Enum Verdict 

pub enum Verdict {
    Allow,
    Deny {
        reason: String,
        guard: String,
        http_status: u16,
        details: Box<DenyDetails>,
    },
    Cancel {
        reason: String,
    },
    Incomplete {
        reason: String,
    },
}

The verdict for an HTTP request evaluation. Consistent with chio_core_types::Decision but carries HTTP-specific context.

Variants

Allow

Request is allowed. Proceed to upstream.

Deny

Request is denied. Return a structured error response.

Fields

reason: String

Human-readable reason for denial.

guard: String

The guard or policy rule that triggered the denial.

http_status: u16

Suggested HTTP status code for the error response (default 403).

details: Box<DenyDetails>

Structured deny context: tool identity, required vs granted scope, a stable reason code, receipt id, and a next-steps hint. All fields are optional and default to None, so this field is transparent to wire clients that ignore deny details.

Boxed to keep the Verdict enum compact on the hot allow path; the structured deny context is only populated on the (comparatively rare) deny path.

Cancel

Request evaluation was cancelled (e.g., timeout, circuit breaker).

Fields

reason: String

Reason for cancellation.

Incomplete

Request evaluation did not reach a terminal state.

Fields

reason: String

Reason for incomplete evaluation.

Implementations

impl Verdict

pub fn deny(reason: impl Into<String>, guard: impl Into<String>) -> Self

Deny with a 403 status.

pub fn deny_with_status( reason: impl Into<String>, guard: impl Into<String>, http_status: u16, ) -> Self

Deny with a custom HTTP status code.

pub fn deny_detailed( reason: impl Into<String>, guard: impl Into<String>, details: DenyDetails, ) -> Self

Deny with a full structured context block.

Prefer this constructor when the kernel already knows what scope was needed versus granted, which guard fired, and a hint for the developer. The HTTP status defaults to 403.

pub fn with_deny_details(self, new_details: DenyDetails) -> Self

Attach (or overwrite) the structured deny context on an existing Deny verdict. No-op for non-Deny variants. Useful when the guard pipeline constructs a plain deny and a later enrichment stage populates the details.

pub fn is_allowed(&self) -> bool

pub fn is_denied(&self) -> bool

pub fn to_decision(&self) -> Decision

Convert to the core Decision type for receipt signing.

Trait Implementations

impl Clone for Verdict

fn clone(&self) -> Verdict

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Verdict

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Verdict

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl From<Decision> for Verdict

fn from(decision: Decision) -> Self

Converts to this type from the input type.

impl PartialEq for Verdict

fn eq(&self, other: &Verdict) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Verdict

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for Verdict

impl StructuralPartialEq for Verdict