crates/nornir-guard/Cargo.toml
[package]
name = "nornir-guard"
# 0.1.3: src/guard.rs and src/selftest.rs drifted from the published 0.1.2 under
# the SAME version number. crates.io bytes are immutable, so every consumer that
# resolved 0.1.2 keeps getting source nobody reads any more — the edit has to
# ship as a new version. Caught by `dwarves release_gates` (StaleSourceDrift),
# which is the only thing that looks at published bytes rather than local ones.
version = "0.1.3"
edition = "2021"
description = "AI-agent guard rails — enforces a `[guard].forbidden` path list at the filesystem level (chmod -w) with a tamper-evident sha256 manifest, so a misbehaving agent gets EACCES rather than silently corrupting append-only history. Lifted out of nornir."
license = "MIT OR Apache-2.0"
repository = "https://git.gunnar.rs/nordisk/nornir"
keywords = ["guard", "chmod", "tamper-evidence", "sha256"]
categories = ["filesystem"]
exclude = ["/.nornir/"]
[features]
# Functional-status emit MODE: pull `nornir-testmatrix` and light this crate's
# `selftest::emit` bridge so its guard checks record honest matrix rows. OFF by
# default — release strips the emit to an `#[inline]` no-op and does NOT link
# `nornir-testmatrix`.
testmatrix = ["dep:nornir-testmatrix", "nornir-testmatrix/testmatrix"]
[dependencies]
anyhow = "1"
# The shared content-hash primitive (edda leaf) — the tamper-evident manifest's
# sha256 + lowercase-hex, consumed instead of re-rolling `Sha256` + a hex loop.
nornir-hash = { version = "0.1.0", path = "../../../edda/crates/nornir-hash" }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
chrono = { version = "0.4", features = ["serde"] }
nornir-cli-outcome = { version = "0.1.0", path = "../../../edda/crates/nornir-cli-outcome" }
nornir-testmatrix = { version = "0.2.4", path = "../../../edda/crates/nornir-testmatrix", optional = true }
[dev-dependencies]
tempfile = "3"