mati 0.1.4

An enforcement layer for codebase knowledge: confirmed gotchas gate what AI agents read and edit at the hook level. Not a passive memory store.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127

use super::*;

// ─────────────────────────────────────────────

/// Store key for the enforcement mode setting.
const ENFORCEMENT_MODE_KEY: &str = "enforcement:mode";

/// Store key for the local policy posture kill switch.
pub(crate) const POLICY_MODE_KEY: &str = "enforcement:policy_mode";

/// Default retention period in days.
const DEFAULT_RETENTION_DAYS: u64 = 365;

/// Store key for the retention period setting.
const RETENTION_DAYS_KEY: &str = "enforcement:retention_days";

/// Read the current enforcement mode from the store.
/// Defaults to Advisory if not set or unreadable.
pub async fn get_enforcement_mode(store: &Store) -> EnforcementMode {
    match store.get_raw_bytes(ENFORCEMENT_MODE_KEY).await {
        Ok(Some(bytes)) => match std::str::from_utf8(&bytes) {
            Ok("strict") => EnforcementMode::Strict,
            _ => EnforcementMode::Advisory,
        },
        _ => EnforcementMode::Advisory,
    }
}

/// Persist the enforcement mode to the store. Returns the previous mode.
/// Records an EnforcementConfigChanged event when the mode actually changes.
pub async fn set_enforcement_mode(store: &Store, mode: EnforcementMode) -> Result<EnforcementMode> {
    let old = get_enforcement_mode(store).await;
    let value = match mode {
        EnforcementMode::Advisory => "advisory",
        EnforcementMode::Strict => "strict",
    };
    store
        .put_raw(ENFORCEMENT_MODE_KEY, value.as_bytes())
        .await?;

    // Record config change event if the mode actually changed. The audit event
    // uses the USER-FACING vocabulary (audit.write_durability / best_effort),
    // even though the internal enum + stored value stay advisory/strict (frozen
    // by the RecordingGap hash contract and the storage round-trip).
    if old != mode {
        let user_label = |m: EnforcementMode| match m {
            EnforcementMode::Advisory => "best_effort",
            EnforcementMode::Strict => "strict",
        };
        // Best-effort — don't fail the config change if event recording fails
        let _ = record_event(
            store,
            EnforcementEventType::EnforcementConfigChanged {
                setting: "audit.write_durability".to_string(),
                old_value: user_label(old).to_string(),
                new_value: user_label(mode).to_string(),
            },
            SubjectKind::Config,
            "enforcement:mode".to_string(),
            "developer".to_string(),
            None,
            "config_changed".to_string(),
            None,
        )
        .await;
    }
    Ok(old)
}

/// Read the policy posture. Policies deny by default when this key is absent
/// or unreadable; `advisory` is an explicit global kill switch.
pub async fn get_policy_mode(store: &Store) -> EnforcementMode {
    match store.get_raw_bytes(POLICY_MODE_KEY).await {
        Ok(Some(bytes)) if bytes.as_slice() == b"advisory" => EnforcementMode::Advisory,
        _ => EnforcementMode::Strict,
    }
}

/// Persist the policy posture and return the previous value.
pub async fn set_policy_mode(store: &Store, mode: EnforcementMode) -> Result<EnforcementMode> {
    let old = get_policy_mode(store).await;
    let value = match mode {
        EnforcementMode::Advisory => "advisory",
        EnforcementMode::Strict => "strict",
    };
    store.put_raw(POLICY_MODE_KEY, value.as_bytes()).await?;
    if old != mode {
        let label = |mode: EnforcementMode| match mode {
            EnforcementMode::Advisory => "advisory",
            EnforcementMode::Strict => "strict",
        };
        let _ = record_event(
            store,
            EnforcementEventType::EnforcementConfigChanged {
                setting: "policy.mode".to_string(),
                old_value: label(old).to_string(),
                new_value: label(mode).to_string(),
            },
            SubjectKind::Config,
            POLICY_MODE_KEY.to_string(),
            "developer".to_string(),
            None,
            "config_changed".to_string(),
            None,
        )
        .await;
    }
    Ok(old)
}

/// Read the configured retention period in days.
pub async fn get_retention_days(store: &Store) -> u64 {
    match store.get_raw_bytes(RETENTION_DAYS_KEY).await {
        Ok(Some(bytes)) => std::str::from_utf8(&bytes)
            .ok()
            .and_then(|s| s.parse::<u64>().ok())
            .unwrap_or(DEFAULT_RETENTION_DAYS),
        _ => DEFAULT_RETENTION_DAYS,
    }
}

/// Persist the retention period.
pub async fn set_retention_days(store: &Store, days: u64) -> Result<()> {
    store
        .put_raw(RETENTION_DAYS_KEY, days.to_string().as_bytes())
        .await
}