Repository map
Mint has four Rust crates. The dependency direction is one way.
| Crate | Depends on | Owns |
|---|---|---|
| mint-core | Workspace dependencies only | Pure declarations, policy, custody, audit, scanning, and release logic. |
| mint-broker | mint-core | HTTP authentication, policy enforcement, forwarding, scrubbing, and readiness. |
| mint-cli | mint-core and mint-broker | Operator commands and process startup. |
| mint-mcp | mint-core | Read-only JSON-RPC inspection. |
The broker imports the core. The CLI assembles the broker. MCP does not import the broker.
[!NOTE] A module name is a source ownership boundary. It is not a promise that every symbol is a stable public API.
mint-core forbids network access. mint-broker is the data plane. mint-cli and mint-mcp are entry points.
mint-core
Section titled “mint-core”The core is deterministic. It contains no network client. OS access is limited to custody adapters and guarded file operations.
| Module | Responsibility | Key invariant | Tests and change landing zone |
|---|---|---|---|
| lib.rs | Declares modules and re-exports the product spine. | Non-test builds forbid unsafe code. | Add public exports here only with API tests. Source · Tests |
| adoption.rs | Loads evidence and derives consumer posture. | A parked declaration cannot hide brokered, mixed, or missing evidence. | adoption_inventory.rs. Source · Tests |
| alias.rs | Parses aliases and finds bounded placeholders. | Alias grammar is strict. Prose that resembles a placeholder is not a match. | Embedded alias tests and config_scan.rs. Source · Tests |
| audit.rs | Builds audit events and delegates to the hash-chained ledger. | Prepared effects need a terminal record before readiness is green. | Embedded audit tests and broker audit-gate tests. Source · Tests |
| call_guard.rs | Enforces actor and service call windows. | Limits are separate from semantic policy and fail closed on malformed windows. | Embedded call-guard tests. Source · Tests |
| capability.rs | Issues, stores, authenticates, and revokes capability declarations. | Disk stores only a SHA-256 digest. The raw token is returned once. | mint-cli capability tests and embedded tests. Source · Tests |
| config_scan.rs | Scans structured and raw files for credential findings. | Findings never render matched values. Unknown credential shapes fail closed. | config_scan.rs. Source · Tests |
| credential_boundary.rs | Parses custody, principals, launch surfaces, scan paths, and exact OAuth exceptions. | Native OAuth matches identity, schema, fields, owner, mode, and destination exactly. | credential_boundaries.rs. Source · Tests |
| cutover.rs | Validates name-based migration manifests and environment files. | Cutover checks compare names and metadata, not secret values. | cutover_manifest.rs. Source · Tests |
| discovery.rs | Finds known launcher homes and credential-bearing surfaces. | Findings carry no credential content. Absent launchers stay silent. | Embedded discovery tests and CLI adoption tests. Source · Tests |
| error.rs | Defines structured errors for core operations. | Errors carry paths and causes without secret values. | Update the owning module test when adding an error. Source · Tests |
| ledger.rs | Appends, verifies, rotates, migrates, and reconciles audit records. | Hash-chain tampering, unsafe migration, and unresolved effects fail closed. | Embedded ledger tests and release activation tests. Source · Tests |
| local_cutover.rs | Persists the local cutover journal and severance receipt. | Transitions are monotonic. Journal and receipts are value-free and owner-private. | local_cutover.rs tests in core and CLI. Source · Tests |
| policy.rs | Parses first-match policy rules and evaluates proxy or tool requests. | Default deny, exact alias binding, placeholder requirements, and no stale authority fields. | Embedded policy tests and broker deploy-policy tests. Source · Tests |
| redact.rs | Detects and scrubs known or credential-shaped content. | Scrubbing preserves ordinary content and never passes detected credentials through. | Embedded redaction tests and broker response-scrub tests. Source · Tests |
| release.rs | Preflights bundles and activates immutable releases. | The candidate binary owns preflight. Activation is atomic and rollback restores the expected target. | release_activation.rs. Source · Tests |
| secret_store.rs | Defines custody adapters for OS key stores, environment stores, and private directories. | Secret values stay behind the SecretStore boundary. Paths, modes, symlinks, and timeouts are checked. | Embedded secret-store tests. Source · Tests |
| typed_action.rs | Describes the bounded typed-action registry and input validation. | Action IDs, HTTPS URLs, prompt size, and unknown fields are bounded. | Embedded typed-action tests and broker typed-effect tests. Source · Tests |
mint-broker
Section titled “mint-broker”The broker depends on mint-core. It authenticates a caller, evaluates policy, resolves a placeholder inside the broker, forwards the request, scrubs the response, and writes terminal audit state.
| Module | Responsibility | Key invariant | Tests and change landing zone |
|---|---|---|---|
| lib.rs | Builds shared state, routes, declaration snapshots, and health checks. | Policy and authentication reload as one generation. Request body size stays bounded. | reload.rs, audit_gate.rs, and typed_effect.rs. Source · Tests |
| audit_gate.rs | Coordinates prepared effects, terminal audit records, readiness, and shutdown. | No new effect starts while admission is stopped or the audit sink is unresolved. | audit_gate.rs and embedded gate tests. Source · Tests |
| auth.rs | Authenticates capability headers and exposes the caller identity. | Shared-secret authentication is loopback-only. Invalid credentials fail before resolution. | auth_boundary.rs and embedded auth tests. Source · Tests |
| breaker.rs | Tracks per-host upstream failure state. | Server failures open independently per host. Client errors do not open the breaker. | breaker.rs and breaker_indeterminate.rs. Source · Tests |
| canary.rs | Sends bounded operational health and error signals. | Disabled or unreachable telemetry never delays the caller and carries no payload values. | canary.rs and embedded reporter tests. Source · Tests |
| canary_audit.rs | Queues sanitized audit envelopes for operational shipping. | Prepared audit phases never ship. The outbox deduplicates and survives restart. | Embedded envelope tests. Source · Tests |
| config.rs | Parses broker environment configuration and defaults. | Explicit paths fail when missing. Secret backend selection never silently falls back. | Embedded config tests. Source · Tests |
| doctor.rs | Runs bounded readiness checks and returns named results. | Checks use scratch state and redact values. A failed check makes the report unhealthy. | Embedded doctor tests and CLI doctor tests. Source · Tests |
| proxy.rs | Implements the HTTP proxy request path and response handling. | Auth, policy, placeholder, SSRF, audit, forwarding, and scrubbing order is fail closed. An unpermitted placeholder mention in a request body or query is inert forwarded text; the same mention in a header still denies the call. | exfil.rs, response_scrub.rs, ingress_boundary.rs, inert_unpermitted_placeholder.rs, and leak.rs. Many helpers are pub(crate) and are not stable APIs. Source · Tests |
| stream.rs | Decodes bounded compressed bodies and scrubs streaming frames. | Encoded or oversized responses fail closed. Split secrets are scrubbed across chunks. This module is internal. | Embedded streaming tests and response_scrub.rs. Source · Tests |
| tailnet.rs | Resolves peer identity and authenticates by observed peer address. | Client-supplied identity headers are ignored. Unresolved or slow identity checks deny. | tailnet_identity.rs. Source · Tests |
| typed_effect.rs | Runs the bounded typed-action route. | Input validation and policy happen before resolution. Cleanup runs after an effect attempt. This module is an internal route implementation. | typed_effect.rs. Source · Tests |
mint-cli
Section titled “mint-cli”mint-cli builds the mint binary from one source module.
| Module | Responsibility | Key invariant | Tests and change landing zone |
|---|---|---|---|
| main.rs | Parses commands, assembles configuration, runs broker startup, and exposes policy, audit, alias, capability, adoption, release, doctor, and cutover commands. | CLI paths use the same parsers as runtime paths. Failed checks return non-zero without printing credential values. | cli.rs, capability.rs, local_cutover.rs, and unit_migration.rs. Source · Tests |
CLI helper functions and command enum variants are implementation details unless the CLI reference documents them as commands.
mint-mcp
Section titled “mint-mcp”mint-mcp is a read-only JSON-RPC surface. It reads aliases, policy, and audit records through core loaders.
| Module | Responsibility | Key invariant | Tests and change landing zone |
|---|---|---|---|
| lib.rs | Defines tool metadata, JSON-RPC dispatch, and read-only tool handlers. | No tool resolves a secret. Tool schemas are valid JSON and unknown tools fail as errors. | Embedded MCP tests. Source · Tests |
| main.rs | Reads one JSON-RPC request per non-empty stdin line and writes one response line. | Notifications produce no response. Invalid JSON is reported on stderr and does not crash the loop. | Exercise the binary and update mint-mcp lib tests for behavior. Source · Tests |
Dependency and ownership rules
Section titled “Dependency and ownership rules”- Change the deepest owning module first.
- Add a focused test at the same boundary.
- Update a crate re-export only when the symbol is a deliberate public surface.
- Keep broker helpers marked pub(crate) out of API promises.
- Keep CLI and MCP behavior in their entry-point tests.
Source map
Section titled “Source map”Source and test links in this page pin the immutable commit that introduced or last changed the described code. The module declarations are mint-core lib.rs, mint-broker lib.rs, mint-cli main.rs, and mint-mcp lib.rs, all pinned at f82276b. Test anchors appear in each table row.
The map covers Rust source files only. It does not publish deployment inventories, private paths, credential identities, or runtime receipts.