Canonical immutable security-policy snapshots and their model-facing view.
A snapshot is created once for a root environment, inherited unchanged by child environments, and replaced only by an explicit environment rebuild. Enforcement and context both derive from this value.
Canonical immutable security-policy snapshots and their model-facing view. A snapshot is created once for a root environment, inherited unchanged by child environments, and replaced only by an explicit environment rebuild. Enforcement and context both derive from this value.
(access-view policy workspace-roots)Build the string-keyed model context from the exact enforcement snapshot.
workspace-roots are the live session overlay; configured grants remain
immutable. Paths under HOME render as ~/… without changing enforcement.
Build the string-keyed model context from the exact enforcement snapshot. `workspace-roots` are the live session overlay; configured grants remain immutable. Paths under HOME render as `~/…` without changing enforcement.
(home-relative path)(home-relative path home)Render an absolute path under HOME as ~ / ~/…; leave other paths absolute.
Render an absolute path under HOME as `~` / `~/…`; leave other paths absolute.
(no-search-roots policy)Configured roots flagged search: false in the workspace catalog. They are
granted to the jail but excluded from the DEFAULT rg/find_files sweep;
explicit paths still reach them.
Configured roots flagged `search: false` in the workspace catalog. They are granted to the jail but excluded from the DEFAULT rg/find_files sweep; explicit paths still reach them.
(read-write-roots policy)Configured roots available read/write to common model tools. allow-write
remains readable under the process-jail contract, so it belongs here too.
Configured roots available read/write to common model tools. `allow-write` remains readable under the process-jail contract, so it belongs here too.
(snapshot config)(snapshot config
{:keys [base-dir home]
:or {base-dir (System/getProperty "user.dir")
home (System/getProperty "user.home")}})Build the immutable canonical security policy from validated string-keyed configuration. Relative and home-relative paths become absolute; symlinks are resolved at this boundary.
Build the immutable canonical security policy from validated string-keyed configuration. Relative and home-relative paths become absolute; symlinks are resolved at this boundary.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |