Enum NetDecision 

pub enum NetDecision {
    NotRequested,
    Confine,
    GapWarn {
        reason: String,
    },
}

What to do about network confinement for one subprocess spawn. Unlike FsDecision, this never refuses the whole call — network.enabled is an independent, best-effort axis (§build brief item 3): “surface the gap, never claim enforcement you lack”, not a hard fs-style gate. A caller that ALSO has an FsDecision::Refuse for the same call still refuses (that decision wins), but a network-only gap never blocks a call that has no fs confinement problem.

Variants

NotRequested

network.enabled is false (the default) — nothing to do, byte-identical to pre-P5-10 behavior.

Confine

A coarse (no domain granularity) network cut-off is available and requested — apply it for real.

GapWarn

network.enabled is true but this platform/kernel can’t deliver what was asked (domain allow/deny lists — needs the out-of-scope TLS-MITM proxy — or coarse cut-off itself is unavailable). Never silently dropped: surfaced as a one-time warning, the subprocess still runs (network-UNCONFINED, everything else about the call is unaffected).

Fields

reason: String

Human-readable reason, fed to the one-time warning.

Trait Implementations

impl Clone for NetDecision

fn clone(&self) -> NetDecision

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NetDecision

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for NetDecision

impl PartialEq for NetDecision

fn eq(&self, other: &NetDecision) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for NetDecision