Skip to main content

Module wrapper

kovra_wrapper

Module wrapper 

Source
Expand description

The Wrapper (spec §5) — kovra run’s engine.

Ties the layers together for a single launch:

  1. Resolve the .env.refs (L4) into concrete values — the resolver does not confirm or gate; that is this module’s job.
  2. Compute the two independent injection gates (KOV-25): the allowlist set (I15 — high or prod, via kovra_core::inject_requires_allowlist) and the confirm set (I3 — high only, via kovra_core::inject_requires_confirmation, orthogonal to environment).
  3. If any var is allowlist-gated, enforce the executor allowlist (I15): the resolved program must be a reviewed, allowlisted executable, else injection is refused before anything launches.
  4. If any var is confirm-gated (high), confirm through the broker (I3) with an authoritative ConfirmRequest whose resolved_command is the exact argv (I16). Denied / timed-out ⇒ refuse; the child never launches. A deliberately-downgraded prod secret is allowlist-gated but not confirm-gated — it injects without a prompt (KOV-25).
  5. Inject the resolved values into the child process environment and launch it. Nothing is written to disk (I7).
  6. Optionally mask injected vault-backed secret values in the child’s output (§5.1 margin defense — a net, never a boundary; plain literals and ${env:} passthrough are not masked).

inject-only is not gated for confirmation: injection is its only delivery, and it is not high. dev/test throwaway (low/medium, non-prod) values inject freely with no allowlist and no prompt (§5.1).

Structs§

Wrapper
The Wrapper bundles the core dependencies (all behind traits, so the whole thing is mock-testable) and the launch policy knobs.