Module subject

Expand description

What a policy is asked about.

Per plan/policy.md’s “Two trees, one set of mechanics”: the same indexing, evaluators and outcomes serve every subject shape.

Structs§

Change: One field’s value before and after a write, at a dotted path such as "displayName" or "profile.bio".
DeploymentAttributes: Facts about this deployment a policy may reference, independent of the account or the write — a different kind of fact from SubjectAttributes, which is why it is its own type rather than a field folded into that one. An evaluator asking for the PDS’s own DID or hostname is asking a different question than one asking about the account, and naming them separately keeps that visible at the call site — for a rule like “deny a handle that is not under this deployment’s zone”.
Diff: What changed in a write, as the applicability index’s key.
Lookup: What a policy’s declared lookup found in somebody else’s repository.
SubjectAttributes: Attributes about the writing account a policy may need beyond its DID, explicit and extensible rather than a bag.
Universal: Facts that do not belong to the account or the write, but that a stateless predicate is still allowed to reference — grouped into one field per Subject variant rather than left flat, since the field list otherwise grows by one every time a new universal fact is added.

AccountKind: One of the four account kinds this build recognizes.
Asked: How a create asked for its account’s name.
Found: What reading one declared lookup established.
Subject: What one policy is asked to decide about.
SubjectKind: What kind of account a subject is, including a kind this build has never heard of.
WriteAction: What kind of write this is, carried alongside the diff rather than inferred from it.