Module policy

Expand description

The policy classifier: every tool call is allowed, needs approval, or is denied — decided by code, before the call.

It decides which calls run; what an allowed command can reach is the OS sandbox’s job (crate::sandbox).

Structs§

Class: The kind of object a decision covers.
Decision: What the engine does with a call.
Object: What a person’s decision covers: exactly one resolved object — never the request’s spelling and never a pattern (constitution V). A path is the canonical file a write reaches; a command is its exact argv with the directory it runs in and the executable it resolves to; an MCP tool is its name with the digest of its definition.

AUTOPILOT_DENIED: Why an autopilot run refused a call that would have asked a person.
MCP_PREFIX: The prefix of an MCP tool’s name as the model sees it (crate::mcp).
NOT_ALLOWED: Why a command no rule allows needs a person.
NOT_FOUND: What an executable that cannot be found is recorded as.

argv_of: The argv a run_command call asks for (strings only).
argv_sha256: Hex SHA-256 over argv as a JSON array.
prefix_matches: Whether argv starts with prefix, a prefix of at least two elements (a bare program allows any argument, so it is never a prefix).
prefix_refusal: Why a prefix entry is refused, if it is: a bare program allows any argument.
unasked: A call that stopped for a person nobody could ask then, in a person’s words: the call (a command’s argv as typed), why, and how to let it run — for a command no rule allows, its exact [commands] allow entry; decide says how else (e.g. approve it: `speccoder task approve T001` ).