Module security_posture 

Unified, human-facing view of lean-ctx’s two independent security planes:

1. Containment — the path jail + shell-command gating. Protects the machine from the agent (what files a tool may touch, what binaries the shell may run).
2. Secret-exfiltration defense — secret/.env redaction. Protects your secrets from the LLM provider (API keys masked before they reach the model).

These are orthogonal by design: a usability-first user can drop containment (lean-ctx yolo) while still never leaking credentials to the provider, and vice-versa. This module is the single source of truth both the lean-ctx security command and lean-ctx doctor read from, so the CLI status screen and the doctor board can never disagree.

It is a pure read of config + env (no side effects), which keeps it cheap to call and safe to use inside deterministic output paths.

Structs

SecurityPosture

A snapshot of every security-relevant switch, resolved exactly the way the runtime enforces it (env → config → secure default).

Enums

JailState

Effective state of the filesystem path jail.

PostureLevel

Coarse, derived label summarising the whole posture for at-a-glance display.