Module policy_registry 

The fixed registry of shipped policies. What: The fixed registry of policies compiled into the native wrapper. Why: Repository JSONC can only tune shipped policies; it can never name code to run.

In TS you’d write (pseudocode):

// const POLICY_REGISTRY = [{ name: 'require-root', defaultSeverity: 'error', ... }] as const;

Structs

PolicyDescriptor

What: struct PolicyDescriptor is one registry row. &'static str is a borrowed string baked into the executable for its whole run ('static is that “lives forever” lifetime). Sibling: String, an owned copy. bool is true/false, exactly TS boolean. Why: Registry text is compiled in and never changes, so borrowing forever is free, while String would allocate at startup for no gain.

Enums

PolicyId

What: One variant per shipped policy; the variant is the policy’s identity in Rust. Why: Typed identities let options and settings be looked up without string comparison.

Severity

What: enum Severity is a closed set of three named values. #[derive(...)] asks the compiler to generate copying, printing and ==. Why: A closed set makes an unhandled severity a compile error, unlike a free string.

Constants

POLICY_REGISTRY

What: pub const POLICY_REGISTRY: &[PolicyDescriptor] is a compiled-in, read-only list. &[T] is a borrowed view of an array; siblings are Vec<T> (owned, growable) and [T; N] (fixed length in the type). Why: Execution and configuration order must be identical on every run; a borrowed constant needs no allocation and cannot be reordered at runtime. Every default is the incumbent policy definition’s own defaultSeverity. The four formerly plugin-provided policies are additionally off unless the repository configuration names them, because the incumbent only ran them in repositories whose configuration registered their plugin.

Functions

policy_by_name

What: Find a registry row by its configuration key. Option<T> is Rust’s “value or nothing”: Some(row) or None. &'static PolicyDescriptor borrows a row that lives as long as the program. Why: An unknown policy ID must be reported, never treated as a new policy.

policy_descriptor

What: Find the registry row for a typed identity. Why: Callers holding a PolicyId need its name, default and warn-safety.

severity_from_name

What: Translate a configuration word into a typed severity. Why: Only the three documented spellings are settings; anything else is an error the caller reports with the offending key.

severity_name

What: Translate a typed severity back to its configuration and JSONL spelling. Why: Events and diagnostics print the same words the configuration accepts.