Struct GateInput 

pub struct GateInput<'a, E: AsRef<str> + Ord> {
    pub all: &'a [String],
    pub display: &'a HashMap<String, String>,
    pub hash: &'a HashMap<String, String>,
    pub inferred: &'a HashMap<String, BTreeSet<E>>,
    pub calls: &'a HashMap<String, BTreeSet<String>>,
    pub hosts: &'a HashMap<String, BTreeSet<String>>,
    pub cmds: &'a HashMap<String, BTreeSet<String>>,
    pub paths: &'a HashMap<String, BTreeSet<String>>,
    pub tables: &'a HashMap<String, BTreeSet<String>>,
    pub surface_incomplete: &'a HashMap<String, BTreeSet<E>>,
    pub reason_classes: &'a HashMap<String, BTreeSet<String>>,
    pub net_classes: &'a HashMap<String, Vec<String>>,
}

Fields

all: &'a [String]

Every UNIT the gate ranges over, in the caller’s order — an opaque KEY, not necessarily a name.

display: &'a HashMap<String, String>

⟨0.32⟩ key -> the name to MATCH and DISPLAY. Empty means the keys are already names.

A multi-report gate must join by hash and never by bare fn (SPEC §2.2), because two members of a workspace legitimately share a name — and merging them was measured turning a refusal into policy ✓ by letting one borrow the other’s Unknown reason class. But a hash is package#fn, and a POLICY SCOPE is written against the name (deny Exec app::), so keying by hash without this map silently stops scopes matching: a false green introduced by fixing a false green. Identity is the default, so the single-report callers are unaffected.

hash: &'a HashMap<String, String>

⟨0.32⟩ key -> the §2.2 UNIT IDENTITY (package#fn) a verdict row carries. Missing means this caller has none, and the row then omits the field — see Self::unit.

inferred: &'a HashMap<String, BTreeSet<E>>

Per fn, the TRANSITIVE effect set — the model’s S, with candor’s Unknown marker carried as a member (this engine’s encoding of D ≠ ∅).

calls: &'a HashMap<String, BTreeSet<String>>

The call graph AS-EFF-009 walks.

hosts: &'a HashMap<String, BTreeSet<String>>

Per fn, the TRANSITIVE literal surface AS-EFF-008 certifies against.

cmds: &'a HashMap<String, BTreeSet<String>>

paths: &'a HashMap<String, BTreeSet<String>>

tables: &'a HashMap<String, BTreeSet<String>>

surface_incomplete: &'a HashMap<String, BTreeSet<E>>

Per fn, the effects whose literal surface is structurally INCOMPLETE — the AS-EFF-008 fail-closed marker, without which a benign visible literal masks an invisible forbidden endpoint.

reason_classes: &'a HashMap<String, BTreeSet<String>>

Per fn, the TRANSITIVE reason-class tokens — the model’s D (§6.2 ⟨0.19⟩). The Unknown EFFECT propagates along the call graph, so its REASON must too: else deny E Unknown[reflect] at a caller inheriting Unknown from a reflect-caused callee sees no class and does NOT fire.

net_classes: &'a HashMap<String, Vec<String>>

Per Net-bearing fn, its ⟨0.20⟩ destination classes, ALREADY derived — by net_classes_of on the scan route, read verbatim from the report’s netClass on the report route. Absent ⇒ empty.

Implementations

impl<'a, E: AsRef<str> + Ord> GateInput<'a, E>

⟨0.24⟩ THE GATE’S INPUT — one signature per function, every field already TRANSITIVE.

E is the effect-name representation: &'static str on the scan route (the classifier’s interned vocabulary) and String on the report route (the wire’s names, taken VERBATIM — a report naming an effect this build’s vocabulary does not list must still trip a pure rule, so the names are never filtered through a known-effect allowlist on the way in).

pub fn disp<'x>(&'x self, k: &'x str) -> &'x str

The name to match a policy scope against, and to print. Identity when no map was supplied.

pub fn unit<'x>(&'x self, k: &'x str) -> &'x str

⟨0.32⟩ The §2.2 UNIT IDENTITY this key stands for — what a verdict row carries so a consumer can tell two units apart (SPEC §2). EMPTY when the caller has none to give, and empty is then omitted from the wire: this producer cannot answer beats a fabricated id.

A separate map from Self::display rather than a second use of the key, because the two routes disagree about what the key IS: the report route keys by hash already, the scan route keys by the qualified NAME and must qualify it with the crate. Reading identity off the key would have made the two routes emit different hash values for one unit, which §3.1 byte-equality forbids and which no single-route test could see.