Crate hornguard 

A default-deny firewall for untrusted Prolog.

Hornguard judges a goal, clause, or clause set before a Prolog engine runs it: admitted, admitted subject to something the host must supply, or refused with a reason and a classification. The default is deny, every rule is an allow rule, and a set of capability classes is pinned shut that no profile can reopen.

This crate is a client. The judgment happens in a separate SWI-Prolog process, the judge worker, so the judge runs where an author’s code cannot reach it. The crate spawns that process, speaks its line protocol, and gives you a Verdict.

use hornguard::{Hornguard, Verdict};

let mut hg = Hornguard::builder()
    .profiles(["iso", "prologue"])
    .spawn()?;

match hg.judge_goal("findall(X, member(X, [a, b]), L)")? {
    Verdict::Admit { canonical } | Verdict::AdmitWith { canonical } => {
        // Hand `canonical` to the engine, never the author's text.
        println!("ok: {canonical}");
    }
    Verdict::AdmitNeeds { needs, .. } => println!("needs {needs:?}"),
    Verdict::Refused { class, rule, .. } => println!("refused: {class} ({rule})"),
}

What this crate does not do

It judges. It never executes Prolog, and it deliberately offers no way to. Running an admitted goal is the host’s job, under the host’s engine, with the host’s caps and isolation. Hornguard’s judgment is one layer of a safe Prolog host, and the cheapest; see the repository’s architecture notes for the rest.

Requirements

SWI-Prolog 9.2 or later on PATH, and the Hornguard pack. The crate finds the pack by, in order: the path given to Builder::home, the HORNGUARD_HOME environment variable, and then asking swipl where the installed pack lives.

Concurrency

A worker is sequential, so judging takes &mut self. A host wanting parallelism spawns several Hornguard values; they share nothing.

Structs

Builder

Configuration for a judge worker.

Hornguard

A running judge worker.

Enums

Class

Why a term was refused. Classification is metadata on a decision already made: it never changes the verdict.

Error

Need

Something the host must supply before an otherwise admissible term runs.

Verdict

The judge’s answer for one goal, clause, or program.

Constants

PROTOCOL_VERSION

The protocol version this crate speaks. The worker announces its own in the handshake and a mismatch is Error::Protocol rather than a confusing failure later.

Type Aliases

Result