Module render 

The render pipeline: a declared gateway tree to the bytes the gateway holds on disk.

Stages, in order (later plans insert at the named stage; each stage is a private function below):

1. collect the source tree (super::tree::SourceTree) - done by the caller and handed in as RenderInput::source
2. overlay modes/<env>/ onto the base: a file replaces the base file at the same path whole, or is added (SF-7: there is no removal). Only the selected environment is applied.
3. map repo paths to collection paths: resources/... drops its prefix, tags/<P>/<type>/<rest> becomes ignition/<type>/<P>/<rest> (CD5); two sources on one collection path are refused
4. policy: the manifest type allowlist and its D-02 refusal, the deny list, gateway-owned files, dot-names, undeclared tag providers and tag types under resources/ (21-06)
5. JSON classification, the Gson gate (21-05): node::classify on every .json member; findings name the source path; parsed nodes are kept
6. uuid (21-07): the rule-table checks of stage 4 (enforce_rules), then per Named resource keep, inject or synthesize attributes.uuid
7. lints (21-08): secrets (Embedded, plaintext at schema paths, plaintext by key name) over the parsed nodes, then the tree lints; one final raise
8. finish: build the RenderedTree, resources and the digest

Pure: no filesystem, no network, no clock, no randomness. Ordered collections only, so equal inputs give equal outputs on every OS.

Structs

RenderInput

Everything render needs.

RenderOutcome

What render produced.

RenderedResource

One rendered resource.

Functions

render

Render input. Every policy defect is collected and raised once as a deploy_tree_invalid.