Crate code_passenger 

code_passenger: scans a workspace with klepto, then does the writing klepto never does: feature gates across every crate of a workspace from one features document, Cargo.toml edits, file headers, reports, and the history of it all.

Modules

agent

Agent mode, on custodian_kit’s job runtime: jobs as folders in .custodian/ (queued → running → done), every step a declared code-passenger line started by custodian_kit’s executor, its receipt kept in the journal (receipts/<seq>.json), and a closing receipt in the job’s folder.

analysis

cargo

What code_passenger reads of a package’s manifest, and where it finds it.

commands

The klepto-backed commands (rules G, F, R, X in GATE_RULES.md). Each module exposes a library function the CLI and the tests call.

depth

With a feature off: what goes, how deep it sits, and who in other crates loses what. Computed on the planned tree (the tree with the plan’s edits written into a scratch copy, or the tree itself when the plan is empty), so a plan’s report and a header describe the gates as they will be.

doc

The workspace features document: one per workspace root, read by every features line and by annotate, written by init.

engine

scan: klepto’s use sites grouped per file. The files are the ones the scan read (Klepto::files), not a directory walk; the manifest facts are klepto’s feature model (crate::cargo).

error

Every error and refusal code_passenger gives, declared once as liaise codes: [CP0001] and its sentence. The code is what a script matches on; the sentence is what a person reads; the detail after it says what.

gate

Applying a klepto GatePlan to a tree (rules A1–A4 in GATE_RULES.md). Pure until EditSet::write; the oracle uses write_to on a scratch copy.

init

init and agent init.

lines

Every command code-passenger takes, declared once as an xccute line (simple_impl_derive’s CompositeShell root, a SimpleSubCommand leaf per command, its exit statuses named), and the one dispatcher that reads the words of a run back into a declared line, validates it, runs the library behind it and decides its exit status by the line’s own policy.

model

oracle

The cargo oracle (rules O1–O4 in GATE_RULES.md): proves a plan with real cargo check on a scratch copy. The real tree is never written.

packs

passenger

plans

proof_dir

The proof’s one place per workspace (custodian_kit’s proof_place, the place custodian’s test runs use too): a copy of its source at a path that does not change, and one build folder beside it, kept between proofs. A proof syncs the copy (only the files whose bytes differ are written, so cargo’s fingerprints of everything else hold), writes its edits there, and runs cargo with CARGO_TARGET_DIR on the kept build: a crate whose source did not move is not compiled again. One proof at a time holds it (a lock file, let go when the proof ends, by the OS if it dies).

scaffolds

to_toolkit

to-toolkit --function F [--write] [--out DIR]: one function’s body swapped for the simple_impl toolkit calls whose expansion it already is (custodian_kit’s patterns reading finds them; toolkit::matcher::function_at matches the one function again here, over the code as it is now).

transform

transform --spec S [--write]: one bounded change spec (custodian_kit’s change::ChangeSpec) made in the code.

words

The plan flags as one packed word (big-bad-bool), its rules the word’s own and checked by flaga_solver: check never writes, so it conflicts with write; a write the cargo check did not prove (write with no_cargo) requires unproven, said on purpose; unproven means nothing else. The word is what a receipt keeps of a run’s flags.

workspace

features plan | apply | check: the workspace features document planned for every crate in one run.