Enum ProvenanceTier 

pub enum ProvenanceTier {
    Runtime,
    Maintainer,
    Public,
}

The trust tier of one issue. Exactly one, always resolved before its text is readable.

Variants

Runtime

Filed by the account this runtime authenticates as (gh api user), carrying a signature this process recomputed locally. May seed a session and may source an outcome contract: this process authored the reproduction, not a model and not a stranger.

Note what this is not: there is no dedicated bot account today, so in practice it is whichever operator ran gh auth login. That is why deduplication in super::fix_issues accepts maintainer too — a teammate’s report is not a forgery — and why only public is excluded.

Maintainer

The author holds write, maintain, triage or admin permission on the repository. May seed a session. The body is still data, not instruction.

Public

Everyone else — and the default whenever permission cannot be established at all. Never seeds a session, never sources a contract.

Implementations

impl ProvenanceTier

pub fn as_str(self) -> &'static str

pub fn may_seed_session(self) -> bool

Whether an issue at this tier may seed a coder session.

pub fn may_source_contract(self) -> bool

Whether an issue at this tier may source an outcome contract.

Runtime only, matching the table in car#1081: a contract may derive from the attached machine-generated reproduction because the runtime authored it — not a model, and not a person.

This deliberately does NOT extend to maintainer. An earlier version did, arguing that a maintainer “holds write access to the repository, so gating their issue body while leaving that door open would be theatre”. That argument is false for one of the roles RepoPermission::is_maintainer accepts: GitHub defines triage as managing issues and pull requests without write access to the code. For a triage collaborator the door is not already open, so this gate is not theatre — it is the only gate.

Why that matters concretely: car-releases is public, and triage is the role handed to a community moderator. One triage account, granted or compromised, could otherwise open an issue whose body sources a trivially-green contract, pass it against an untouched baseline, and mint a runtime-stamped “premise wrong, already fixed” — the exact contract-poisoning write path car#1081 was filed to close, reached by someone who cannot push a commit.

A maintainer may still seed a session (Self::may_seed_session); that is where the write-access argument genuinely applies.

Trait Implementations

impl Clone for ProvenanceTier

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ProvenanceTier

impl Debug for ProvenanceTier

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ProvenanceTier

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for ProvenanceTier

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ProvenanceTier

impl PartialEq for ProvenanceTier

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for ProvenanceTier

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ProvenanceTier