Module read_path_report 

Whether the user’s config actually grants what a blueprint’s [read_paths] declares, entry by entry.

Declaring is not granting (see leviath_core::read_paths), and for a long time nothing said so out loud: an agent that asked to read outside its workdir validated, listed, and spawned exactly like one that did not, then failed at its first read on any machine whose config.toml was missing the grant. This module is the one place that answers “is this declaration live here”, so lev validate, lev list, lev run, lev add, and lev ps all answer it the same way.

The check is deliberately pattern-level: each declared entry is compiled, reduced to one representative path (leviath_core::ReadPathEntry::sample_path), and offered to the compiled grant set with leviath_core::ReadPathSet::matches_lexically. Nothing touches the filesystem, so a grant naming a directory that does not exist yet still reads as a grant. The trade is that a report is not a promise: the runtime matches real, symlink-resolved paths, so an individual read can still be refused.

Structs

EntryStatus

One declared entry and its verdict.

GrantReport

Every [read_paths] entry a blueprint declares, with its grant verdict.

Enums

GrantStatus

Whether one declared entry is live under the current config.

Functions

build

Build the report for blueprint under config.