Module gate 

⟨0.24⟩ The §6.2 GATE over an already-accumulated signature — SHARED so candor-scan --policy and candor-query gate --report (SPEC §3.1) are the same gate reached by two routes, not two gates. ⟨0.24⟩ THE GATE — SPEC §6.2 matching over an ALREADY-ACCUMULATED signature, and the ONLY copy of that matching in the stable toolchain.

THE SEAM. [GateInput] is the boundary between what produced the signature and what §6.2 does with it. Every field is already accumulated: this module runs no fixpoint, opens no file and consults no scan state, so the same matching code serves both routes in —

• candor-scan … --policy <f> builds a GateInput from the classifier’s transitive accumulators (crate::gate::policy_violations, which is now a thin wrapper);
• candor-query gate --report <loc> --policy <f> (SPEC §3.1 ⟨0.24⟩) builds one from a WRITTEN report and nothing else.

That split is the whole point of §3.1 ⟨0.24⟩: until it existed the gate was reachable only THROUGH the classifier, so a defect in the gate and a defect in the classifier were indistinguishable from any test that could be written. Do NOT re-implement the matching on the report side — the §6.2 clause that mandates the verb was written about exactly that mistake.

Structs

GateInput

⟨0.24⟩ THE GATE’S INPUT — one signature per function, every field already TRANSITIVE.

GateOutcome

⟨0.24⟩ What gate returns: the violations it is SURE of, and the (rule, function) pairs it WITHHELD. Both halves travel, because the verdict is both (SPEC §3.1).

RuleHits

⟨0.24⟩ What one §6.2 deny/pure rule DOES to one function’s signature — see rule_hits.

Withheld

⟨0.24⟩ ONE (rule, function) THE GATE COULD NOT EVALUATE — SPEC §3.1: “a rule FIRES on a function only where the match is evidenced by that function’s own entry, and is WITHHELD exactly where it is not. Withholding is per (rule, function), never whole-policy.”

Functions

gate

Apply a parsed §6.2 policy to an already-accumulated signature. THE ONLY matching code in the stable toolchain — candor-scan --policy and candor-query gate --report both land here, which is what makes “the same verdict from the same signature” a property of the code rather than of two consistent authors. Returns the violations, sorted by (rule, detail), AND the withheld pairs.

net_classes_of

⟨0.20⟩ The Net destination classes an fn reaches (transitive) — the SINGLE derivation shared by the report’s netClass field (candor-scan’s writer) and the gate: an exact host-literal match (crate::net_dest_class) for the visible hosts, plus the fail-closed unknown-host when the Net surface is masked (incomplete has Net) OR carries no visible host (a runtime endpoint). Call only for an fn known to have Net; returns sorted.

rule_hits

⟨0.24⟩ WHAT ONE §6.2 deny/pure RULE DOES TO ONE FUNCTION’S SIGNATURE — the firing decision, extracted so it has exactly one implementation.