1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
//! FathomDB facade crate — re-exports the public Rust surface of `fathomdb-engine`.
//!
//! The **default** (operator-feature-OFF) surface is the *governed application
//! surface* (`dev/interfaces/rust.md` § Governed-surface contract): it is
//! recovery-name-free and raw-SQL-free at the **method** level. The
//! operator/recovery seam (`rebuild_*`, `excise_source`, `dump_*`,
//! `trace_source_ref`, `truncate_wal`, `verify_embedder`, `check_integrity`,
//! `safe_export`, `recompute_mean` + their report types) is gated behind the
//! `operator` cargo feature, which `fathomdb-cli` enables. Gating, not deletion:
//! engine behavior is identical with the feature on. See AC-074
//! (`dev/acceptance.md`) + `dev/design/slice-27-fix1-operator-gate-design.md`.
// The 26 governed application-surface types (`dev/interfaces/rust.md` § 2a) —
// always present on the default facade.
//
// 17 original types + 7 new types from Slices 20 (G5/G6) and 35 (G4):
// Slice 20: ComparisonOp, NodeRecord, Predicate, ScalarValue, SearchExpandResult,
// SearchFilter, TraversalDirection
// + 2 new types from Slice 15 (G11 BYO-LLM ingest — fix-29):
// ExtractDocument, IngestWithExtractorReceipt
// + 3 new types from 0.8.8 Slice 5 (EXP-OBS explain sidecar):
// Explanation, QueryTrace, PerHitExplain
pub use ;
// The 20 operator-seam report types (`dev/interfaces/rust.md` § 2b) — CLI-only,
// gated behind `operator`. The backing `Engine` methods are operator-gated in
// `fathomdb-engine`, so the default facade is recovery-clean at the method level.
pub use ;
/// AC-074 method-level pin (Q5=BIND-RUST, Slice 27 fix-1): in a **default**
/// (operator-OFF) build the governed `fathomdb::Engine` exposes **no**
/// recovery-denylist-named method. Rust has no runtime method reflection, so the
/// guarantee is pinned by `compile_fail` doctests (the only mechanism that can
/// assert a method does *not* resolve). This module is
/// `#[cfg(not(feature = "operator"))]`, so feature-unified `--workspace` builds
/// (which turn `operator` ON via `fathomdb-cli`) correctly skip it.
///
/// `rebuild_projections` does not resolve on the default facade:
/// ```compile_fail
/// fn _no_rebuild_projections(e: &fathomdb::Engine) {
/// let _ = e.rebuild_projections();
/// }
/// ```
///
/// `rebuild_vec0` does not resolve on the default facade:
/// ```compile_fail
/// fn _no_rebuild_vec0(e: &fathomdb::Engine) {
/// let _ = e.rebuild_vec0();
/// }
/// ```
///
/// `excise_source` (operator seam) does not resolve on the default facade:
/// ```compile_fail
/// fn _no_excise(e: &fathomdb::Engine) {
/// let _ = e.excise_source("s");
/// }
/// ```
/// AC-074 no-raw-SQL release-surface pin: the shipped (release) facade exposes
/// no raw-SQL method. The **canonical** guarantee is the engine's
/// `Engine::execute_for_test` gate — `#[cfg(debug_assertions)] #[doc(hidden)]`,
/// so the symbol is absent from release builds (verified: it is not present in
/// `target/release/libfathomdb_engine.rlib`). This `#[cfg(not(debug_assertions))]`
/// module is the release-surface pin in the best-effort `no_recovery_surface.rs`
/// style; it is compiled out of debug builds, and a true no-debug-assertions doc
/// build runs the `compile_fail` below. (Plain `cargo test --release` may not
/// re-run rustdoc with debug-assertions off, so this is a documented pin backed
/// by the engine cfg-gate, not a load-bearing CI assertion.)
///
/// `execute_for_test` (raw SQL) does not resolve in a release build:
/// ```compile_fail
/// fn _no_raw_sql(e: &fathomdb::Engine) {
/// let _ = e.execute_for_test("SELECT 1");
/// }
/// ```