Module enforcement 

Commitment-enforcement layer - the A_t^valid gate.

This is the layer that lets the reference implementation claim all three roles. It implements the full execution chain behind operation selection:

1. every action attempt is carried as an attributed event (actor, action, content, time, scope, provenance);
2. the engine selects the active commitments K_t from the history H_t (expiry-aware, so expired commitments leave K_t and are not enforced);
3. before an action may run, the violates() check is consulted unconditionally by the gate;
4. a violation can only proceed along the documented justifiedOverride() path (authorized overrider + a recorded justification);
5. a non-permitted action is blocked, never merely warned;
6. every check, decision and override is appended to the audit chain (SHA-256 hash-chained so tampering is detectable);
7. positive and negative tests cover every required scenario.

The runnable set is restricted to

  A_t^valid = { a in A_t | attribution_valid(a) AND
                           (not violates(a, K_t) OR
                           justifiedOverride(a, K_t, H_t)) }

A standalone checker that nothing calls would be an incomplete implementation; that is why crate::planning::Planner::execute_step routes every candidate action through this gate before it can be advanced. The audit chain, the expiry model and the persistence files mirror the binary, zero-JSON core.

Structs

ActionEvent

A single attributed action attempt.

AuditChunk

A single link in the audit chain. hash = sha256(prev_hash || record).

Commitment

A commitment (an element of the history H_t). When active it forms part of the active set K_t.

EnforcementEngine

The enforcement engine. Owns the commitment history H_t (and thus the active subset K_t), the override policy, and the in-memory audit chain.

EngineState

Reference-implementation state kept between calls (commitments + policy).

Violation

One concrete violation of an active commitment.

Enums

Decision

Per-action decision returned by the gate.

EnforcementError

Error surfaced by the gate when it actually blocks execution.

Outcome

Outcome persisted into the audit chain.

Constants

DEFAULT_AUTHORIZED_OVERRIDER

Default built-in overrider authority for new engines.

MIN_JUSTIFICATION_LEN

Minimum length a documented justification must have to be accepted.

Functions

load_audit

Read the audit chain from a binary file.

load_engine

Load the engine’s commitment state. A missing file yields a fresh engine.

load_engine_strict

Fail-closed loader for a guard. Returns an Err if the state or the audit cannot be loaded cleanly or the chain is invalid. A caller that turns this error into “do not run the guarded operation” gives a genuinely fail-closed boundary: corruption means denial, never a silent default.

save_audit

Rewrite the audit chain to a binary file (magic EAU1).

save_engine

Persist the engine’s commitments + policy to a bincode file.