← snapshot

# Development

This file is an index into the compiler, not prose. The design rationale
lives in [ARCHITECTURE.md](design/ARCHITECTURE.md).

## Three invariants the compiler enforces

```rust
// 1. Only a human can attest. There is no other signature, and no
//    conversion from AgentIdentity in either direction.
let a = Attestation::new(&agent_identity, decision, statement, at);
// ^ does not compile

// 2. Settled is reachable only through attestation.
let r: DecisionRecord<Settled> = DecisionRecord { /* ... */ };
// ^ does not compile — no constructor exists; the single producing
//   path is DecisionRecord::<Unsettled>::attest(attestation)

// 3. Content cannot cross the privacy boundary.
registry_payload::<String>();
// ^ does not compile — String is not DigestSafe, and jac-rendezvous
//   cannot even name Blob/Snapshot/Decision (no dependency path)
```

All three are pinned by `compile_fail` doctests, so `cargo test` re-proves
the negative space.

## Crates

| Crate | Plane | Role |
|---|---|---|
| `jac-core` | neutral | ids, digests, clocks, identity, `DigestSafe` |
| `jac-sketch` | neutral | MinHash sketches |
| `jac-object` | content | blob/tree/snapshot DAG, `ObjectStore` |
| `jac-decision` | content | decisions, attestations, typestate, ledger |
| `jac-gate` | content | fail-closed verdict |
| `jac-git` | content | `GitInterop` port + fake |
| `jac-repo` | content | the engine |
| **`jac-rendezvous`** | **rendezvous** | registry; digest-only, proven |
| `jac-demo` | content | narrated walkthrough (`cargo run -p jac-demo`) |
| `xtask` | neutral | controls |

## Checks

```bash
cargo xtask ci        # layout → boundary → fmt --check → clippy -D warnings → test
cargo xtask boundary  # the plane proof alone
cargo run -p jac-demo # the story
cargo deny check      # supply-chain policy
```

Module layout: `foo.rs` alongside `foo/`, never `foo/mod.rs` (clippy deny +
xtask grep — two mechanisms, one invariant). Clocks are injected;
`std::time::SystemTime` is a disallowed type. All lint policy lives in the
workspace `Cargo.toml` and `clippy.toml`, inherited by every member.