Struct ScopeReport 

pub struct ScopeReport {

    pub declared_containment: ContainmentClass,
    pub achieved_containment: ContainmentClass,
    pub floor_met: bool,
    pub shortfall_reason: Option<String>,
    pub enforcement_tier: &'static str,
    pub filesystem_scope: Option<String>,
    pub workdir_exec: bool,
    pub network_allow: Vec<String>,
    pub unix_sockets: bool,
    pub shell_allow: Vec<String>,
    pub spawn_allow: Vec<String>,
    pub env_allow: Vec<String>,
    pub interpreter_runtime_grants: Vec<String>,
    pub staged_runtime_grants: Vec<String>,
}

Read-only answer to “what would this capsule actually be allowed to do on this host?”.

Built from the already-parsed CapabilityPolicy plus one host tier probe. Nothing here stages artifacts, touches a registry, creates a workdir or resolves DNS — it is a diagnostic, so it reports even when Self::floor_met is false.

Fields

declared_containment: ContainmentClass

Strongest class any source asked for (manifest / workspace config / --containment).

achieved_containment: ContainmentClass

Strongest class this host can actually back, derived from the tier probe alone.

floor_met: bool

achieved_containment >= declared_containment. false means mur run would refuse.

shortfall_reason: Option<String>

The missing mechanism when floor_met is false; absent otherwise.

enforcement_tier: &'static str

The probed host tier, as a stable wire name.

filesystem_scope: Option<String>

capabilities.filesystem.scope, verbatim.

workdir_exec: bool

capabilities.filesystem.workdir_exec. Always present (never skipped when false), so a consumer can tell “declared false” from “this runtime predates the key” by the field’s presence rather than by its value.

true is the only manifest declaration that lowers Self::achieved_containment, which is why it is reported next to the grants rather than buried: reading achieved: advisory on a Landlock-capable host makes sense only alongside it.

network_allow: Vec<String>

capabilities.network.allow, verbatim — declared destinations, not resolved IPs.

unix_sockets: bool

capabilities.network.unix_sockets.

shell_allow: Vec<String>

capabilities.shell.allow, verbatim.

spawn_allow: Vec<String>

capabilities.spawn.allow, verbatim.

env_allow: Vec<String>

capabilities.env.allow, verbatim.

interpreter_runtime_grants: Vec<String>

Every host directory a capabilities.shell.interpreter_runtime grant opens, rendered as <binary>: <dir>[ (list_dir)]. These are the paths outside the workdir that stay reachable even at scoped.

staged_runtime_grants: Vec<String>

Every capabilities.shell.staged_runtime grant, rendered as <binary>: <source_path> (pin: <pin>). These are host runtime trees a sealed capsule asks to have bind-mounted read-only into its composed root.

Reported whatever the floor and whatever this host can back — a capsule that declares a staged runtime and cannot run here is exactly the case an operator is inspecting when they reach for --explain-scope, so hiding the grant behind a met floor would blank out the diagnostic in the one case it is for.

Implementations

impl ScopeReport

pub fn render(&self) -> String

Human-readable rendering used by mur run --explain-scope without --json.

Trait Implementations

impl Clone for ScopeReport

fn clone(&self) -> ScopeReport

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ScopeReport

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ScopeReport

impl PartialEq for ScopeReport

fn eq(&self, other: &ScopeReport) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for ScopeReport

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ScopeReport