Struct HarnessGrants 

pub struct HarnessGrants {
    pub report: HarnessReport,
    pub granted_paths: Vec<HostPath>,
    pub refusal: Option<RuntimeError>,
}

The resolved harness grant for one session: the report --explain-scope and session_start.effective_grants carry, the host paths to add to the harness’s enforcement, and the refusal (E-CAP-021) when any need the manifest does not allow, or a granted path resolving to a refused location, was found.

The report is always built, with every need’s status, so --explain-scope can print it and exit 0 even when refusal is set. Staging and mur doctor propagate refusal; explain-scope ignores it.

Fields

report: HarnessReport

granted_paths: Vec<HostPath>

The host paths to add to the harness’s enforcement: one per path need that resolved to a real directory on this host (status: granted). A missing or refused need contributes none.

refusal: Option<RuntimeError>

Some when a path or host need the manifest does not allow, or a granted path resolving to a refused location, was found: the E-CAP-021 refusal naming every one.