Module taint 

Taint gate checking for tool execution.

Implements the gate check logic that runs before outbound tool calls. When taint tracking is enabled, the gate compares the context window’s overall taint level against the tool’s clearance level.

Structs

TaintGate

Taint gate - checks whether a tool invocation is allowed given the current taint state of the context window. Attached per-agent (as an ECS component) when the agent’s blueprint opts into taint tracking.

Enums

GateResolution

The user’s resolution of a blocked outbound tool call.

Traits

GatePrompt

Injected resolver used when the gate blocks an outbound tool call.

Type Aliases

ScriptRuleChecker

Type alias for a scripted rule checker function. Takes (tool_name, target, taint_level) and returns Some(script_name) if the rule allows. Send + Sync so a boxed checker can live in a shared-world resource.