{
  "component_id": "src_main.rs",
  "name": "Signet-Eval Main CLI Entry Point",
  "description": "Command-line interface entry point for signet-eval, a deterministic policy enforcement tool for AI agent tool calls. Parses CLI arguments, dispatches to subcommands for policy evaluation, vault management, credential storage, MCP server/proxy operations, and enforcement control (pause/resume/disable/enable). Returns exit codes (0 for success, 1 for failure).",
  "version": 1,
  "types": [
    {
      "name": "Cli",
      "kind": "struct",
      "fields": [
        {
          "name": "command",
          "type_ref": "Option<Command>",
          "required": false,
          "default": "",
          "description": "Subcommand to execute; defaults to Eval if omitted",
          "validators": []
        },
        {
          "name": "policy_path",
          "type_ref": "String",
          "required": true,
          "default": "~/.signet/policy.yaml",
          "description": "Path to policy YAML file",
          "validators": []
        }
      ],
      "item_type": "",
      "variants": [],
      "inner_types": [],
      "description": "Top-level CLI argument structure parsed by clap. Contains optional subcommand and policy file path.",
      "owner_component": ""
    },
    {
      "name": "Command",
      "kind": "enum",
      "fields": [],
      "item_type": "",
      "variants": [
        "Eval",
        "Init",
        "Setup",
        "Status",
        "Store",
        "Rules",
        "Log",
        "Test",
        "Delete",
        "ResetSession",
        "Sign",
        "Unlock",
        "Validate",
        "Serve",
        "Proxy",
        "PreflightStatus",
        "PreflightOverride",
        "Pause",
        "Resume",
        "Disable",
        "Enable"
      ],
      "inner_types": [],
      "description": "All available CLI subcommands for policy evaluation, vault management, and enforcement control.",
      "owner_component": ""
    },
    {
      "name": "TestInput",
      "kind": "struct",
      "fields": [
        {
          "name": "tool_name",
          "type_ref": "String",
          "required": true,
          "default": "",
          "description": "",
          "validators": []
        },
        {
          "name": "parameters",
          "type_ref": "Option<serde_json::Value>",
          "required": false,
          "default": "",
          "description": "Tool input parameters; aliased as 'tool_input'",
          "validators": []
        }
      ],
      "item_type": "",
      "variants": [],
      "inner_types": [],
      "description": "Deserialization structure for Test command JSON input, representing a tool call with name and parameters.",
      "owner_component": ""
    }
  ],
  "functions": [
    {
      "name": "expand_home",
      "description": "Expands tilde-prefixed paths (~/) to absolute paths by replacing ~ with the HOME environment variable. Returns the path unchanged if not tilde-prefixed or if HOME is not set.",
      "inputs": [
        {
          "name": "path",
          "type_ref": "&str",
          "required": true,
          "default": "",
          "description": "File path string, potentially starting with ~/",
          "validators": []
        }
      ],
      "output_type": "PathBuf",
      "error_cases": [],
      "preconditions": [],
      "postconditions": [
        "Returns absolute path if input starts with ~/ and HOME env var exists",
        "Returns original path as PathBuf if no tilde prefix or HOME not set"
      ],
      "idempotent": false,
      "is_async": false,
      "side_effects": [
        "Reads HOME environment variable"
      ],
      "structured_side_effects": [
        {
          "kind": "reads_file",
          "target": "environment variable HOME",
          "description": "Reads HOME environment variable via std::env::var"
        }
      ],
      "performance_budget": null
    },
    {
      "name": "run",
      "description": "Main dispatch function: parses CLI arguments, expands policy path, and executes the selected subcommand. Handles policy evaluation (Eval), initialization (Init), vault setup/status/unlock, credential management (Store/Delete), policy operations (Sign/Validate/Rules), MCP server/proxy (Serve/Proxy), preflight management, and enforcement control (Pause/Resume/Disable/Enable). Returns exit code 0 on success, 1 on failure.",
      "inputs": [],
      "output_type": "i32",
      "error_cases": [
        {
          "name": "vault_already_exists",
          "condition": "Setup command invoked when vault already exists",
          "error_type": "user_error",
          "error_data": {
            "message": "Vault already exists. Delete ~/.signet/vault.meta to reset."
          }
        },
        {
          "name": "passphrase_mismatch",
          "condition": "Setup command: confirmation passphrase doesn't match",
          "error_type": "user_error",
          "error_data": {
            "message": "Passphrases don't match."
          }
        },
        {
          "name": "passphrase_too_short",
          "condition": "Setup command: passphrase less than 8 characters",
          "error_type": "validation_error",
          "error_data": {
            "message": "Passphrase must be at least 8 characters."
          }
        },
        {
          "name": "vault_not_found",
          "condition": "Vault-dependent command invoked when vault not set up or locked",
          "error_type": "state_error",
          "error_data": {
            "message": "Vault not set up or locked."
          }
        },
        {
          "name": "policy_integrity_check_failed",
          "condition": "Eval command: HMAC verification of policy file fails when vault exists",
          "error_type": "security_error",
          "error_data": {
            "message": "WARNING: Policy integrity check failed. Using safe defaults."
          }
        },
        {
          "name": "json_parse_error",
          "condition": "Test command: invalid JSON input",
          "error_type": "parse_error",
          "error_data": {
            "message": "Invalid JSON: {error_details}"
          }
        },
        {
          "name": "policy_validation_error",
          "condition": "Validate command: policy file contains validation errors",
          "error_type": "validation_error",
          "error_data": {
            "message": "ERROR: {validation_error}"
          }
        },
        {
          "name": "pause_duration_out_of_range",
          "condition": "Pause command: minutes parameter not in range 1-60",
          "error_type": "validation_error",
          "error_data": {
            "message": "Pause duration must be 1-60 minutes."
          }
        },
        {
          "name": "already_paused",
          "condition": "Pause command invoked when already paused",
          "error_type": "state_error",
          "error_data": {
            "message": "Already paused until timestamp {timestamp}."
          }
        },
        {
          "name": "vault_unlock_failed",
          "condition": "Unlock or PreflightOverride command: incorrect passphrase",
          "error_type": "authentication_error",
          "error_data": {
            "message": "Authentication failed: {error_details}"
          }
        },
        {
          "name": "file_write_error",
          "condition": "Init command: unable to write policy file",
          "error_type": "io_error",
          "error_data": {
            "message": "Error: {io_error}"
          }
        },
        {
          "name": "mcp_server_error",
          "condition": "Serve or Proxy command encounters runtime error",
          "error_type": "runtime_error",
          "error_data": {
            "message": "MCP server error: {error_details}"
          }
        }
      ],
      "preconditions": [],
      "postconditions": [
        "Returns 0 if operation succeeded",
        "Returns 1 if operation failed or validation error occurred"
      ],
      "idempotent": false,
      "is_async": false,
      "side_effects": [
        "Reads stdin for Eval command",
        "Writes to policy file for Init command",
        "Writes to vault metadata files",
        "Reads/writes HMAC signature files",
        "Reads/writes pause/disable marker files",
        "Prints to stdout/stderr",
        "Creates directories as needed",
        "Prompts for password input"
      ],
      "structured_side_effects": [
        {
          "kind": "reads_file",
          "target": "stdin, policy_path, vault metadata, HMAC files, pause/disable files",
          "description": "Reads from stdin (Eval), policy files, vault, pause/disable marker files"
        },
        {
          "kind": "writes_file",
          "target": "policy_path, vault metadata, HMAC signature files, pause/disable files",
          "description": "Writes policy YAML, vault data, HMAC signatures, pause/disable markers"
        },
        {
          "kind": "network_call",
          "target": "MCP server/proxy endpoints",
          "description": "Serve and Proxy commands start network servers"
        },
        {
          "kind": "mutates_state",
          "target": "vault session state, spending counters, preflight state",
          "description": "Modifies vault session keys, spending counters, preflight overrides"
        },
        {
          "kind": "logging",
          "target": "stdout, stderr",
          "description": "Prints status messages, errors, policy rules, vault status, action logs"
        }
      ],
      "performance_budget": null
    },
    {
      "name": "main",
      "description": "Entry point: invokes run() and exits the process with the returned exit code.",
      "inputs": [],
      "output_type": "!",
      "error_cases": [],
      "preconditions": [],
      "postconditions": [
        "Process exits with code from run()"
      ],
      "idempotent": false,
      "is_async": false,
      "side_effects": [
        "Terminates process with exit code"
      ],
      "structured_side_effects": [
        {
          "kind": "mutates_state",
          "target": "process exit code",
          "description": "Calls std::process::exit with run() return value"
        }
      ],
      "performance_budget": null
    }
  ],
  "dependencies": [
    "clap",
    "std::path::PathBuf",
    "std::env",
    "std::fs",
    "serde_yaml",
    "serde_json",
    "serde",
    "rpassword",
    "chrono",
    "tokio"
  ],
  "dependency_contracts": {
    "hook": [
      "run_hook"
    ],
    "policy": [
      "load_policy",
      "load_policy_config",
      "validate_policy",
      "default_policy",
      "self_protection_rules",
      "evaluate",
      "PolicyConfig",
      "PolicyRule",
      "Decision",
      "ToolCall"
    ],
    "vault": [
      "try_load_vault",
      "verify_policy_integrity",
      "sign_policy",
      "vault_exists",
      "setup_vault",
      "unlock_vault",
      "is_paused_file",
      "pause_until_file",
      "set_pause_file",
      "clear_pause_file",
      "is_disabled_file",
      "set_disabled_file",
      "clear_disabled_file"
    ],
    "mcp_server": [
      "run_server"
    ],
    "mcp_proxy": [
      "run_proxy"
    ]
  },
  "invariants": [
    "Default policy path is '~/.signet/policy.yaml'",
    "Exit code 0 indicates success, 1 indicates failure",
    "Vault passphrase must be at least 8 characters",
    "Pause duration must be in range 1-60 minutes",
    "Policy version is always 1",
    "Default policy action is Allow",
    "HMAC verification only occurs if vault exists",
    "Self-protection rules are always included in Init command",
    "Preflight override requires passphrase confirmation"
  ],
  "requires": [],
  "processing_register": "",
  "data_access": {
    "reads": [
      "filesystem",
      "environment_variables",
      "stdin"
    ],
    "writes": [
      "filesystem",
      "stdout",
      "stderr"
    ],
    "rationale": "CLI tool that reads policy files, vault metadata, stdin (for Eval), environment variables (HOME), and writes policy files, vault state, HMAC signatures, pause/disable markers. Prints output to stdout/stderr.",
    "side_effects": [
      {
        "type": "file_read",
        "classification": "config_data",
        "fields": [
          "policy_path",
          "vault_metadata",
          "hmac_files",
          "pause_file",
          "disable_file"
        ],
        "rationale": "Reads configuration and state files from ~/.signet/"
      },
      {
        "type": "file_write",
        "classification": "config_data",
        "fields": [
          "policy_path",
          "vault_metadata",
          "hmac_files",
          "pause_file",
          "disable_file"
        ],
        "rationale": "Writes configuration, vault state, HMAC signatures, and enforcement control markers"
      },
      {
        "type": "stdin_read",
        "classification": "tool_call_input",
        "fields": [
          "stdin"
        ],
        "rationale": "Eval command reads tool call JSON from stdin"
      },
      {
        "type": "stdout_write",
        "classification": "user_output",
        "fields": [
          "stdout",
          "stderr"
        ],
        "rationale": "All commands write status, errors, and results to stdout/stderr"
      },
      {
        "type": "network_listen",
        "classification": "mcp_service",
        "fields": [
          "mcp_server_endpoint",
          "mcp_proxy_endpoint"
        ],
        "rationale": "Serve and Proxy commands start network listeners for MCP protocol"
      }
    ]
  },
  "authority": {
    "domains": [
      "policy_enforcement",
      "vault_management",
      "credential_storage",
      "mcp_service"
    ],
    "rationale": "Owns policy evaluation decisions, vault encryption/decryption, credential tier-3 storage, and MCP server/proxy lifecycle"
  }
}