Struct TaintLedger 

pub struct TaintLedger { /* private fields */ }

Runtime-observed taint provenance: the state keys, per tenant, that currently hold a value derived from an untrusted tool result.

Owned by the crate::Runtime and installed alongside the VIGIL intent gate — no intent gate, no ledger, so an unconfigured runtime pays nothing. See the module docs for the threat model and the limitations.

Implementations

impl TaintLedger

pub fn new(untrusted_tools: HashSet<String>) -> Self

Build a ledger over the configured untrusted tool names.

pub fn untrusted_tools(&self) -> &HashSet<String>

The configured untrusted tool names.

pub async fn record_result( &self, tenant: Option<&str>, action: &Action, written_keys: impl IntoIterator<Item = String>, )

Record the provenance of one successful action.

written_keys is what the action actually changed (the executor’s state_changes: declared expected_effects plus the state transitions dispatch produced). The result is tainted when the action’s tool is untrusted, or when it read a key that is already tainted for tenant; a tainted result taints every written key and a trusted one clears them.

Failed actions must NOT be recorded — a failed action commits no effects, so it changes no provenance.

pub async fn untrusted_action_ids( &self, tenant: Option<&str>, actions: &[Action], ) -> HashSet<String>

The ids of actions whose read set intersects tenant’s tainted keys — exactly the untrusted_ids input car_verify::intent::intent_actions_from takes.

Tools named in untrusted_tools are deliberately NOT re-derived here: intent_actions_from already marks those from the tool name. This answers the question the tool name cannot — did this action read something a previous untrusted result wrote?

pub async fn tainted_keys(&self, tenant: Option<&str>) -> HashSet<String>

The tainted state keys for tenant — for tests and observability.