Module harness_needs 

What a transport: process harness needs beyond what the capsule’s class gives every command, and where the capsule manifest allows it.

A process driver’s describe().harness-needs names the host directories and hosts the harness reaches on its own — Claude Code’s config folder, its inference host — the environment half being required-env. Each need is granted only where the capsule manifest also allows it: a path by capabilities.harness.paths, a host by capabilities.network.allow. A need the manifest does not allow refuses the launch with E_CAP_021; nothing is spawned.

What is granted is the driver’s path at the driver’s access, never the wider manifest entry, and a granted path goes through the same host-folder checks as an operator host_paths entry (crate::host_paths::resolve_host_paths) and never carries Execute. The resolution is computed once at staging, set on the policy’s report, and recomputed identically by mur run --explain-scope (read-only, exit 0 even when a need is refused).

Structs

HarnessBinaryInfo

The resolved harness binary, for the report and the enforcement derivation.

HarnessBinaryReport

The resolved harness binary and, for a #! script, the interpreter its first line names.

HarnessEnvReport

One required-env variable’s row.

HarnessGrants

The resolved harness grant for one session: the report --explain-scope and session_start.effective_grants carry, the host paths to add to the harness’s enforcement, and the refusal (E-CAP-021) when any need the manifest does not allow, or a granted path resolving to a refused location, was found.

HarnessHostReport

One host need’s row.

HarnessPathReport

One path need’s row: what the driver asked for, where it resolved, and whether it was granted.

HarnessReport

The harness key of a crate::containment::ScopeReport: the driver, the harness binary and its interpreter, and each path, host and env need with its status. null on a capsule whose transport is not process.

Functions

render_harness_block

The Process harness (<driver>) block mur run --explain-scope prints: the binary and its interpreter, then each path need (need → path (access), allowed by <entry> for a granted one, or its status and reason), each host need and each required env variable. Starts with a header and ends with a newline.

resolve_harness_grants

Resolves a session’s harness grants: the allow rule against the manifest, then the host-folder checks for each allowed path, collecting every disallowed or refused need into one E-CAP-021 refusal.

unresolved_report

The harness report for --explain-scope when the driver could not be read: every list empty, unresolved naming why.