) — but typed rather than string- shaped, because the per-axis variants for path violations were already split three ways (EmptyPath / AbsolutePath / ParentEscape in BehaviorError; EmptyScript / AbsoluteScript / ParentEscapeScript in UpgradeError), so collapsing them to a single *PathInvalid { reason } variant would regress the diagnostic shape rather than preserve it.

Variants

Empty

The path string is empty — PathBuf::new() or the canonical “I declared the slot but left the value blank” authoring footgun. root.join(PathBuf::new()) resolves to root itself, silently pointing the runtime’s LisleLoader at the project root rather than a file.

Absolute

The path is absolute — Path::join replaces the base with an absolute right-hand side, so root.join("/etc/passwd") resolves to "/etc/passwd" and escapes the project sandbox entirely. The Lunatic-style sandbox discipline (theory/INSPIRATIONS.md §III.1) requires every author-supplied path to live under the caixa root.

ParentEscape

The path contains a Component::ParentDir component anywhere — root.join("../sibling/x") traverses above the caixa root, the same sandbox-escape vector via parent-directory traversal. Caught regardless of where the .. component sits (leading, mid-path, trailing) so a future relaxation that only checks one position surfaces at this one predicate.

Implementations

impl PathShapeViolation

pub const fn is_empty(&self) -> bool

pub const fn is_absolute(&self) -> bool

pub const fn is_parent_escape(&self) -> bool

impl PathShapeViolation

pub const ALL: &'static [Self]

Exhaustive iteration surface for every consumer that walks the closed three-arm PathShapeViolation discriminator set — the paired byte-parity pin on the gen_platform::IsVariant-derived per-arm is_* predicate family, a future feira lint --explain-path-shape=<axis> per-arm listing of the accepted violation kinds, a future mesh.pleme.io/v1alpha1/Caixa CR materializer’s per-path admission-webhook rejection body naming the accepted-violation-tag set, any future property-test harness that sweeps every arm to compute per-arm diagnostic coverage. A future variant addition (a Symlink arm the future symlink-escape gate would carry once Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes) extends this slice as one edit and every consumer picks up the new entry by construction; the compiler-checked exhaustiveness on the sibling match arms in is_sandboxed_relative_path and require_sandboxed_lisp_path is the build-time guarantee that no arm forgets to grow.

Peer of the sibling closed-set fieldless typed enums’ crate::CaixaKind::ALL (6b1f4fb) / crate::CaixaDialeto::ALL (dd4f541) / crate::aplicacao::PlacementStrategy::ALL (18c7342) / crate::aplicacao::RateLimitUnit::ALL (6bce03d) / crate::dep::DepList::ALL (45ee563) / crate::supervisor::RestartStrategy::ALL (4eec29c) / crate::supervisor::RestartPolicy::ALL (dd32ccf) exhaustive-iteration surfaces — the tenth closed-set typed enum on the caixa surface to converge onto the same one-canonical-arm-list-per-enum discipline, and the first render-side path-shape-diagnostic axis (as distinct from an OTP-shape M2 slot or an M3 mesh slot) to reach it. Order matches variant declaration order verbatim (Empty → Absolute → ParentEscape) so the slice is the canonical ordering every exhaustive dispatch site (the Empty → Absolute → ParentEscape arm-ordering is_sandboxed_relative_path and every per-axis caller in crate::manifest::ManifestError preserve for diagnostic-precedence continuity) defers to.

pub const fn as_str(self) -> &'static str

Substrate-canonical per-PathShapeViolation lowercase-kebab-tag scalar accessor every consumer that renders the three-arm path-shape violation axis as user-facing text keys off — returns the per-arm byte-string ("empty" / "absolute" / "parent-escape") as a &'static str, the same lowercase tags a future feira lint --explain-path-shape=<axis> per-arm listing, a future mesh.pleme.io/v1alpha1/Caixa CR materializer’s per-path admission-webhook rejection body naming the accepted-violation-tag set, or a tracing::field::Value::Str-arm structured-log recorder on the caixa-build pipeline’s per-slot path-gate emission path would have otherwise reached via a format!("{:?}", violation).to_lowercase() round-trip through the std::fmt::Debug derive — with two silent drift footguns the substrate-canonical accessor closes at build time:

• the std::fmt::Debug derive’s per-arm output is not a stability guarantee (Rust’s own convention gives it as no guarantee at all), so a #[derive(Debug)] swap for a hand-rolled impl Debug that pretty-prints the arm with per-arm context ("Empty(no path supplied)", "Absolute(escapes sandbox)", "ParentEscape(traverses above root)") would silently reroute every diagnostic tag through a stale byte-string with no downstream signal until an operator scrolled the feira lint / feira build terminal output;
• format!("{:?}", violation).to_lowercase() also collapses ParentEscape to "parentescape" rather than the kebab-case "parent-escape" every other substrate-side kebab-slug axis (the sibling [caixa_provedor::FerriteRuntime::variant_slug]-emitted "ferrite-safe" / "ferrite-arena" tags, the crate::CaixaKind::as_str-emitted lowercase-single-word kind tags) already carries — allocating a fresh String per render pass on top of the tag drift.

Peer of the sibling substrate-wide closed-set fieldless typed- enum canonical-lowercase-tag scalar accessors [caixa_arch::ArchVerdict::as_str] (f3da79b — the paired proof-outcome axis on the sibling caixa-arch closed-set enum), [caixa_arch::InvariantKind::as_str] (87c875a — the sibling caixa-arch severity axis), [caixa_lint::Severity::as_str] / [caixa_lint::FixSafety::as_str] (72782f7 — caixa-lint), crate::CaixaKind::as_str / crate::CaixaDialeto::as_str / crate::CaixaVersion::as_str, and the sibling M2/M3 caixa-core closed-set typed-enum as_str family (crate::supervisor::RestartStrategy::as_str / crate::supervisor::RestartPolicy::as_str / crate::aplicacao::PlacementStrategy::as_str / crate::aplicacao::RateLimitUnit::as_suffix / crate::dep::DepList::as_str) — extends the substrate-wide “one canonical lowercase-tag accessor per closed-set fieldless typed enum” discipline onto the caixa-core render-side path-shape-diagnostic axis, the first render-side path-shape- diagnostic closed-set enum to reach it.

pub const fn — matches the sibling gen_platform::IsVariant-derive-generated per-arm is_* predicates’ const fn posture, so every future substrate-side const-context consumer (a const _: () = assert!(…) module- scope pin on a per-fixture typed PathShapeViolation, a future const fn per-violation rejection-body composer, a compile-time HashMap<&'static str, _>-shaped per-violation policy table) reaches the paired byte-string through one substrate-primitive dispatch at compile time as at runtime.

A future variant addition (a Symlink arm the future symlink-escape gate would carry once Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes) reaches the paired std::fmt::Display impl + AsRef<str> impl + every downstream .as_str() consumer through one match-arm edit here, not a coordinated rewrite of every open-coded format!("{:?}", …) re-inlining. Named as_str (not label / tag / slug) to match the sibling closed-set-enum as_str convention the substrate already carries verbatim across every peer typed enum whose canonical projection is a plain &'static str (as distinct from the sibling [caixa_provedor::FerriteRuntime::variant_slug] and crate::WitTarget::label domain-named projections on enums carrying a paired non-string projection axis).

pub fn from_wire(s: &str) -> Option<Self>

Substrate-canonical reverse projection on the PathShapeViolation closed-set render-side path-shape-diagnostic axis — parses the lowercase-kebab per-arm byte-string Self::as_str emits back to the typed variant, or None when s is outside the closed three-arm accept-set ("empty" / "absolute" / "parent-escape"). Walks exactly the same three byte-strings the sibling Self::as_str forward emitter returns, so the parse and emit halves of the round-trip migrate through one caixa-core edit on any future arm addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes): the compiler-checked exhaustiveness on Self::as_str’s match self arms and the round-trip pin [tests::path_shape_violation_from_wire_accepts_every_as_str_output] together lock the two halves mutually.

Prior to this lift the substrate carried only the forward Self → &str projection on the path-shape-violation axis (the Self::as_str emitter, the paired std::fmt::Display impl routed through it, the paired AsRef<str> impl routed through it) — every future consumer that wanted to promote the render- side path-shape-violation tag back to the typed enum (a future feira lint --explain-path-shape=<empty|absolute|parent-escape> CLI arg-parse that binds the wire byte-string into the typed enum before dispatching to the per-arm listing body, a future M4 mesh.pleme.io/v1alpha1/Caixa CR materializer’s admission- webhook rejection-body parser that re-binds a prior audit’s Self::as_str output to the typed enum before threading it into the per-slot diagnostic-precedence table, a future tracing::field::Value::Str-arm structured-log re-loader that hydrates a prior caixa-build pipeline’s per-slot path-gate emission back to the typed enum for cross-run violation-histogram diff) would have had to re-inline a three- arm match s cascade that expressed no compile-time link back to the typed PathShapeViolation enum.

Same closed-set-reverse-projection discipline the sibling crate::CaixaKind::from_wire (2aa6d23), crate::CaixaDialeto::from_wire (d0e65ea), crate::supervisor::RestartStrategy::from_wire (4eec29c), crate::supervisor::RestartPolicy::from_wire (dd32ccf), crate::aplicacao::PlacementStrategy::from_wire (18c7342), crate::dep::DepList::from_wire (45ee563), and [caixa_arch::InvariantKind::from_wire] (b9e4e61) typed enums carry on the peer wire-side str → Self axes — extends the substrate-wide (as_str, from_wire) round-trip family onto the caixa-core render-side path-shape-diagnostic closed-set enum (the first render-side path-shape-diagnostic axis to reach it), matching the same two-way str ↔ Self round-trip every sibling closed-set enum already carries. Method-named from_wire (not from_str) to match the peer shapes verbatim and side-step a clippy::should_implement_trait lint that a plain from_str name would otherwise trigger without paired std::str::FromStr impl scaffolding this axis does not carry today. Returns Option<Self> (rather than Result<Self, _>) to match the peer shapes: the caller picks the diagnostic form appropriate for its use site (a feira lint --explain-path-shape CLI arg-parse renders its own per-verb error message; an admission-webhook rejection body wraps the None outcome with the accepted-set enumeration PathShapeViolation::ALL.iter(). map(PathShapeViolation::as_str) for operator diagnostics).

Trait Implementations

impl AsRef<str> for PathShapeViolation

Route the standard-library AsRef<str> projection on PathShapeViolation through the substrate-canonical PathShapeViolation::as_str pub const fn accessor so every consumer that binds a PathShapeViolation through the trait- idiomatic .as_ref() (a future HashMap::get::<str>(violation.as_ref()) per-violation policy- table lookup, a Command::arg shell-out composing the canonical violation tag into a feira lint --path-shape=<tag> filter, any impl AsRef<str>-bound generic function) reaches the canonical byte-string through one substrate-primitive dispatch rather than an open-coded .as_str() re-inlining at every wire-up.

Peer of the substrate-wide sibling closed-set-enum AsRef<str>-through-as_str family already carried by [caixa_arch::ArchVerdict] (f3da79b), [caixa_arch::InvariantKind] (87c875a), [caixa_lint::Severity] (ce9d1e3), [caixa_lint::FixSafety] (72782f7), crate::CaixaKind, crate::CaixaDialeto, crate::aplicacao::PlacementStrategy, crate::aplicacao::RateLimitUnit, crate::supervisor::RestartStrategy, crate::supervisor::RestartPolicy, crate::dep::DepList, and crate::CaixaVersion, plus the peer [caixa_provedor::FerriteRuntime] AsRef<str>-through- variant_slug route (f919cda) — extends the axis onto the caixa- core render-side path-shape-diagnostic closed-set enum, closing the (as_str, Display, AsRef<str>) canonical-projection triple on the first render-side path-shape-diagnostic closed-set fieldless typed enum on the caixa surface to converge onto it.

fn as_ref(&self) -> &str

Converts this type into a shared reference of the (usually inferred) input type.

impl Clone for PathShapeViolation

fn clone(&self) -> PathShapeViolation

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for PathShapeViolation

impl Debug for PathShapeViolation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for PathShapeViolation

Route the derived-style std::fmt::Display impl on PathShapeViolation through the substrate-canonical PathShapeViolation::as_str pub const fn accessor so every consumer that binds a PathShapeViolation through the standard- library {} formatting axis (a future feira lint --explain-path-shape=<axis> per-arm listing line naming the violation, a tracing::field::Value::from(violation) structured- log recorder on the caixa-build pipeline’s per-slot path-gate emission path, any format!("{violation}") interpolation in a future audit surface) reaches the canonical byte-string through one substrate-primitive dispatch rather than an open-coded per-arm match at every wire-up.

Follows the same closed-set-typed-enum Display-through-as_str convention the substrate-wide siblings [caixa_arch::ArchVerdict] (f3da79b), [caixa_arch::InvariantKind] (87c875a), [caixa_lint::Severity] (6ad94f3), [caixa_lint::FixSafety] (72782f7), crate::CaixaKind, crate::aplicacao::PlacementStrategy, crate::supervisor::RestartStrategy, crate::supervisor::RestartPolicy, and crate::dep::DepList already carry, plus the peer [caixa_provedor::FerriteRuntime] Display-through-variant_slug route (f919cda) on the sibling caixa-provedor axis whose canonical projection is domain-named — closes the PathShapeViolation closed-set enum’s (as_str, Display, AsRef<str>) canonical-projection triple.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for PathShapeViolation

impl From<PathShapeViolation> for &'static str

Standard-library trait-idiomatic forward projection on the PathShapeViolation closed-set typed enum. Routes byte-for-byte through the paired substrate-primitive PathShapeViolation::as_str pub const fn accessor so <&'static str>::from(violation) / violation.into::<&'static str>() reaches the same three-arm "empty" / "absolute" / "parent-escape" canonical-kebab emit-set the sibling method-named accessor dispatches through and the sibling [std::fmt::Display for PathShapeViolation] / [AsRef<str> for PathShapeViolation] impls also route through.

Extends the substrate-wide closed-set-enum trait-idiomatic forward-projection family (crate::supervisor::RestartStrategy via 523157d, crate::supervisor::RestartPolicy via 9fb37d0, crate::CaixaKind via edb827b, crate::CaixaDialeto via c189a6f, crate::aplicacao::PlacementStrategy via afa3562, crate::aplicacao::WitShape via 56998ec, crate::aplicacao::RateLimitUnit via 7fdfbf4) onto the first render-side path-shape-diagnostic closed-set enum on the caixa surface — the sandbox-escape three-arm accept-set every is_sandboxed_relative_path caller (crate::BehaviorSpec::validate, crate::UpgradeInstruction::validate, every future M3/M4 axis admitting a user-supplied path) match-and-wraps into its own typed per-slot *Invalid { slot, path } variant. Closes the trait- idiomatic forward-projection family on the caixa-core-side closed-set fieldless typed-enum surface — every caixa-core enum that already carries the paired trait-idiomatic reverse projection TryFrom<&str> now also carries the trait-idiomatic forward projection, so a downstream impl From<T> for &'static str-bound generic consumer reaches every caixa-core closed-set enum through one uniform trait dispatch.

Pairs with the sibling [TryFrom<&str> for PathShapeViolation] impl (e67e48a) to close the two-way Self ↔ &'static str round-trip on the trait-idiomatic axis pair, mirroring the pre-existing method-named PathShapeViolation::as_str + PathShapeViolation::from_wire pair on the substrate-primitive axis pair.

Return type is &'static str by construction — every PathShapeViolation::as_str arm resolves to an inline "empty" / "absolute" / "parent-escape" &'static str literal, so the trait’s return-type promise is upheld structurally without a String::leak cast or a per-arm inline literal outside the paired PathShapeViolation::as_str dispatch.

The paired PathShapeViolation::as_str accessor’s three-arm emit-set is the single source of truth — every future arm addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes — both trajectory items the sibling PathShapeViolation::ALL doc block already names) grows the trait-idiomatic forward axis by construction: one caixa-core edit on PathShapeViolation::as_str extends every one of the sibling forward-projection paths (std::fmt::Display, AsRef<str>, PathShapeViolation::as_str itself, and this [From<Self> for &'static str]) without a coordinated rewrite across every future Into<&'static str>-bound consumer’s arm-set.

Pinned load-bearing by [tests::path_shape_violation_from_into_static_str_routes_through_as_str_accessor] (byte-parity pin against PathShapeViolation::as_str across the three-arm emit-set, plus a const-context materialization witness for the &'static str lifetime promise routed through the paired PathShapeViolation::as_str pub const fn accessor, plus a paired .into() shape assertion covering the blanket-derived Into<&'static str> shape) and [tests::path_shape_violation_from_into_static_str_and_as_str_partition_the_emit_set] (partition pin asserting <&'static str as From<PathShapeViolation>>::from and PathShapeViolation::as_str agree on every arm, plus a two-way direct round-trip witness through the paired trait-idiomatic TryFrom<&str> axis that closes the two-way Self ↔ &'static str round-trip on the trait-idiomatic axis pair — the emit-side PathShapeViolation::as_str and the parse-side PathShapeViolation::from_wire dispatch on the same three inline canonical-kebab byte-strings by construction, so round-tripping composes the two trait impls directly).

fn from(violation: PathShapeViolation) -> &'static str

Converts to this type from the input type.

impl Hash for PathShapeViolation

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for PathShapeViolation

fn eq(&self, other: &PathShapeViolation) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for PathShapeViolation

impl TryFrom<&str> for PathShapeViolation

Trait-idiomatic reverse projection on the PathShapeViolation closed-set render-side path-shape-diagnostic axis — routes byte-for-byte through the paired substrate-primitive PathShapeViolation::from_wire Option<Self> accessor so every future consumer that binds a canonical path-shape-violation tag through the standard-library .try_into() / TryFrom axis (a future feira lint --explain-path-shape=<empty|absolute|parent-escape> CLI arg-parse that composes into let axis: PathShapeViolation = s.try_into()?, a future M4 mesh.pleme.io/v1alpha1/Caixa CR admission-webhook rejection-body parser that folds a prior audit’s spec.pathShape: String through PathShapeViolation::try_from(&s)?, a generic <T: TryFrom<&str>>-bound loader over any of the substrate’s closed-set typed enums) reaches the same three-arm accept-set the sibling PathShapeViolation::from_wire resolver parses through and the sibling PathShapeViolation::as_str emits, rather than an open-coded per-arm match s { "empty" => …, "absolute" => …, "parent-escape" => …, _ => … } cascade whose arm-set has no compile-time link back to the substrate primitive.

Complements the pre-existing forward-projection triple (std::fmt::Display, AsRef<str>, PathShapeViolation::as_str) with the paired trait-idiomatic reverse-projection axis: Rust-side newtype/typed-enum convention pairs AsRef<str> with either std::str::FromStr or TryFrom<&str> on the same primitive so a caller who can project out to a &str can also project in from one. The TryFrom<&str> axis is deliberately chosen over std::str::FromStr to sidestep the clippy::should_implement_trait lint the sibling method-named PathShapeViolation::from_wire would trigger under a FromStr impl (the same design tradeoff the peer crate::CaixaKind (3c83606), crate::CaixaDialeto (bf33136), crate::aplicacao::PlacementStrategy (6fd00cd), crate::supervisor::RestartStrategy (5b828ed), crate::supervisor::RestartPolicy (6fdd0d9), crate::aplicacao::WitShape (5472902), and crate::aplicacao::RateLimitUnit (bf78400) blocks note) — this impl closes the trait-idiomatic reverse axis without disturbing the method-named from_wire shape every peer closed-set typed enum already carries.

type Error = () matches the sibling PathShapeViolation::from_wire’s Option<Self> return-shape’s deliberate deferral of error typing: the caller picks the diagnostic form appropriate for its use site (a future feira lint --explain-path-shape CLI arg-parse composes its own per-verb “unknown path-shape axis: — accepted: {…}” message enumerating PathShapeViolation::ALL, a future M4 admission-webhook rejection body wraps the Err(()) outcome with the accepted-set enumeration for operator diagnostics, a Result::map_err at the call site lifts the axis-error to a per-verb error type). Same shape the peer sibling reverse-projection axes carry.

The paired TryFrom<&str> impl reaches the same three-arm accept-set the PathShapeViolation::from_wire resolver dispatches through, so any future arm addition (a Symlink arm the future symlink-escape gate would carry once std::path::Path::is_symlink becomes part of the sandbox contract, a TrailingSpace arm a future authoring-side whitespace-hygiene gate would raise for "lib/init.lisp " shapes — both trajectory items the sibling PathShapeViolation::ALL doc block already names) grows the trait-idiomatic axis by construction: one caixa-core edit on PathShapeViolation::from_wire extends both the method-named reverse projection every existing consumer keys off and the trait-idiomatic reverse projection this impl exposes, without a coordinated rewrite across every future TryFrom<&str>-bound consumer’s arm-set.

Extends the substrate-wide closed-set-enum trait-idiomatic reverse-projection family (crate::CaixaKind via 3c83606, crate::CaixaDialeto via bf33136, crate::aplicacao::PlacementStrategy via 6fd00cd, crate::supervisor::RestartStrategy via 5b828ed, crate::supervisor::RestartPolicy via 6fdd0d9, crate::aplicacao::WitShape via 5472902, and crate::aplicacao::RateLimitUnit via bf78400) onto the first render-side path-shape-diagnostic closed-set enum on the caixa surface — the sandbox-escape three-arm accept-set every is_sandboxed_relative_path caller (crate::BehaviorSpec::validate, crate::UpgradeInstruction::validate, every future M3/M4 axis admitting a user-supplied path) match-and-wraps into its own typed per-slot *Invalid { slot, path } variant.

Pinned load-bearing by [tests::path_shape_violation_try_from_str_routes_through_from_wire_accessor] (byte-parity pin against PathShapeViolation::from_wire across the three-arm accept-set) and [tests::path_shape_violation_try_from_str_rejects_unknown_byte_strings] (rejection witness against silent accept-set widening).

type Error = ()

The type returned in the event of a conversion error.

fn try_from(s: &str) -> Result<Self, Self::Error>

Performs the conversion.