Expand description
Preview-time presentation profile for every action the daemon recognises.
The dispatcher calls preview_action before execution to produce a
PreviewEnvelope the shell shows the operator.
§Risk is a single source of truth
risk_level is not declared here — it is owned by each action’s
ActionSpec (crate::actions) and derived via crate::actions::spec_meta,
so the approval gate can never disagree with the documented risk in
docs/action-reference.md. This module supplies the preview-specific fields:
expected side effects, warnings, and the reboot/rollback display flags.
(reboot_required / rollback_available are still declared here pending a
separate consolidation onto the spec — see the follow-up note in
tests/action_consistency.rs.)
§Invariant: spec ↔ preview ↔ policy consistency
policy::min_role_for_action mirrors the spec risk via
policy::role_for_risk_level, except a documented, monotonic exception
list (an exception may only raise the role above the risk floor, never lower
it). The cross-module tests in tests/action_consistency.rs pin
preview.risk == spec.risk and role == role_for_risk_level(risk) (± the
exception list) for every action, so these tables cannot silently drift.