Module host_coverage 

Host coverage — what the context gateway can actually see and stop per host.

One source for doctor, the generated coverage matrix and the gateway status line. It never claims more than the integration delivers:

• Enforced: the host’s model traffic flows through the lean-ctx proxy, so egress admission checks every byte before it leaves the device. If the proxy is down the request fails — fail-closed by construction.
• Observed: a hook sees every tool call but cannot stop or change it.
• Partial: lean-ctx admits its own tools and rewrites shell commands, but host-native file tools still reach the model unchecked. Rewrite hooks fail open on purpose (compression is best effort).
• NotObservable: MCP only — ctx_* calls are admitted, nothing else is visible to lean-ctx.
• Unsupported: no integration exists.

Structs

HostCoverage

Coverage of one host as currently configured on this machine.

Enums

CoverageLevel

ToolIntegration

What a host’s own tooling lets lean-ctx do at the tool layer.

Constants

HOSTS

Every host lean-ctx setup registers (the editor registry’s agent keys). Kept static so classification never spawns detection subprocesses; a test pins it to the registry so a new host cannot go unclassified.

Functions

achievable

The best level each integration can reach when fully configured — the published matrix. Observed is never claimed: no installed integration delivers an all-calls observer without also routing or rewriting.

classify

Classify a host from its static integration, the hook mode actually installed (if any) and whether its model traffic is routed through the proxy.

egress_routable

matrix_markdown

The published coverage matrix (docs/reference/generated/host-coverage.md).

tool_integration