setup

Documentation

Overview

Package setup implements SafeLane's deterministic, repository-aware setup. Agent-authored findings are an explicit inspect/plan/apply workflow and never execute a nested coding-agent process.

Index

• func Fingerprint(snapshot Snapshot) string
• func ValidateFindings(p Findings, s Snapshot, requireEvidence bool) error
• func ValidatePlan(plan Plan) error
• type AssertionIntent
• type CompiledSetup
  • func CompileFindings(p Findings, s Snapshot, requireEvidence bool) (CompiledSetup, error)
• type Evidence
• type File
• type Findings
  • func ConservativeFindings(s Snapshot) Findings
• type Plan
  • func NewPlan(s Snapshot, findings Findings, compiled CompiledSetup, agentFindings bool) Plan
• type RiskPath
• type RuntimeAssertion
• type Snapshot
  • func Discover(root string) (Snapshot, error)
• type TemplateFile

Functions

func Fingerprint

func Fingerprint(snapshot Snapshot) string

Fingerprint binds agent findings to the exact repository inspection.

func ValidateFindings

func ValidateFindings(p Findings, s Snapshot, requireEvidence bool) error

ValidateFindings checks semantic input before SafeLane compiles a plan. Agent findings require citations; the trusted deterministic fallback does not.

func ValidatePlan

func ValidatePlan(plan Plan) error

ValidatePlan detects malformed or modified plan artifacts before mutation.

Types

type AssertionIntent

type AssertionIntent struct {
	Surface  string     `json:"surface"`
	Covers   string     `json:"covers"`
	Evidence []Evidence `json:"evidence"`
}

AssertionIntent identifies semantic coverage the analyst requires. SafeLane compiles it into an executable Runtime Assertion supported by the probe.

type CompiledSetup

type CompiledSetup struct {
	RequiredChecks    []string           `json:"required_checks"`
	RuntimeAssertions []RuntimeAssertion `json:"runtime_assertions"`
	PolicyYAML        string             `json:"policy_yaml"`
	TemplateFiles     []TemplateFile     `json:"template_files"`
}

CompiledSetup is the operator-owned configuration produced from valid Semantic Findings and the exact repository Snapshot they cite.

func CompileFindings

func CompileFindings(p Findings, s Snapshot, requireEvidence bool) (CompiledSetup, error)

CompileFindings is the only setup path that authors policy or manifests.

type Evidence

type Evidence struct {
	File string `json:"file"`
	Line int    `json:"line"`
}

Evidence ties one semantic finding to repository text the operator can review.

type File

type File struct {
	Path          string `json:"path"`
	Bytes         int    `json:"bytes"`
	ContentSHA256 string `json:"content_sha256"`
	Truncated     bool   `json:"truncated,omitempty"`
	// Content is retained only inside this SafeLane process for deterministic
	// discovery. The active agent already has repository tools; echoing source
	// through setup inspection wastes context and can expose irrelevant text.
	Content string `json:"-"`
}

File is a bounded, read-only snapshot of one repository file.

type Findings

type Findings struct {
	SchemaVersion         string            `json:"schema_version"`
	InspectionFingerprint string            `json:"inspection_fingerprint"`
	Summary               string            `json:"summary"`
	RiskPaths             []RiskPath        `json:"risk_paths"`
	AssertionIntents      []AssertionIntent `json:"assertion_intents"`
}

Findings are the replaceable semantic analyst's bounded, evidence-backed input. SafeLane remains the sole setup authority and configuration compiler.

func ConservativeFindings

func ConservativeFindings(s Snapshot) Findings

ConservativeFindings are the semantic fallback used by non-agent setup.

type Plan

type Plan struct {
	SchemaVersion  string        `json:"schema_version"`
	ID             string        `json:"id"`
	FindingsSource string        `json:"findings_source"`
	Snapshot       Snapshot      `json:"snapshot"`
	Findings       Findings      `json:"findings"`
	Compiled       CompiledSetup `json:"compiled"`
}

Plan is the immutable, content-addressed setup SafeLane presents and applies.

func NewPlan

func NewPlan(s Snapshot, findings Findings, compiled CompiledSetup, agentFindings bool) Plan

NewPlan freezes the exact validated setup that can later be applied by ID.

type RiskPath

type RiskPath struct {
	Glob     string     `json:"glob"`
	Minimum  string     `json:"minimum"`
	Reason   string     `json:"reason"`
	Evidence []Evidence `json:"evidence,omitempty"`
}

RiskPath is one bounded semantic decision the active agent may make. SafeLane compiles it into the operator-owned policy; the agent never authors policy YAML.

type RuntimeAssertion

type RuntimeAssertion struct {
	ID          string     `json:"id"`
	Surface     string     `json:"surface"`
	Expectation string     `json:"expectation"`
	Covers      string     `json:"covers"`
	Evidence    []Evidence `json:"evidence,omitempty"`
}

RuntimeAssertion is a concrete black-box claim about a discovered route.

type Snapshot

type Snapshot struct {
	SchemaVersion         string             `json:"schema_version"`
	Application           string             `json:"application"`
	Repository            string             `json:"repository"`
	DefaultBranch         string             `json:"default_branch"`
	ImageRepository       string             `json:"image_repository"`
	RequiredChecks        []string           `json:"required_checks"`
	KubernetesFiles       []string           `json:"kubernetes_files"`
	CriticalSurfaces      []string           `json:"critical_surfaces"`
	MandatoryAssertions   []RuntimeAssertion `json:"mandatory_runtime_assertions"`
	Uncertainties         []string           `json:"uncertainties"`
	Files                 []File             `json:"files"`
	InspectionFingerprint string             `json:"inspection_fingerprint"`
}

Snapshot contains facts SafeLane discovered without changing the app repo.

func Discover

func Discover(root string) (Snapshot, error)

Discover reads only repository metadata and bounded, non-secret text files.

type TemplateFile

type TemplateFile struct {
	Path    string `json:"path"`
	Content string `json:"content"`
}

TemplateFile is one operator-owned Release Template file compiled by SafeLane.