Module scanner_failure_code 

Which engine failure code each candidate and scanner failure carries. What: Which engine failure code each failure of the candidate and scanner layers carries. Why: An engine failure names its cause. content-unavailable means candidate bytes or a repository fact could not be read; policy-incomplete means the policy’s own machinery failed. Deciding the code here, beside the failures, makes every policy that reads candidates or scans them report the same code for the same cause.

In TS you’d write (pseudocode):

// const code = scanRunFailureCode(error); // 'content-unavailable' | 'policy-incomplete'

Functions

candidate_failure_code

What: The code of one candidate-layer failure. match lists every cause by name and has no catch-all arm; A | B in an arm means “either of these”. Why: Every cause but one is something Git could not list or hand over, or a private index a prediction needed could not be prepared, so the content was unavailable. A stale candidate is different: its content can be read through a fresh version, and what failed is the calling pass, which kept a candidate across an invalidation. Without a catch-all arm, a cause added later does not compile until someone chooses its code.

finding_failure_code

What: The code of a finding that is not a violation, or nothing for a violation. Option<EngineFailureCode> is “a code or nothing”; { .. } ignores a variant’s fields. Why: The scanner reports two things among its findings that are not matches: a matcher that failed, and a pathname with a line break that it could not inspect. Neither says the candidate is clean and neither names a rule, so each must end the pass as an engine failure instead of being printed as a rule violation. Both arrive after the candidate was read, so the cause is the policy’s machinery.

scan_run_failure_code

What: The code of a failed scan pass. &ScanRunError borrows the failure read-only. Why: A pass fails in the candidate layer or in the adapter, and each already has its code; the pass reports the code of the failure it wraps.

scanner_failure_code

What: The code of one adapter failure. Why: Rules that cannot be loaded, and a pathname that was read but cannot be handed to the scanner on this platform, are both failures of the policy’s machinery; no repository content was unreadable. The match names both causes so a cause added later does not compile until someone chooses its code.