//! Core runtime for tsafe.
//!
//! `tsafe-core` owns encrypted vault storage, authority contracts, audit
//! records, deny reasons, and Agent Authority Firewall data types. It is the
//! shared layer used by safe command execution (`tsafe exec`) and by bound MCP
//! server instances that run through a fixed profile, contract, and workdir.
//!
//! Current Agent Authority Firewall support is deliberately local and
//! contract-first:
//!
//! - [`contracts`] parses named authority contracts, trust posture, allowed
//!   targets, and no-secret diagnostic contract shapes.
//! - [`authority`] defines model-safe decisions, refusal payloads, metadata,
//!   and receipts for bound MCP command authority.
//! - [`deny_reason`] carries stable denial categories for execution and
//!   diagnostic surfaces.
//!
//! This crate does not expose an MCP server. Use `tsafe-cli` or `tsafe-mcp`
//! when you need the `tsafe mcp serve --profile <profile> --contract <contract>
//! --workdir <repo>` normal form.
//!
//! ## Algol-merged surface (Phase 1)
//!
//! Two algol-derived modules live alongside the existing surface:
//!
//! - [`attest_contract`] — per-run env-injection contract (`AttestContract`),
//!   distinct from [`contracts::AuthorityContract`] (vault-policy semantics);
//!   the two have zero field overlap and represent different abstractions.
//! - [`run_evidence`] — typed-evidence artifact for an attested command run,
//!   including parent-vs-child env diff with per-var SHA-256 hashes.
//!
//! See `ecosystem-catalog/docs/adr/draft-algol-into-tsafe-merge.md` for the
//! merge rationale; modules carry full provenance + relicense notes at the
//! top of each file.

pub mod age_crypto;
pub mod agent;
pub mod attest_contract;
pub mod audit;
pub mod audit_explain;
pub mod authority;
pub mod baseline_contracts;
pub mod compliance_narrative;
pub mod contracts;
pub mod crypto;
pub mod deny_reason;
pub mod env;
pub mod errors;
pub mod events;
pub mod fsperm;
pub mod gen;
pub mod health;
pub mod keyring_store;
pub mod lifecycle;
pub mod migrate;
pub mod namespace_bulk;
pub mod profile;
pub mod pullconfig;
pub mod pushconfig;
pub mod rbac;
pub mod run_evidence;
pub mod sign;
pub mod snapshot;
pub mod sync;
pub mod team;
pub mod trust_store;
pub mod tooling_inventory;
pub mod totp;
pub mod update;
pub mod vault;
