Module target_policy 

Target ceiling policy manifest representation, canonicalization, and narrowing verification.

The target ceiling defines the immutable hardware boundaries and safety constraints for the proxy driver. Runtime configuration (such as structured configuration) may only narrow this ceiling, never widen it (Spec 9.2, 22).

Manifests are canonicalized and digested via SHA-256 (Spec 9.6).

Structs

RangeDto

A byte range [start, end) representing a hard-denied region.

ResourcePolicyManifest

Manifest specification for one resource’s ceiling.

TargetPolicyManifest

Target-wide ceiling policy manifest.

WritableRegisterDto

Manifest specification for one writable register.

Enums

NarrowingError

Errors when a runtime configuration widens rather than narrows the baseline policy.

PolicyValidationError

Errors during manifest validation or canonicalization.

Constants

MAX_NAME_LENGTH

Maximum name length allowed for a resource.

MAX_RESOURCES

Maximum resources allowed by the wire contract.

MAX_SNAPSHOT_ITEMS

Maximum snapshot items allowed by the wire contract.

TARGET_POLICY_SCHEMA_VERSION

The schema version for target ceiling manifests.

Functions

canonicalize_ranges

Merges overlapping and adjacent ranges and validates start < end.