Enum GrantKind 

pub enum GrantKind {
    Command,
    TouchPath,
    WorkerDeny,
    Egress,
}

What a grant would extend on approval. All kinds park through the SAME operator approve/deny gate (and reuse its timeout + per-milestone cap); they differ only in the boundary that triggered them and what the reducer extends. #[default] = Command so pre-kind events (and the wire default) fold as the original command-grant behaviour.

Variants

Command

A validator command outside its allow-set → extend command_grants.

TouchPath

A worker write outside the touch_set → extend touch_set.

WorkerDeny

A worker command blocked by a deny rule (deny-wins) → lift that rule by adding it to deny_exceptions. Unlike the others this SUBTRACTS from a safety guardrail, so it is per-mission, explicit, and logged.

Egress

A sandboxed (fs+net) run whose egress proxy refused a destination → extend egress_grants, so the re-run’s proxy allowlist covers it.

Trait Implementations

impl Clone for GrantKind

fn clone(&self) -> GrantKind

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for GrantKind

impl Debug for GrantKind

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for GrantKind

fn default() -> GrantKind

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for GrantKind

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for GrantKind

impl PartialEq for GrantKind

fn eq(&self, other: &GrantKind) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for GrantKind

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for GrantKind