Module risk_acceptance 

Risk-acceptance rule YAML emit per Client spec rev1 §11.1 + phase-1-storage-architecture §3 customer-flow.

Customer runs cleanlib risk-accept → CLI emits a YAML rule the customer uploads to CDP admin UI to permit serve of a high-risk package they need for legacy / vendor-pinned reasons.

Output shape:

risk_accepted:
  - ecosystem: npm
    package: log4j-core
    version_range: "<2.15"
    justification: "Legacy system; vendor patch pending Q3 2026"
    proposed_by: "customer-admin@company.com"
    proposed_at: "2026-05-21T10:00:00Z"

Phase 1 hand-formats YAML rather than depending on serde_yaml (which is deprecated upstream and would add ~30 transitive deps). The shape is small + predictable; yaml_escape handles quote + backslash characters in the justification (the only user-controlled string field).

CLEANLIB-80: ecosystem field is emitted first so uploaded rules can be disambiguated across ecosystems (a requests package exists in both PyPI and RubyGems, lodash only in npm, etc.). Every sibling CLI command (verdict, scan, policy preview, audit) already carries an ecosystem argument — the rule YAML now matches that shape so the policy engine can match unambiguously.

Structs

Rule

Risk-acceptance rule for one package + version-range in a given ecosystem.

Functions

emit_yaml

Emit the rule as a YAML document suitable for upload to CDP admin UI.