Module spec 

The attest-inputs declaration (SPEC.md, “Input fingerprints”) and the canonical-tree opt-out it governs (SPEC.md, “Canonical tree”).

Structs

Findings

What check_coverage found. Empty means every required gate declares every tracked file.

PathTok

One declared path. ?src/build.rs in the spec is optional: it may be absent, and its absence is then part of the fingerprint. The marker is stripped here, once, so no consumer can ever hand ?x to git — where it would match nothing and silently drop out of the fingerprint.

Spec

The committed declaration of which paths each gate reads.

Enums

AtError

Why a tree has a spec that cannot be used. Each disables the input-fingerprint route only.

CoverageError

Why the coverage question cannot be answered. A guard that cannot answer fails, unlike the verifier, whose contract is fail-open.

Error

Why a spec is invalid. Any one invalidates the whole spec. Display is the reason the verifier reports, after the spec’s path.

PathProblem

Why a path token is not a literal, root-relative file or directory. git ls-tree does not glob, so a wildcard would match nothing and silently fingerprint nothing; every other shape here is a path git would interpret rather than look up.

PlanExempt

What a tree says about the canonical route.

Constants

DEPRECATED_OPT_OUT

The line a verifier reports when only the deprecated opt-out is present.

EXEMPT

Paths no gate reads, exempt from the coverage check: the plans a change keeps rewriting. Everything else a repository tracks is either declared or the check fails.

MAX_SPEC_BYTES

MAX_SPEC_GATES

MAX_SPEC_PATHS

PLAN_EXEMPT_DIRECTIVE

The one directive a spec may hold (1.6.0): the canonical opt-out.

SPEC_PATHS

Where a repository declares which paths each gate reads, in order of precedence. Both are always part of every fingerprint’s listing.

Functions

at

The spec committed in tree and where it was found; Ok(None) when the tree has none. Read from the TREE, never the working copy: the bytes hashed into every fingerprint and the bytes parsed here are then the same object. Presence comes from a listing that must itself succeed, never from a cat-file -e probe, which cannot tell an absent file from a git that failed: “absent” opens the canonical route, and “cannot tell” must not.

check_coverage

Do the required gates declare, completely, everything tree tracks?

conf_says_plan_exempt_off

Does this amont.conf say set planExempt off? One tolerant reading, shared with amont and verify.sh: strip CR, trim blanks, split on blanks, and compare the three words set, planExempt and off ASCII case-insensitively. A line that is not exactly those three words (a trailing comment, another value) does not match; any match anywhere is off.

coverage

The pure half of check_coverage: coverage of files by each required gate of spec, with the fingerprint question answered by can_fingerprint.

implicit_inputs

The paths every fingerprint lists besides the gate’s own: both spec locations (so adding, removing or editing either invalidates), .gitmodules, and .gitattributes at the root and at every ancestor directory of every token — they change the bytes a checkout yields without changing any listed blob. Deduplicated; order does not affect the value.

is_plan_exempt_directive

Is this spec line the opt-out directive? Blanks around and between the two words are tolerated, nothing else.

parse_spec

The spec grammar, byte-strict. Every violation is a distinct reason, and any violation invalidates the WHOLE spec: a line that silently dropped out would be one the author believes is protecting something.

plan_exempt

Is the canonical route switched off for tree? Read from the committed bytes, never through a tool’s trust-gated settings: off only narrows, so it is honoured whoever wrote it. The directive is found in either spec location even when the spec is otherwise invalid, for the same reason.