icebox-gov 0.2.6

Runtime governance for autonomous offensive security — the single seam every human operator, REST client, and LLM agent must pass through before anything touches a target.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

use serde::{Deserialize, Serialize};

/// The 10-stage mandatory GEE lifecycle. Only moves forward.
#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum GeeStage {
    Request,
    PolicyEvaluation,
    ScopeEnforcement,
    SandboxProvisioning,
    ApprovalCheck,
    Execute,
    CollectEvidence,
    Audit,
    Validate,
    Destroy,
}

impl GeeStage {
    pub fn as_str(&self) -> &'static str {
        match self {
            GeeStage::Request => "request",
            GeeStage::PolicyEvaluation => "policy_evaluation",
            GeeStage::ScopeEnforcement => "scope_enforcement",
            GeeStage::SandboxProvisioning => "sandbox_provisioning",
            GeeStage::ApprovalCheck => "approval_check",
            GeeStage::Execute => "execute",
            GeeStage::CollectEvidence => "collect_evidence",
            GeeStage::Audit => "audit",
            GeeStage::Validate => "validate",
            GeeStage::Destroy => "destroy",
        }
    }

    pub fn lifecycle() -> &'static [GeeStage] {
        &[
            GeeStage::Request,
            GeeStage::PolicyEvaluation,
            GeeStage::ScopeEnforcement,
            GeeStage::SandboxProvisioning,
            GeeStage::ApprovalCheck,
            GeeStage::Execute,
            GeeStage::CollectEvidence,
            GeeStage::Audit,
            GeeStage::Validate,
            GeeStage::Destroy,
        ]
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn lifecycle_proceeds_only_forward() {
        let order = GeeStage::lifecycle();
        assert_eq!(order.len(), 10);
        for w in order.windows(2) {
            assert!(w[0] < w[1], "stage {w:?} must be ordered");
        }
    }

    #[test]
    fn stage_names_are_stable_api() {
        assert_eq!(GeeStage::PolicyEvaluation.as_str(), "policy_evaluation");
        assert_eq!(
            GeeStage::SandboxProvisioning.as_str(),
            "sandbox_provisioning"
        );
        assert_eq!(GeeStage::Destroy.as_str(), "destroy");
    }
}