tracevault-core 0.16.0

Core library for TraceVault - AI code tracing and attribution
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109

use serde::{Deserialize, Serialize};
use uuid::Uuid;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct PolicyRule {
    pub id: Uuid,
    pub org_id: Option<String>,
    pub name: String,
    pub description: String,
    pub condition: PolicyCondition,
    pub action: PolicyAction,
    pub severity: PolicySeverity,
    pub enabled: bool,
    #[serde(default)]
    pub scope: PolicyScope,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(tag = "type")]
pub enum PolicyCondition {
    TraceCompleteness,
    AiPercentageThreshold {
        threshold: f32,
    },
    ModelAllowlist {
        allowed_models: Vec<String>,
    },
    SensitivePathPattern {
        patterns: Vec<String>,
    },
    RequiredToolCall {
        tool_names: Vec<String>,
        #[serde(default)]
        must_succeed: bool,
    },
    TokenBudget {
        max_tokens: Option<u64>,
        max_cost_usd: Option<f64>,
    },
    ConditionalToolCall {
        tool_name: String,
        min_count: Option<u32>,
        when_files_match: Option<Vec<String>>,
        #[serde(default)]
        must_succeed: bool,
    },
}

/// Which evaluation window this policy applies to.
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Default)]
#[serde(rename_all = "snake_case")]
pub enum PolicyScope {
    /// Evaluated over the entire push window (default).
    #[default]
    Session,
    /// Evaluated only against events inside the last validation window.
    ValidationWindow,
    /// Evaluated in both contexts.
    Both,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum PolicyAction {
    BlockPush,
    Warn,
    /// Tool is explicitly permitted inside a validation window without a count
    /// requirement. Prevents it from triggering the unknown-tool gate.
    Allow,
}

/// Org/repo-level setting controlling what happens when an unknown tool
/// (not covered by any validation_window-scoped policy) is called inside
/// the validation window.
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Default)]
#[serde(rename_all = "snake_case")]
pub enum ValidationWindowMode {
    /// No window enforcement (default).
    #[default]
    Disabled,
    /// Unknown tool call is flagged but push succeeds.
    Warn,
    /// Unknown tool call blocks the push.
    Block,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum PolicySeverity {
    Critical,
    High,
    Medium,
    Low,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct PolicyEvaluation {
    pub policy: PolicyRule,
    pub result: EvalResult,
    pub details: String,
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
#[serde(rename_all = "lowercase")]
pub enum EvalResult {
    Pass,
    Fail,
    Warn,
}