Struct ProfileContract 

pub struct ProfileContract {
    pub profile: String,
    pub prefixes: Vec<String>,
    pub expected_count: usize,
    pub registered_count: usize,
    pub dead_prefixes: Vec<String>,
    pub unexpected_tools: Vec<String>,
    pub destructive_tools: Vec<String>,
    pub verified_at: String,
    pub binary_version: Option<String>,
    pub surface_hash: Option<String>,
    pub ok: bool,
}

The profile contract — proof that the advertised surface is the declared surface.

Computed at server startup from the pre-filter (“full”) registry and the post-filter (registered) registry. ok == false means surface drift: the boundary is advertising or routing something the declared profile does not cover, or declares prefixes that match nothing (the dead-route class the curated galaxy.list regression came from). Persisted as profile_contract.json in the store root so wm doctor can grade the last server start against it.

Fields

profile: String

Declared profile name (full, curated, minimal, allowlist).

prefixes: Vec<String>

Declared prefixes (["*"] for full).

expected_count: usize

Tools the declared profile should register.

registered_count: usize

Tools actually registered post-filter.

dead_prefixes: Vec<String>

Declared prefixes matching zero tools (dead routes).

unexpected_tools: Vec<String>

Registered tools the declared profile does not cover (drift).

destructive_tools: Vec<String>

Destructive tools on the registered surface. Informational — destructive effects are confirm-gated in the dispatch pipeline; curated deliberately includes memory.delete and friends.

verified_at: String

RFC 3339 timestamp of the check (wm_core::time).

binary_version: Option<String>

Package version of the binary that computed the contract. None = pre-P-PROV-5 contract (serde default keeps them readable).

surface_hash: Option<String>

Surface pin (P-PROV-5, 2026-09-10, rug-pull tripwire): hex SHA-256 over the sorted registered tool names (see surface_hash). Any tool added, removed, or renamed changes the pin; wm doctor discloses it so a reviewed release surface can be pinned externally. None = pre-P-PROV-5 contract.

ok: bool

true iff the registered surface is exactly the declared one.

Trait Implementations

impl Clone for ProfileContract

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProfileContract

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ProfileContract

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for ProfileContract

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.