Struct RollbackPolicy 

pub struct RollbackPolicy {
    pub guard_every: u32,
    pub steer_window: u32,
    pub soft_threshold: SafetyScore,
    pub hard_threshold: SafetyScore,
    pub max_rollbacks: u8,
    pub max_checkpoints: u8,
}

Cadence and bounds for the checkpointed-rollback control loop (ADR-012), chosen per device tier so cost scales with the hardware budget (ADR-003).

steer_window is the ADR-012 stage-1 early-token soft-steering window (ADR-013): model-backed steering applies for the first steer_window output tokens, then decode falls back to hard-bans-only unless the guard re-escalates. Hard bans still apply every step regardless. Checkpoint spacing is guard_every — checkpoints are only taken at guard-verified-safe boundaries, so there is no separate checkpoint cadence to misconfigure.

Fields

guard_every: u32

Score the output every guard_every tokens (0 = never); also the spacing of safe-prefix checkpoints.

steer_window: u32

Apply model-backed (soft) steering for the first steer_window output tokens (0 = never — token-only/hard-ban steering at every step).

soft_threshold: SafetyScore

At/above this score, escalate; do not advance the safe checkpoint.

hard_threshold: SafetyScore

At/above this score, roll back (or fail closed).

max_rollbacks: u8

Hard cap on rollbacks before a deterministic refusal (DoS bound).

max_checkpoints: u8

Bounded checkpoint ring size — fixed memory (ADR-003).

Implementations

impl RollbackPolicy

pub fn for_device(device: DeviceTarget, mode: SafetyMode) -> RollbackPolicy

Tier-aware policy. SafetyMode::Off disables the loop entirely.

pub fn disabled() -> RollbackPolicy

A policy that performs no steering, checkpointing, or guarding.

pub fn guards(&self) -> bool

Whether the guard/rollback machinery is active under this policy.

pub fn active(&self) -> bool

Whether any safety stage (guard/rollback or the soft-steering window) is active — used to gate ingress triage (ADR-013).

Trait Implementations

impl Clone for RollbackPolicy

fn clone(&self) -> RollbackPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for RollbackPolicy

impl Debug for RollbackPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Eq for RollbackPolicy

impl PartialEq for RollbackPolicy

fn eq(&self, other: &RollbackPolicy) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for RollbackPolicy