Module rules 

Fixed render policy: which resource types and files a declared tree may never ship, however the manifest allowlist reads (Phase 21, DRND-04).

Structs

SecretFields

The secret-typed config fields of one resource type, from the 8.3.6 OpenAPI (tests/fixtures/deploy/openapi-8.3.6-resource-types.json, secret_fields; Phase 21, plan 21-01). Each path is dotted from the root of the type’s config.json.

TypeRule

The render rule for one resource type.

Enums

UuidRule

How a resource type carries its identity (attributes.uuid) and where its files sit. The three classes come from the corpus census (RESEARCH Pattern 4) and the 8.3.6 captures (decision CD3).

Constants

DENIED_TYPES

(module, type) pairs that render refuses even when the manifest lists them. Rendering these can lock an administrator out of the gateway (replacing the security level or property singletons, the user sources, or the API tokens that tooling authenticates with), so they stay gateway-owned. Spellings are pinned to the OpenAPI extract by the denied_types_exist_in_openapi_extract test.

GATEWAY_OWNED_FILES

File names (final path component) the gateway writes itself, so a declared tree must not carry them. config-mode.json is written by the gateway’s mode API; shipping one would overwrite the gateway’s mode.

OPENAPI_TYPES

Every (module, type) pair the 8.3.6 OpenAPI describes, sorted by bytes. openapi_types_equal_extract pins it to the extract, so it cannot drift from the evidence. A type outside this list (for example the Cirrus Link MQTT types) has no schema, so secret detection there falls back to the generic Embedded scan and the key-name rule (21-08).

SECRET_FIELDS

The ten resource types whose 8.3.6 schema has secret-typed fields, sorted by (module, type) bytes. secret_fields_agree_with_openapi_extract pins the table to the extract. The email-profile path is settings.settings.password (corrected from RESEARCH Pattern 7 in 21-01; the corpus WH_Classic_SMTP/config.json has the nested layout).

TYPE_RULES

Every resource type render accepts, sorted by (module, type) bytes. A type without a row is refused (fail-closed): only evidence-backed types render.

Functions

is_denied

Whether module/ty is on the deny list.

openapi_describes

Whether the 8.3.6 OpenAPI describes module/ty: the schema is authoritative for its secret-typed fields.

secret_paths

The secret-typed paths of module/ty; empty when the type has none (or is not described by the OpenAPI at all).

type_rule

The rule for module/ty, if the type has evidence.