gleamunison/turnstile

The evidence turnstile: a pure gate between “code exists” and “code ships”. Every definition carries a content hash; every test run attests evidence onto that hash. check answers one question: which of these defs are evidenced? Pure defs require a passing Test attestation; effectful defs (non-empty requirement row) may alternatively carry a human Io attestation — the only honest evidence for IO a suite cannot drive. Io never substitutes for Test on pure defs: tests are cheap there, so they are mandatory. Publishing composes this gate with a manifest write — no evidence, no entry.

Values

admits

</>

pub fn admits(
  snapshot: evidence.Snapshot,
  subject: String,
  effectful: Bool,
  policy: trust.TrustPolicy,
) -> Bool

The gate rule for one definition, public because the same rule has to hold where content is ADMITTED (publish) and where it is EXECUTED (run). Two spellings of “is this evidenced” is how a definition gets published by one gate and refused by the other.

check

</>

pub fn check(
  adapter: storage.StorageAdapter,
  defs: List(#(String, String, Bool)),
) -> Result(List(String), List(String))

Check #(name, subject_hex, effectful) triples against the evidence store. Ok(all names) when every gated def is evidenced per the rule above; Error(just the unevidenced names) otherwise. test_ defs produce evidence, they do not consume it — gating them would be a chicken-and-egg loop, so they pass by construction.

Unsigned fixtures only: every production path passes an explicit policy.

check_with_policy

</>

pub fn check_with_policy(
  adapter: storage.StorageAdapter,
  defs: List(#(String, String, Bool)),
  policy: trust.TrustPolicy,
) -> Result(List(String), List(String))