gaze_token_bridge/
lib.rs

1//! gaze-token-bridge — owner-side authorization + translation bridge between a
2//! short-lived [`RedactionSession`] and long-lived, policy-scoped IndexDomains.
3//!
4//! # Contract modules
5//! The modules [`model`], [`error`], [`session`], [`traits`], and [`util`] are the
6//! shared public contract.
7//!
8//! # Implementation modules
9//! - **Policy and projection**: [`registry`], [`policy`], [`projection`], [`keys`]
10//! - **Index and search**: [`adapter`], [`ingest`]
11//! - **Bridge runtime**: [`bridge`], [`capability`], [`translate`], [`audit`]
12//!
13//! # Invariants
14//! - Raw PII and the session manifest never reach agent-visible output.
15//! - Index-domain aliases / fingerprints never reach agent-visible output.
16//! - The LLM never decides authorization; `purpose` is owner-bound.
17//! - Default-deny: no matching allow rule ⇒ deny. Every error path fails closed.
18//! - HMAC projection is `(tenant, domain)`-keyed only — never salted with principal.
19
20// --- Shared contract ---
21pub mod error;
22pub mod model;
23pub mod session;
24pub mod traits;
25pub mod util;
26
27// --- Policy and projection ---
28pub mod keys;
29pub mod policy;
30pub mod projection;
31pub mod registry;
32
33// --- Index and search ---
34pub mod adapter;
35pub mod ingest;
36pub mod persistent;
37
38// --- Bridge runtime ---
39pub mod audit;
40pub mod bridge;
41pub mod capability;
42pub mod translate;
43
44pub use error::{BridgeError, DenyReason};
45pub use model::*;
46pub use session::RedactionSession;
47pub use traits::{
48    BridgeAuditSink, DomainProjector, KeyManager, PolicyGate, ResponseTranslator, SearchAdapter,
49};
gaze_token_bridge/lib.rs

gaze_token_bridge/
lib.rs
