pub struct EnginePromotionToken { /* private fields */ }Expand description
Engine-only proof-of-construction token for AppliedFix::__engine_promote.
AppliedFix::__engine_promote accepts an EnginePromotionToken; the
only way to obtain one is EnginePromotionToken::__engine_construct.
Because the token’s sole field is private to marque-rules, no
external crate can brace-construct one, and the constructor is
#[doc(hidden)] and named to make the bypass intent obvious at the
call site.
This is the type-level seal for Constitution V Principle V’s
engine-only contract on audit-record promotion. See
AppliedFix::__engine_promote for the binding contract and the
test-fixture carve-out.
§Compile-fail proof of the seal
External crates cannot brace-construct an EnginePromotionToken
because the _seal field is private to marque-rules. Doctests
compile as separate crates against the library’s public API, so
the following snippet is rejected by the compiler — which is what
compile_fail asserts:
// External crates see `EnginePromotionToken` but not `_seal`,
// so brace-construction is rejected. Bypass requires calling
// `EnginePromotionToken::__engine_construct()`, which is the
// single auditable bypass surface.
let _token = marque_rules::EnginePromotionToken { _seal: () };