Module preview 

Preview-time presentation profile for every action the daemon recognises.

The dispatcher calls preview_action before execution to produce a PreviewEnvelope the shell shows the operator.

Risk, reboot, and rollback are a single source of truth

Risk, reboot_required, and rollback_available are not declared here — they are owned by each action’s ActionSpec (crate::actions) and derived via crate::actions::spec_meta / gate_risk, so the approval gate and the displayed reboot/rollback flags can never disagree with the catalogue in docs/action-reference.md. This module supplies only the preview-specific presentation: expected side effects and warnings. Every catalogued action must have a profile arm below; tests/action_consistency.rs fails the build if one falls through to the _ “unclassified” default.

Invariant: spec ↔ preview ↔ policy consistency

policy::min_role_for_action mirrors the spec risk via policy::role_for_risk_level, except a documented, monotonic exception list (an exception may only raise the role above the risk floor, never lower it). The cross-module tests in tests/action_consistency.rs pin preview.risk == spec.risk and role == role_for_risk_level(risk) (± the exception list) for every action, so these tables cannot silently drift.

Functions

gate_risk

The approval-gate risk for action_name: the risk declared on its ActionSpec (the single source of truth), or a conservative fallback for the rare action with no spec. This is the one function every risk-gated decision derives from — the preview envelope above and the CLI’s auto-approval gate (sysknife-cli) both call it, so neither can size its friction off a stale or model-guessed risk.

preview_action