evidence

type Limits ¶

type Limits struct {
	// MaxListEntries bounds evidence_filesystem_list's returned entry count.
	MaxListEntries int
	// MaxReadBytes bounds evidence_filesystem_read's default read size when
	// a call does not specify its own (smaller-or-equal) limit.
	MaxReadBytes int
	// MaxGlobMatches bounds evidence_filesystem_glob's returned match count.
	MaxGlobMatches int
	// MaxGrepMatches bounds evidence_filesystem_grep's returned match count.
	MaxGrepMatches int
	// MaxGrepFileBytes bounds how many bytes of any one file
	// evidence_filesystem_grep scans.
	MaxGrepFileBytes int
	// MaxStatusBytes bounds evidence_git_repository_status's status text.
	MaxStatusBytes int
	// MaxDiffBytes bounds evidence_git_diff's diff text.
	MaxDiffBytes int
}

Limits bounds every evidence tool's output AT THE SOURCE: each tool truncates while it reads/lists/searches, never after buffering an unbounded result. Zero (or a value exceeding the package's internal hard ceiling) falls back to a safe default — see (Limits).normalize.

func DefaultLimits() Limits

type Visibility ¶

type Visibility string

Visibility is the closed classification of a Git remote's visibility, as reported by the evidence_git_remotes tool.

The default and safe outcome is VisibilityUnknown: this package never makes an outbound network call (design §13.3 forbids evidence tools from accessing arbitrary network resources), so a real public/private/internal answer can only ever come from a consumer-injected VisibilityResolver wired to a real, governed, read-only hosting API. Nothing in this package ever infers VisibilityPublic or VisibilityPrivate from the remote URL text alone — a familiar hostname is not evidence of access control.

const (
	VisibilityUnknown  Visibility = "unknown"
	VisibilityPublic   Visibility = "public"
	VisibilityPrivate  Visibility = "private"
	VisibilityInternal Visibility = "internal"
)

type VisibilityResolver ¶

type VisibilityResolver interface {
	ResolveVisibility(ctx context.Context, remoteURL string) (Visibility, error)
}

VisibilityResolver is the explicitly configured, read-only network identity source design §13.2 calls for ("repository visibility evidence through an explicitly configured, read-only network identity source"). It is OPTIONAL — StandardEvidence accepts a nil resolver, in which case every remote is reported VisibilityUnknown. This package supplies no implementation that performs network I/O: injecting a real one (e.g. backed by a hosting provider's repository-visibility endpoint) is a consumer decision, made by a party that can govern its egress, auth, and rate limits. A configured resolver MUST be read-only, MUST NOT mutate any remote state, and is expected to perform at most one bounded lookup per call; ResolveVisibility failing or returning an unrecognized value is always treated as VisibilityUnknown, never as an error that aborts the review (see resolveVisibility).