Struct Report 

pub struct Report {

    pub setup: Vec<SetupGap>,
    pub has_key: bool,
    pub encrypted: Vec<Vec<u8>>,
    pub in_the_clear: Vec<Vec<u8>>,
    pub leaked: Vec<Exposure>,
    pub by_choice: Vec<Vec<u8>>,
    pub fixed: Vec<Vec<u8>>,
    pub undetermined: Vec<String>,
    pub scanned: Scanned,
    pub scan_ran: bool,
    pub fix_requested: bool,
    pub notes: Vec<String>,
    pub warnings: Vec<String>,
}

What status found.

Four sections, deliberately separate, because the remedies are four different things and a single list would hide which one applies.

Fields

setup: Vec<SetupGap>

Reasons git is not filtering here. Any of these means the guarantee is off.

has_key: bool

Whether a repository key is present at all.

encrypted: Vec<Vec<u8>>

Declared paths the index already stores as ciphertext. The good case.

in_the_clear: Vec<Vec<u8>>

Declared paths the index stores in the clear — what a commit made now would push. This is the set --fix repairs.

leaked: Vec<Exposure>

Declared paths that reachable history holds in the clear.

Nothing local repairs this. The report says so in as many words.

by_choice: Vec<Vec<u8>>

Paths a negation deliberately keeps in the clear.

Listed rather than left out: a hole a user wrote on purpose must not be invisible, or the declaration reads as covering more than it does.

fixed: Vec<Vec<u8>>

Paths --fix re-staged through the filter.

Named separately from Report::encrypted so the sentence that follows them — that this changes the next commit and nothing about the past — has something to attach to.

undetermined: Vec<String>

Things this build could not determine, and why.

These fail the gate. “I could not tell” reported as a pass is the one answer a command like this must never give.

scanned: Scanned

How much history was walked, for the closing line.

scan_ran: bool

Whether the history scan ran at all.

Without it the closing line printed “scanned 0 commit(s)” for a run that returned before the scan, which reads as “I looked and there was nothing” in a repository with five hundred commits.

fix_requested: bool

Whether --fix was asked for.

The advice under “in the clear” tells a user to run --fix; printing that in the output of --fix itself points at the command that has just declined, and says nothing about the attempt.

notes: Vec<String>

Notes that describe a lesser problem and never change the exit code.

warnings: Vec<String>

Anything worth saying once, carried out so the binary owns the messages.

Implementations

impl Report

pub fn verdict(&self) -> Verdict

What this run concluded.

Configuration, then a finding, then a question. The owner’s reason for putting configuration first, 2026-08-05: without a working configuration the data in the repository is worth nothing — a checkout where git is not running the filter cannot be judged clean, cannot be trusted about what it stores next, and above all cannot be repaired by acting on anything this report says about its data. So the operator is sent to the one repair that makes the rest meaningful, and asks again afterwards.

It is a reversal in exactly one place. Until 2026-08-05 a setup gap was Verdict::Exposed, which handed 5 — “an exposure was found, rotate the secret” — to a repository that had never run init and had nothing in it to rotate, while the one thing genuinely wrong with it read as a detail. 2 is the frozen table’s “configuration or a state conflict”, used here exactly as init and lock already use it.

Everything else stands: a finding still outranks an unanswered question, so a run that hit an unreadable index and found a leak has found a leak. And no verdict withholds a section — a misconfigured repository that also leaked prints the leak, the paths and the rotate-first procedure exactly as it did before, because the code changes the order of the work and not what the reader is told.

pub fn exposed(&self) -> bool

Whether this run found plain text where ciphertext was expected.

Read off the findings rather than off Report::verdict, and that is deliberate: since 2026-08-05 a setup gap outranks a finding, so a repository that both leaked and is misconfigured answers Verdict::Misconfigured while its leak is every bit as real. Deriving this from the verdict would make it say no.

Trait Implementations

impl Debug for Report

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Report

fn default() -> Report

Returns the “default value” for a type.

impl Display for Report

Renders the whole report, sections and remedies included.

A Display rather than a pile of eprintln! in the binary: the wording here is part of the safeguard — a user must never read “fixed” as “the secret is safe” — so it has to be assertable from a test.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.