Module bundle_loader 

The single shared, fail-closed bundle loader (load + WorkbookBundle + BundleLoadError) — the ONLY parse+integrity-verify path for any BundleSource (WBSV-08). The single shared, fail-closed [load] bundle verifier (Phase 92, Plan 01 — WBSV-08, threats T-92-01/02/04/22).

Every crate::bundle_source::BundleSource (local-dir or embedded) is parsed and integrity-checked HERE and ONLY here, so no source impl can skip the gate (the trait returns raw bytes only — threat T-92-03). [load]:

1. enforces a FAIL-CLOSED membership allow-set — any unexpected/extra member is rejected with BundleLoadError::UnexpectedMember BEFORE parsing (frozen-bundle contract, threat T-92-22);
2. recomputes the evidence-dir hash (path+length-prefixed, SORTED) via the runtime’s own shared crate::artifact_model::fold_evidence_hash;
3. recomputes the per-artifact + combined BUNDLE.lock hashes via the runtime’s own crate::artifact_model::build_bundle_lock (it does NOT re-implement hashing), and fails closed on any mismatch (BundleLoadError::IntegrityMismatch, threat T-92-01);
4. cross-checks the lock’s identity/provenance triple against independently-hash-covered members (BundleLoadError::StampMismatch, threat T-92-02);
5. parses every member total + panic-free (BundleLoadError::Parse, threat T-92-04) and builds the per-cell DAG ONCE.

It returns a fully-verified WorkbookBundle.

Structs

WorkbookBundle

The fully-parsed, integrity-verified bundle the served tools operate on.

Enums

BundleLoadError

Errors load surfaces — every one is fail-closed (the bundle is rejected, the server never boots on a tampered/malformed bundle).

Constants

ALLOWED_MEMBERS

The FROZEN member allow-set (threat T-92-22): the bundle MUST contain exactly these members — any member outside this set fails closed BEFORE parsing.

EVIDENCE_FOLD_MEMBERS

The members folded into the evidence-dir hash — the evidence members PLUS cell_map.json + layout.json, matching the emitter’s fold (Pitfall 2: the generator and loader MUST fold the identical set). Declared in SORTED relative-path order (asserted by test) so the fold iterates it directly.

MEMBER_CELL_MAP

The bundle member holding the I/O cell map.

MEMBER_CHANGELOG

The bundle member holding the recorded version changelog.

MEMBER_IR

The bundle member holding the executable IR (a HashMap<String, Cell>).

MEMBER_LAYOUT

The bundle member holding the captured layout descriptor.

MEMBER_LOCK

The bundle member holding the integrity lock.

MEMBER_MANIFEST

The bundle member holding the logical manifest.

MEMBER_PARSER_EQUIV

The bundle member holding the parser-equivalence evidence record.

Functions

load

Load + fail-closed integrity-verify a bundle from any BundleSource.