Module paths 

Mission data layout under the target repo (plan §4):

<repo>/.kranz/
├── config.json                 # project config (merged over ~/.kranz/config.json)
└── missions/<id>/
    ├── plan.json               # approved plan (also committed to mission branch)
    ├── events.jsonl            # append-only event log (single writer)
    ├── events.jsonl.lock       # exclusive engine lock
    ├── state.json              # derived snapshot (cache; rebuildable)
    ├── control/                # inbox: CLI/server -> engine ControlCommand files
    ├── runs/<runId>.jsonl      # full per-run transcripts
    ├── runs/egress-denials.jsonl # fs+net proxy denial records (gitignored runtime)
    └── workspace/              # container-provider compose files (gitignored runtime)

All paths built with std::path so Windows stays first-class (§9).

Structs

MissionPaths

Constants

AUTHORITY_KEY_LEN

Length of a freshly minted authority key.

KRANZ_GITIGNORE_RULES

The canonical .kranz/.gitignore rules the engine materializes on init (orchestrator::write_kranz_gitignore). Single source for the engine’s writer and for ready.rs’s engine-materialized exception: the file ignores ITSELF (first rule), so it can never be a committed artifact — its rules travel with the tool, not the repo.

Functions

authority_key_path

Where this repository’s authority key lives: <global kranz dir>/keys/<repo fingerprint>.key.

control_mark_path

Where a mission’s CONTROL MARK lives: the name of the last control file the engine acknowledged, recorded beside the high-water mark. Control file names are <zero-padded-nanos>-<8-hex>.json, so they order lexicographically by creation time and the mark never moves backwards.

global_config

Global config file path (<global kranz dir>/config.json), None if no home dir.

global_kranz_dir

The operator’s global kranz directory: $KRANZ_HOME when set and non-empty, else ~/.kranz (%USERPROFILE%\.kranz on Windows), None when neither resolves.

high_water_path

Where a mission’s HIGH-WATER MARK lives: the highest seq the engine has durably written, recorded beside the seal floor and, like it, outside the repository.

load_authority_key

Read this repository’s authority key, or None when there is none to read (no home dir, no key minted yet, unreadable file).

load_or_create_authority_key

Read this repository’s authority key, minting it on first use.

open_read_nofollow

Open path for reading with the mission-tree chain pinned (7th-pass review): when the path carries the mission layout (<root>/.kranz/missions/<id>/... or <root>/.kranz/tickets/...), the prefix BEFORE .kranz is taken as the trusted anchor (ambient authority — the same trust basis MissionPaths uses for its repo root), and every component from .kranz down is opened per-component no-follow, the final file with FollowSymlinks::No. No canonicalization of the untrusted region anywhere: the earlier canonicalize-then-walk shape resolved a hostile parent symlink BEFORE the no-follow discipline began.

project_config

Project config file path.

read_control_mark

The recorded control mark, None when none was ever recorded.

read_high_water

The recorded high-water mark, None when none was ever recorded.

read_regular_file_bounded

Bound both the initial size and bytes actually read, including growth after opening. Oversized artifacts fail instead of returning partial text.

read_regular_file_under

Read one regular file beneath an already-pinned directory. The name must be a single component; nested callers must pin each directory separately.

read_seal_floor

The recorded seal floor for one mission, None when none was ever recorded (so every line is grandfathered).

record_control_mark

Record name as the last acknowledged control file. Never lowers.

record_high_water

Record seq as the highest durably written event. Never lowers an existing mark. Written through a tmp file and rename so a crash between the log write and this one leaves the OLD mark, which is at most one event behind and therefore never accuses a healthy log.

record_seal_floor

Record seq as this mission’s seal floor, once. An existing floor is never moved: raising it would grandfather away lines that were sealed, and lowering it would condemn lines that legitimately were not.

seal_floor_path

Where a mission’s SEAL FLOOR lives: the first events.jsonl seq that must carry integrity fields, recorded outside the repository beside the key.