{
  "component_id": "src_main.rs",
  "name": "Signet-Eval Main CLI Entry Point",
  "description": "Main entry point for signet-eval CLI application providing policy enforcement for AI agent tool calls. Implements command parsing, policy file management, vault operations, credential storage, and policy evaluation. Routes commands to appropriate modules (hook, policy, vault) and handles initialization, signing, testing, and enforcement workflows.",
  "version": 1,
  "types": [
    {
      "name": "Cli",
      "kind": "struct",
      "fields": [
        {
          "name": "command",
          "type_ref": "Option<Command>",
          "required": false,
          "default": "",
          "description": "Subcommand to execute; None defaults to Eval mode",
          "validators": []
        },
        {
          "name": "policy_path",
          "type_ref": "String",
          "required": true,
          "default": "~/.signet/policy.yaml",
          "description": "Path to policy YAML file",
          "validators": []
        }
      ],
      "item_type": "",
      "variants": [],
      "inner_types": [],
      "description": "Top-level CLI structure parsed by clap. Contains optional subcommand and policy file path.",
      "owner_component": ""
    },
    {
      "name": "Command",
      "kind": "enum",
      "fields": [],
      "item_type": "",
      "variants": [
        "Eval",
        "Init",
        "Setup",
        "Status",
        "Store",
        "Rules",
        "Log",
        "Test",
        "Delete",
        "ResetSession",
        "Sign",
        "Unlock",
        "Validate",
        "Serve",
        "Proxy",
        "PreflightStatus",
        "PreflightOverride",
        "Pause",
        "Resume",
        "Disable",
        "Enable"
      ],
      "inner_types": [],
      "description": "All available CLI subcommands for policy enforcement, vault management, and testing",
      "owner_component": ""
    },
    {
      "name": "TestInput",
      "kind": "struct",
      "fields": [
        {
          "name": "tool_name",
          "type_ref": "String",
          "required": true,
          "default": "",
          "description": "Name of the tool being called",
          "validators": []
        },
        {
          "name": "parameters",
          "type_ref": "Option<serde_json::Value>",
          "required": false,
          "default": "",
          "description": "Tool input parameters (alias: tool_input)",
          "validators": []
        }
      ],
      "item_type": "",
      "variants": [],
      "inner_types": [],
      "description": "Deserialized structure for Test command JSON input containing tool call details",
      "owner_component": ""
    }
  ],
  "functions": [
    {
      "name": "expand_home",
      "description": "Expands tilde-prefixed paths to absolute paths by substituting $HOME environment variable. Falls back to literal path if HOME is not set or path doesn't start with ~/.",
      "inputs": [
        {
          "name": "path",
          "type_ref": "&str",
          "required": true,
          "default": "",
          "description": "Input path that may start with ~/",
          "validators": []
        }
      ],
      "output_type": "PathBuf",
      "error_cases": [],
      "preconditions": [],
      "postconditions": [
        "Returns PathBuf with ~/ expanded to $HOME if HOME is set and path starts with ~/",
        "Otherwise returns PathBuf from literal input"
      ],
      "idempotent": false,
      "is_async": false,
      "side_effects": [
        "reads_env_var"
      ],
      "structured_side_effects": [
        {
          "kind": "reads_file",
          "target": "environment variable HOME",
          "description": "Reads $HOME via std::env::var"
        }
      ],
      "performance_budget": null
    },
    {
      "name": "run",
      "description": "Main application logic router. Parses CLI arguments, expands policy path, and dispatches to appropriate command handler. Handles all subcommands including Eval (default), Init, Setup, Status, Store, Rules, Log, Test, Delete, ResetSession, Sign, Unlock, Validate, Serve, Proxy, PreflightStatus, PreflightOverride, Pause, Resume, Disable, Enable. Returns exit code (0 for success, 1 for error).",
      "inputs": [],
      "output_type": "i32",
      "error_cases": [
        {
          "name": "vault_already_exists",
          "condition": "Setup command when vault.meta already exists",
          "error_type": "exit_code_1",
          "error_data": {}
        },
        {
          "name": "passphrase_mismatch",
          "condition": "Setup command when passphrase != confirm passphrase",
          "error_type": "exit_code_1",
          "error_data": {}
        },
        {
          "name": "passphrase_too_short",
          "condition": "Setup command when passphrase length < 8",
          "error_type": "exit_code_1",
          "error_data": {}
        },
        {
          "name": "vault_not_found",
          "condition": "Commands requiring vault when vault doesn't exist or is locked",
          "error_type": "exit_code_1",
          "error_data": {}
        },
        {
          "name": "policy_integrity_failed",
          "condition": "Eval command when HMAC verification fails for policy file",
          "error_type": "fallback_to_safe_defaults",
          "error_data": {}
        },
        {
          "name": "invalid_json",
          "condition": "Test command when input JSON cannot be deserialized",
          "error_type": "exit_code_1",
          "error_data": {}
        },
        {
          "name": "credential_not_found",
          "condition": "Delete command when credential name doesn't exist",
          "error_type": "exit_code_1",
          "error_data": {}
        },
        {
          "name": "policy_validation_errors",
          "condition": "Validate command when policy has validation errors",
          "error_type": "exit_code_1",
          "error_data": {}
        },
        {
          "name": "pause_duration_invalid",
          "condition": "Pause command when minutes < 1 or > 60",
          "error_type": "exit_code_1",
          "error_data": {}
        },
        {
          "name": "already_paused",
          "condition": "Pause command when pause file already exists",
          "error_type": "exit_code_1",
          "error_data": {}
        },
        {
          "name": "not_paused",
          "condition": "Resume command when pause file doesn't exist",
          "error_type": "exit_code_0",
          "error_data": {}
        },
        {
          "name": "already_disabled",
          "condition": "Disable command when disabled file already exists",
          "error_type": "exit_code_0",
          "error_data": {}
        },
        {
          "name": "not_disabled",
          "condition": "Enable command when disabled file doesn't exist",
          "error_type": "exit_code_0",
          "error_data": {}
        },
        {
          "name": "preflight_authentication_failed",
          "condition": "PreflightOverride command when passphrase is incorrect",
          "error_type": "exit_code_1",
          "error_data": {}
        },
        {
          "name": "no_active_preflight",
          "condition": "PreflightOverride command when no preflight is active",
          "error_type": "exit_code_0",
          "error_data": {}
        },
        {
          "name": "mcp_server_error",
          "condition": "Serve/Proxy commands when MCP runtime fails",
          "error_type": "exit_code_1",
          "error_data": {}
        }
      ],
      "preconditions": [],
      "postconditions": [
        "Returns 0 on successful command execution",
        "Returns 1 on error or validation failure",
        "Writes output to stdout/stderr based on command result"
      ],
      "idempotent": false,
      "is_async": false,
      "side_effects": [
        "reads_stdin",
        "writes_stdout",
        "writes_stderr",
        "reads_files",
        "writes_files",
        "network_call_conditional",
        "mutates_vault_state",
        "reads_env"
      ],
      "structured_side_effects": [
        {
          "kind": "reads_file",
          "target": "policy file at policy_path",
          "description": "Loads policy YAML for most commands"
        },
        {
          "kind": "writes_file",
          "target": "policy file, vault files, HMAC signature",
          "description": "Init writes policy, Setup creates vault, Sign writes HMAC"
        },
        {
          "kind": "mutates_state",
          "target": "vault session state, credentials, ledger",
          "description": "Store/Delete modify credentials, ResetSession clears counters"
        },
        {
          "kind": "network_call",
          "target": "MCP server/proxy",
          "description": "Serve and Proxy commands start network services (conditional on mcp feature)"
        },
        {
          "kind": "logging",
          "target": "stdout/stderr",
          "description": "All commands produce diagnostic output"
        }
      ],
      "performance_budget": null
    },
    {
      "name": "main",
      "description": "Program entry point. Calls run() and exits with returned status code.",
      "inputs": [],
      "output_type": "!",
      "error_cases": [],
      "preconditions": [],
      "postconditions": [
        "Process exits with status code from run()"
      ],
      "idempotent": false,
      "is_async": false,
      "side_effects": [
        "process_exit"
      ],
      "structured_side_effects": [
        {
          "kind": "mutates_state",
          "target": "process exit",
          "description": "Calls std::process::exit with run() return value"
        }
      ],
      "performance_budget": null
    }
  ],
  "dependencies": [
    "clap",
    "std::path",
    "std::env",
    "std::fs",
    "std::process",
    "std::time",
    "serde_yaml",
    "serde_json",
    "serde",
    "rpassword",
    "chrono",
    "tokio",
    "hook",
    "policy",
    "vault",
    "mcp_server",
    "mcp_proxy"
  ],
  "dependency_contracts": {
    "hook": [
      "run_hook"
    ],
    "policy": [
      "load_policy",
      "load_policy_config",
      "default_policy",
      "self_protection_rules",
      "evaluate",
      "validate_policy",
      "PolicyRule",
      "PolicyConfig",
      "Decision",
      "ToolCall"
    ],
    "vault": [
      "try_load_vault",
      "verify_policy_integrity",
      "vault_exists",
      "setup_vault",
      "sign_policy",
      "unlock_vault",
      "is_paused_file",
      "pause_until_file",
      "set_pause_file",
      "clear_pause_file",
      "is_disabled_file",
      "set_disabled_file",
      "clear_disabled_file"
    ],
    "mcp_server": [
      "run_server"
    ],
    "mcp_proxy": [
      "run_proxy"
    ]
  },
  "invariants": [
    "Policy file default location is ~/.signet/policy.yaml unless overridden",
    "Vault passphrase must be at least 8 characters",
    "Exit code 0 indicates success, 1 indicates error",
    "HMAC verification requires vault to be set up",
    "Policy integrity failure falls back to safe default policy",
    "Self-protection rules are always included in Init policy",
    "Pause duration is clamped to 1-60 minutes",
    "PreflightOverride requires passphrase re-authentication",
    "Serve and Proxy commands require 'mcp' feature flag"
  ],
  "requires": [],
  "processing_register": "Formal",
  "data_access": {
    "reads": [
      "environment_variables",
      "policy_yaml_file",
      "vault_metadata",
      "stdin"
    ],
    "writes": [
      "policy_yaml_file",
      "vault_files",
      "hmac_signature_file",
      "pause_state_file",
      "disable_state_file",
      "stdout",
      "stderr"
    ],
    "rationale": "CLI application needs to read configuration from filesystem and environment, write policy and vault data, and manage enforcement state through marker files.",
    "side_effects": [
      {
        "type": "file_write",
        "classification": "policy_configuration",
        "fields": [
          "policy_yaml"
        ],
        "rationale": "Init command writes default policy rules to YAML file"
      },
      {
        "type": "vault_mutation",
        "classification": "credential_storage",
        "fields": [
          "credentials",
          "session_state"
        ],
        "rationale": "Store/Delete commands modify vault credential compartments"
      },
      {
        "type": "process_exit",
        "classification": "control_flow",
        "fields": [
          "exit_code"
        ],
        "rationale": "main() exits process with status from run()"
      }
    ]
  },
  "authority": {
    "domains": [
      "cli_argument_parsing",
      "policy_file_management",
      "vault_initialization",
      "command_routing"
    ],
    "rationale": "Main entry point owns CLI interface and command dispatch logic. Coordinates between policy, vault, and hook modules but delegates actual enforcement and cryptographic operations."
  }
}