Struct AgentFacts 

pub struct AgentFacts {
    pub name: String,
    pub role: String,
    pub exec: ExecFacts,
    pub writes: Vec<PathBuf>,
    pub net: NetworkOutboundMode,
    pub skills: Vec<String>,
    pub model_ref: String,
    pub effort: Option<Effort>,
    pub running: bool,
    pub drift: bool,
}

One agent, as the kernel and the profile describe it.

Fields

name: String

role: String

profile.role, falling back to a non-boilerplate persona.description. Empty means nobody has said what this agent is for.

exec: ExecFacts

writes: Vec<PathBuf>

net: NetworkOutboundMode

skills: Vec<String>

model_ref: String

effort: Option<Effort>

Per-turn effort from the profile. None means unset — which is the API default (high), not “no effort”; mur agent who says so explicitly because the difference is the whole point.

running: bool

drift: bool

profile.yaml (or sys_prompt.md) was edited after the running process started, so the live agent is NOT what this index describes. See [started_after_edits].

Implementations

impl AgentFacts

pub fn can_exec(&self, bin: &str) -> bool

Does this agent explicitly hold bin?

bin may be a bare name (cargo) or the absolute path the kernel refused (/Users/d/.cargo/bin/cargo) — a denial always reports the latter, so both sides are compared by file name. An allowlist entry may itself be absolute, which is why the normalisation is symmetric.

Deliberately CONSERVATIVE: under Allowlist mode the sandbox also re-allows the system exec paths (/usr/bin, /bin, …), so an agent can in fact run /usr/bin/git without naming it. Resolving that would mean replicating the runtime’s PATH augmentation and Seatbelt’s system-path exemption down here, and it would answer the wrong question anyway: a binary that resolves to a system path is one nobody needed to delegate. Under-reporting routes work to an agent that provably holds the binary; over-reporting would route it to one that dies with the same EPERM.

pub fn can_write(&self, path: &Path) -> bool

Can it write anywhere at or under path?

pub fn privilege_breadth(&self) -> u32

How much privilege this agent carries, for least-privilege dispatch (P4): among the agents that CAN do the job, prefer the one carrying the least unrelated power. Without this the ranking silently prefers the most capable agent — which is the one that undoes every containment decision made elsewhere.

A heuristic, and openly so: writable roots dominate (they are what an escaped task can damage), then egress (what it can exfiltrate to), then breadth of exec.

Trait Implementations

impl Clone for AgentFacts

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AgentFacts

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.