arbiter/
lib.rs

1//! # arbiter
2//!
3//! Cedar-based policy enforcement as Suggestors for the Converge Engine.
4//!
5//! Policy gates participate INSIDE the convergence loop — they evaluate
6//! proposals against Cedar policies and write constraints for violations.
7//!
8//! ## Usage
9//!
10//! ```rust,ignore
11//! use arbiter::{PolicyGateSuggestor, PolicyEngine};
12//! use std::sync::Arc;
13//!
14//! let engine = PolicyEngine::from_policy_str(EXPENSE_APPROVAL_POLICY)?;
15//! let gate = PolicyGateSuggestor::new(Arc::new(engine));
16//! converge_engine.register_suggestor(gate);
17//! ```
18//!
19//! ## Available Suggestors
20//!
21//! - [`PolicyGateSuggestor`] — Cedar policy evaluation
22//! - [`DelegationVerifySuggestor`] — Ed25519 delegation chain verification
23//! - [`FlowGateSuggestor`] — Flow-level authorization gates
24//! - [`CedarHitlGateSuggestor`] — named strict Cedar-backed HITL gate for Formations
25
26// ── Public API: Suggestors + construction types ───────────────────────
27
28#[cfg(feature = "analysis")]
29pub mod analysis;
30pub mod engine;
31pub mod formation;
32pub mod primitives;
33pub mod provenance;
34pub mod suggestor;
35pub mod types;
36
37#[cfg(feature = "analysis")]
38pub use analysis::{
39    CedarAnalysisBackend, CedarAnalysisCheck, CedarAnalysisError, CedarAnalysisExecutionStatus,
40    CedarAnalysisInput, CedarAnalysisPlan, CedarAnalysisQuery, CedarAnalysisReport,
41    CedarRequestEnvironmentAnalysis, EXPENSE_NON_FINANCE_HIGH_VALUE_COMMIT_CLAIM_POLICY,
42    LocalCvc5AnalysisBackend, compile_analysis_plan, execute_analysis_with_cvc5,
43    execute_analysis_with_solver, execute_analysis_with_solver_and_identity,
44};
45pub use engine::PolicyEngine;
46pub use formation::{
47    ANALYSIS_EVIDENCE_CAPABILITY_ID, ARBITER_FORMATION_CAPABILITIES, ARBITER_FORMATION_PACK_ID,
48    ArbiterFormationCapability, ArbiterFormationCapabilityKind, HITL_GATE_CAPABILITY_ID,
49    POLICY_GATE_CAPABILITY_ID, find_formation_capability, formation_capabilities,
50};
51pub use primitives::{Confidence, CostUsd, EpochSeconds, ProposalCount, ProposalLimit};
52pub use provenance::{ARBITER_PROVENANCE, Arbiter};
53#[cfg(feature = "analysis")]
54pub use suggestor::CedarAnalysisSuggestor;
55pub use suggestor::{
56    ApprovalConstraintPayload, ApprovalGateStatus, ApprovalGateSuggestor, ApprovalRiskPayload,
57    BudgetConstraintPayload, BudgetGateSuggestor, CedarHitlGateSuggestor, ComplianceCondition,
58    ComplianceConstraintPayload, ComplianceDocumentPayload, ComplianceGateSuggestor,
59    ComplianceRule, CostEstimatePayload, DataClassificationConstraintPayload,
60    DataClassificationGateSuggestor, DelegationVerificationPayload, DelegationVerifySuggestor,
61    FlowGateSuggestor, GateConstraintAction, PolicyGateSuggestor, RateLimitConstraintPayload,
62    RateLimitGateSuggestor,
63};
64pub use types::{ContextIn, DecideRequest, PrincipalIn, ResourceIn};
65
66/// Built-in Cedar policies for reference and testing.
67pub const EXPENSE_APPROVAL_POLICY: &str = include_str!("../policies/expense_approval.cedar");
68pub const EXPENSE_APPROVAL_SCHEMA: &str = include_str!("../schemas/expense_approval.cedarschema");
69pub const FLOW_GOVERNANCE_POLICY: &str = include_str!("../policies/flow_governance.cedar");
70pub const VENDOR_SELECTION_POLICY: &str = include_str!("../policies/vendor_selection.cedar");
71
72// ── Supporting types (needed by consumers for construction/evaluation) ─
73
74pub mod decision;
75pub mod delegation;
76pub mod flow;
77
78pub use converge_core::{
79    FlowAction, FlowGateAuthorizer, FlowGateDecision, FlowGateError, FlowGateInput, FlowGateOutcome,
80};
81pub use decision::{PolicyDecision, PolicyOutcome};
82pub use delegation::Delegation;
arbiter/lib.rs

arbiter/
lib.rs
