Struct Grant 

pub struct Grant {
    pub filesystem: Level,
    pub network: Level,
    pub exec: Level,
}

A capability grant: one Level per Dimension. This is the trust manifest’s core payload. As a product of totally-ordered dimensions it forms a lattice under componentwise ordering, with Grant::bottom (deny everything) and Grant::top (the most dangerous config — sudo + open internet, design doc §3) as the extremes.

Fields

filesystem: Level

network: Level

exec: Level

Implementations

impl Grant

pub fn new(filesystem: Level, network: Level, exec: Level) -> Self

pub fn bottom() -> Self

Deny everything — the lattice bottom. The default starting point for the narrowest-possible grant (design doc §5.1): every ungranted effect is physically absent.

pub fn top() -> Self

Grant everything — the lattice top. sudo + open internet; the single most dangerous config. Never the default.

pub fn level(&self, dim: Dimension) -> Level

pub fn leq(&self, other: &Grant) -> bool

self ≤ other: self grants no more authority than other on any dimension. This is the subtyping relation over the trust lattice — a narrower grant is a subtype of a wider one.

pub fn join(&self, other: &Grant) -> Grant

Componentwise join (least upper bound).

pub fn meet(&self, other: &Grant) -> Grant

Componentwise meet (greatest lower bound).

pub fn narrow(parent: &Grant, child: &Grant) -> Result<Grant, TrustError>

Narrowing-as-subtyping (design doc §7.1, “the narrowing invariant becomes a type property”). A child manifest is only well-formed if it narrows its parent on every dimension; any widening is rejected here — the inheritance equivalent of a type error. On success returns the (validated) child grant.

pub fn permits_effect(&self, effect: &EffectKind) -> bool

Does this grant permit a single effect? Effects are mapped to a dimension and the minimum level they require via effect_requirement; effects outside the trust vocabulary (pure compute, logging, time, rng) are always permitted.

pub fn permits_effects(&self, effects: &EffectSet) -> Result<(), TrustError>

Check every concrete effect in a set against the grant. This is the bridge that makes “code calling a net effect won’t type-check under a network: none grant” true (design doc §7). Returns the first offending effect as a TrustError.

pub fn permits_effects_with_allowlist( &self, effects: &EffectSet, allowlist: &[String], ) -> Result<(), TrustError>

Like Self::permits_effects but resolves network egress against an explicit host allowlist (the lex-os manifest’s egress rules — design doc demo grant network: none EXCEPT results.demo.internal). The allowlist is authoritative for network: a host-scoped net("h") effect is permitted iff the grant’s network is Full, or h matches an allowlist entry — regardless of the coarse network level, so an allowlist can carve exceptions into an otherwise-none network. An unscoped [net] is permitted only under Full (it cannot be proven to stay within the allowlist). Non-network effects use the same level check as Self::permits_effects.

pub fn pretty(&self) -> String

Canonical one-line rendering, e.g. fs=read-only net=none exec=none.

pub fn content_id(&self) -> GrantId

Content-addressed identity of the grant. The bytes hashed are a stable canonical form (dimension order is fixed, ranks not enum names), so a GrantId is reproducible across processes and languages — the manifest stays hashable exactly as AgentSpec required (design doc §7.4). Two grants with the same authority hash identically even if spelled with different aliases (Sandboxed vs ReadOnly).

Trait Implementations

impl Clone for Grant

fn clone(&self) -> Grant

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Grant

impl Debug for Grant

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Grant

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for Grant

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Grant

impl PartialEq for Grant

fn eq(&self, other: &Grant) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Grant

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Grant