Struct ExecGuard 

pub struct ExecGuard<'a> { /* private fields */ }

What the verification layer is allowed to spawn, and where to record it.

Verification cannot prompt — there is no approver on this path — so a command is spawned only when the policy explicitly allows it. Anything else, including Effect::Ask, is refused.

A run builds one of these for you. Build it yourself to check a criterion outside a run — a CI step re-verifying what an agent produced, say — under the boundary the agent itself worked under:

use io_harness::{ExecGuard, Policy, Verification, TEST_BINARY};

// Compile-only: `rustc` may run, the produced test binary may not. The gate
// type-checks the criterion against the code and never executes it, which is
// what you want when the code came from a model and this host is not a sandbox
// you are willing to lose.
let policy = Policy::permissive()
    .layer("verify")
    .allow_exec("rustc")
    .deny_exec(TEST_BINARY);

let criterion = Verification::RustTestPasses {
    test_src: "#[test] fn it_answers() { assert_eq!(hello(), 42); }".into(),
};
// An allow the policy does not give is `Error::Refused`, not a silent skip —
// a verification that was refused is not one that ran and failed.
let outcome = criterion
    .passes_guarded(
        "src/hello.rs".as_ref(),
        "pub fn hello() -> u32 { 42 }",
        &ExecGuard::new(&policy),
    )
    .await;
assert!(matches!(outcome, Err(io_harness::Error::Refused { .. })));

ExecGuard::tracing additionally writes every spawn’s full argv against a run id, and ExecGuard::no_sandbox opts back to direct host execution — the sandbox is the default.

Implementations

impl<'a> ExecGuard<'a>

pub fn new(policy: &'a Policy) -> Self

Guard spawns with policy, recording nothing. Sandboxed by default.

pub fn tracing(self, store: &'a Store, run_id: i64, step: u32) -> Self

Also record every spawn’s full argv against run_id at step, so argument-level enforcement can be added later against a real baseline.

pub fn sandboxed(self, config: SandboxConfig) -> Self

Run the compile inside config’s sandbox instead of the default one.

pub fn no_sandbox(self) -> Self

Opt out of the sandbox: run the compile directly on the host, exactly as 0.5.0 did. Additive and reversible — the sandbox is the default, not a forced change.