Crate gaze_token_bridge 

gaze-token-bridge — owner-side authorization + translation bridge between a short-lived RedactionSession and long-lived, policy-scoped IndexDomains.

Contract modules

The modules model, error, session, traits, and util are the shared public contract.

Implementation modules

• Policy and projection: registry, policy, projection, keys
• Index and search: adapter, ingest
• Bridge runtime: bridge, capability, translate, audit

Invariants

• Raw PII and the session manifest never reach agent-visible output.
• Index-domain aliases / fingerprints never reach agent-visible output.
• The LLM never decides authorization; purpose is owner-bound.
• Default-deny: no matching allow rule ⇒ deny. Every error path fails closed.
• HMAC projection is (tenant, domain)-keyed only — never salted with principal.

Re-exports

pub use error::BridgeError;

pub use error::DenyReason;

pub use session::RedactionSession;

pub use traits::BridgeAuditSink;

pub use traits::DomainProjector;

pub use traits::KeyManager;

pub use traits::PolicyGate;

pub use traits::ResponseTranslator;

pub use traits::SearchAdapter;

pub use model::*;

Modules

adapter

In-memory owner-side corpus index keyed by IndexedEntityRef. Enforces entity_ref/domain/expiry/nonce guards defensively.

audit

Append-only bridge audit sink: one event per bridge decision, raw values only as sha256. Durable implementations should preserve restricted-column isolation.

bridge

TokenBridge runtime: orchestrate resolve → canonicalize → project → policy → mint capability → adapter → translate → audit. Also the chokepoint integration (ToolResources sealed handle, search_documents tool).

capability

Capability issuance and lifecycle: mint entity-bound SearchHandles, validate them, and project raw filter values before they reach the adapter.

error

Error and deny taxonomy.

ingest

Redact-before-index ingest pipeline: run corpus text through the gaze Pipeline, canonicalize and project entities, then build owner-side index hits. Raw PII must not enter the searchable index.

keys

Per-domain projection key material and rotation. Old keys are retained for reads; missing keys fail closed.

model

Shared data model.

persistent

Owner-side persistent corpus index.

policy

PolicyGate implementation: default-deny evaluation over principal/tenant/workspace/role/tool/action/owner-bound-purpose/domain/entity-class/scope.

projection

Deterministic DomainProjector implementation: HMAC((tenant,domain) key, canonical_value) → IndexedEntityRef. Never salt with principal.

registry

IndexDomainRegistry: load IndexDomains and PolicyRules from a policy file, then expose domain, rule, and key lookup.

session

The RedactionSession wrapper.

traits

Trait surfaces used by token bridge components.

translate

ResponseTranslator: rewrite owner-side index snippets into the active session namespace. Fails closed if any domain alias or raw value would remain.

util

Shared deterministic helpers.