Struct ProvenSafeIngest 

pub struct ProvenSafeIngest {
    pub accepted: bool,
    pub refusal: Option<String>,
    pub scry_version: String,
    pub declared_module_sha256: String,
    pub actual_module_sha256: String,
    pub declared_memory_min_bytes: u64,
    pub offered: Vec<SafeSite>,
    pub diagnostics: Vec<String>,
}

The result of ingesting a safe-accesses.json. TOTAL by design — there is deliberately no Result in ingest’s return type, mirroring crate::wsc_facts::parse_wsc_facts: no input may turn a successful compile into a failed one.

When ProvenSafeIngest::accepted is false, ProvenSafeIngest::offered is EMPTY — a refused document is not trusted piecemeal — and ProvenSafeIngest::refusal names why.

Fields

accepted: bool

Did the document clear every whole-file gate (schema, hash, memory floor)? False ⇒ elide nothing.

refusal: Option<String>

Some(reason) exactly when accepted is false.

scry_version: String

The producer version string, for the attestation. Empty if absent or the document was unreadable.

declared_module_sha256: String

The module_sha256 the document declared (hex, as written). Empty when the document did not parse.

actual_module_sha256: String

The sha256 synth computed over the module it is actually compiling.

declared_memory_min_bytes: u64

The memory_min_bytes the document declared.

offered: Vec<SafeSite>

Sites the document offered, once the whole-file gates passed. These are candidates: each still faces ProvenSafeIngest::validate_function.

diagnostics: Vec<String>

Human-facing diagnostics (warnings). Never an error.

Implementations

impl ProvenSafeIngest

pub fn offered_for_func(&self, func: u32) -> Vec<&SafeSite>

Sites this document offered for one function, in pc order.

pub fn validate_function( &self, func: u32, ops: &[WasmOp], notes: &mut Vec<String>, ) -> Vec<usize>

The self-checking key. Validate this function’s offered sites against the operator stream synth actually decoded, and return the operator indices that survive — the per-site elision marks.

An entry is DROPPED (with a diagnostic pushed into notes) when:

• pc is out of range for this function’s op count;
• the op at pc is not a linear-memory access;
• the op’s access width differs from the declared width.

Dropping rather than refusing the whole file is deliberate and matches the wsc.facts per-record rule: a newer scry proving an access class synth does not guard must not invalidate the sites it does guard. The safety direction is preserved either way — a dropped entry keeps its guard.

Trait Implementations

impl Clone for ProvenSafeIngest

fn clone(&self) -> ProvenSafeIngest

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProvenSafeIngest

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ProvenSafeIngest

fn default() -> ProvenSafeIngest

Returns the “default value” for a type.

impl Eq for ProvenSafeIngest

impl PartialEq for ProvenSafeIngest

fn eq(&self, other: &ProvenSafeIngest) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for ProvenSafeIngest