Module governance_overlay 

Project governance overlay, kernel side: load, merge, hash (ADR-103 D8). Project governance overlay, kernel side (ADR-103 A6, D8, Phase 2 package E).

Package A owns the file format and the tighten-only rule (clawft_types::config::overlay); this module adds what only the kernel can do:

• load_overlay: read <root>/.weftos/overlay.toml. A missing file is the empty overlay (nothing is added); every other failure (unreadable, not a regular file, too large, not UTF-8, does not parse) is an error, never an empty overlay. A broken overlay must not become fewer rules.
• merge: the user’s ParentPolicy plus the overlay become one Effective rule set, limits and three hashes. The merge itself is package A’s overlay_merge; nothing here relaxes it and nothing is clamped silently.
• Effective::into_rules: the rules for GovernanceEngine::add_rule.

Rule mapping

The parent’s rules are carried over verbatim, active and severity included. Each overlay deny glob becomes one blocking rule that fires on the action alone (force_on_match) and is tagged OVERLAY_DENY_TAG, so the engine answers Deny even when the engine-wide human-approval flag is on. Each require_approval glob is the same shape tagged OVERLAY_APPROVAL_TAG and answers EscalateToHuman. Globs are an exact action or a prefix ending in one *: workload.place* also matches workload.placement.x (documented in package A).

Hashes

All three are SHA-256 over a domain tag plus canonical JSON (canonical_json); floats never appear (a risk threshold is hashed as the hex of its IEEE-754 bits).

• parent_hash: "weftos-parent-rules-v1\n" + {limits, rules}, rules sorted by id. Recomputed from the rules, never read from the file.
• overlay_hash: "weftos-overlay-v1\n" + the parsed overlay, so comments and whitespace do not change it.
• effective_hash: "weftos-effective-rules-v1\n" + {limits, overlay_hash, parent_hash, rules} with the merged rules sorted by id. Each rule is its full serialized form, so active, severity and selectors are covered.

Structs

Effective

The merged result a project kernel runs with.

Overlay

A parsed overlay plus its hash.

Enums

OverlayError

Why an overlay, a parent policy or their merge was refused.

Constants

EFFECTIVE_HASH_DOMAIN

Domain tag of the effective-rules hash.

MAX_FILE_BYTES

Largest overlay or parent-policy file read, in bytes.

OVERLAY_HASH_DOMAIN

Domain tag of the overlay hash.

Functions

load_overlay

Load overlay.toml. A missing file is Overlay::empty; any other failure is an error (fail closed, ADR-103 A6 decision 2).

merge

Merge overlay onto parent (tighten-only). The parent’s signature is NOT checked here (see crate::parent_policy::verify_parent_policy); its rule hash is recomputed rather than trusted.