Module policy_poll 

The policy poll: the operator’s bot.did.policy and bot.did.policyBinding records, read on the operator poll’s tick and built into one policy set.

List the collection, not track individual records

com.atproto.repo.listRecords, walked via its cursor every tick – not getRecord against a set of rkeys this server remembers from before. This was an explicit design question and the owner answered it directly: list the collection. Ideally this would subscribe rather than poll, but there is no efficient way to subscribe to one collection in one foreign repository, so polling listRecords on a timer is what this ships with.

One tick lists both collections to their last page from the endpoint the operator poll resolved, builds the whole set from them with didbot_pds::policy_bindings::resolve, and swaps the tree into the gate every write and grant is judged by. A listing that fails at any page builds nothing, so the gate keeps the set it has; a record the build cannot honour is refused on its own, keeping the record in force at its key where there is one, so neither an unreachable repository nor a mid-edit one widens what an account may do.

Across a restart

Every set installed is written to didbot_pds::PolicyStore, and PolicyPoll::restore reads it back into the gate at boot, before the first tick runs. Without that, a restart is a window in which the operator’s denials are not in force — which would make restarting the server a way around them. A file that is there and cannot be used stops the boot; see that module’s own doc comment for why that direction.

What the enforced set holds, and what the newest build refused, are published on bot.did.stats — see didbot_pds::policy_bindings::EnforcedSet.

Structs

ListRecordsResponse 🔒

ListedRecord 🔒

PolicyPoll

The operator’s policy records as this deployment reads and enforces them, across ticks.

Enums

PolicyPollError

Why a tick installed nothing. The gate keeps the set it had.

PollError

Why a listing could not complete. Every variant means the caller has no records at all from this attempt – see this module’s doc comment on why a failed listing must never apply a partial result.

RestoreError

Why a boot could not put the kept set back in force.

Constants

MAX_PAGES 🔒

The most pages one listing follows before giving up.

PAGE_SIZE 🔒

How many records listRecords is asked for per page. The maximum com.atproto.repo.listRecords allows.

Functions

by_record_key 🔒

A listing keyed by at-uri, re-keyed by record key: the key a binding names a policy by, and the one a refusal names a record by.

list_records

Page through operator_did’s collection at endpoint to completion, returning every record found keyed by at-uri.