Module compile 

Turning a batch of ParsedPolicy records into declarations registered on a PolicyTreeBuilder – the step where “applicability parses, the predicate does not” gets its scoped, fail-closed treatment, by actually calling didbot_policy::Evaluator::compile.

Why this is a separate step from parsing

Reading a record cannot tell a well-formed predicate from a malformed one: predicate is opaque JSON, and only the evaluator implementation named by language knows its own syntax. So the distinction plan/policy.md draws – “applicability parses, the predicate does not (bad syntax, or it names an evaluator this build does not have)” – can only be made here, once a Language is available to try, and it is made by actually compiling: didbot_policy::Evaluator::compile is validation, there is no separate validate step.

This module is synchronous and does no I/O of its own: it is handed predicate documents and hands back Predicates.

Fail-closed, scoped – and the core already does the work

didbot_policy::Predicate has exactly the state this needs: Predicate::Evaluator for a working one, Predicate::Unusable for “applicability is known-good, the predicate is not.” When a predicate’s language is not one any registered Language answers to, or the matching Language’s evaluator rejects it as malformed, this module registers the record’s applicability and observes with Predicate::Unusable carrying the reason – no evaluator, no separate “deny everything” implementation needed, because didbot_policy::PolicyTree::decide already turns Unusable into a scoped didbot_policy::Outcome::Reject on its own. The tree still routes exactly the writes this policy declared it covers there – nothing outside its declared scope is touched, and nothing inside it is silently allowed by a predicate that could not be built.

Structs

CompileReport

What compiling one batch of records produced: every ScopedDenial and PolicyWarning hit along the way, for the operator-facing report, and the PolicyId each record was registered as.

PolicyWarning

One record Evaluator::compile accepted, but with something the operator should see – see CompileOutcome::CompiledWithWarnings. Never blocks the policy: it is registered exactly like a clean compile, this is purely a report.

ScopedDenial

One record this step could not compile into a live Evaluator, alongside why. Its applicability was still registered, scoped, with Predicate::Unusable – see this module’s doc comment – so this is a report for the operator, not a sign the record was dropped.

Constants

LOCAL_SPELLING

What a predicate is told when it names http://localhost in a spelling no client_id is judged in.

Traits

Language

One evaluator language a build carries, and the bridge from this crate’s opaque predicate payloads into it.

Functions

compile_policies

Registers every policy in records against builder, in records’ iteration order – callers wanting a specific presentational order (see plan/policy.md’s “order is presentational, not semantic”) should pass an already-ordered sequence.

compiled_successfully

Whether resolve_predicate produced a working Predicate::Evaluator – with or without warnings – for id, judged from what it appended to report. didbot-pds’s last-good-revision loader uses this to decide whether an id’s current revision compiled, without duplicating resolve_predicate’s own compiling logic.

local_spelling 🔒

LOCAL_SPELLING, once, if any string in predicate names http://localhost followed by anything but / or a port.

register

Register predicate – whatever resolve_predicate produced – as one policy on builder, using policy’s own applicability, observation surface, staleness and revision.

resolve_predicate

Resolve one record’s Predicate – a working Predicate::Evaluator or a scoped Predicate::Unusable – without registering it on builder as a policy. Appends any ScopedDenial or PolicyWarning hit along the way to report.