Logical source references: `@root/relative` names a path within a REGISTERED source root, not a path to open. The vocabulary plus the one sanctioned resolver from logical ref to PathBuf, so an index that spans more than one repository cannot confuse two files with the same relative path, and no consumer invents its own decoding.
| Tier | foundation |
| Role | value_object |
| Path | crates/foundation/source-ref |
| Edition | 2021 |
| Targets | foundation_source_ref |
| Public items | 13 across 0 modules |
| Tests | 9 |
What it is for
Logical source references: @hooks-rs/src/ruleset.rs means "the path src/ruleset.rs within the REGISTERED source root hooks-rs", and never a path to hand to the filesystem.
Foundation tier, and deliberately not inside the corpus crate: the consumers that must not mistake a logical ref for a path span tiers all the way up — operations-control-plane's scope_dirs decides which directories a coding session may touch, and a tools-tier crate is not importable from there. One vocabulary, one resolver, every tier.
Why: corpus_doc.repo_path has held one repository's relative paths since US-3.96.2, with no column saying which repository. Code the workspace actually runs lives outside crates/ too — the harness hooks in ~/.claude/hooks-rs are the case that forced this — and a capability that cannot be found is a capability that gets built twice (operator, 2026-09-17: "I swear we already did this").
This is an INTERIM identity, deliberately: a second column on corpus_doc is the right end state, and is not written here because that database is mid-migration in another session. The prefix buys the namespace without a schema change, and this module is the one place that knows the encoding.
Two rules the rest of the tree depends on:
1. A logical ref is not a path. Only SourceRootRegistry::resolve turns one into a PathBuf, and only for a root that is registered. No caller strips the sigil itself; if one does, the encoding has two owners and the next change breaks one of them. 2. Retirement is scoped to the observed root. An ingest of one root may only retire refs in that root's namespace (scope_predicate). Nothing else is what the run looked at, so nothing else may be called missing.
Existing workspace refs keep their bare relative paths and are NOT rewritten by this work: the unnamespaced namespace is the workspace's, and scope_predicate states that as NOT LIKE '@%'.
Capabilities
crate root
Logical source references: @hooks-rs/src/ruleset.rs means "the path
| Item |
|---|
pub const SIGIL: char |
fn split_ref(stored : & str) ->(Option <& str>, & str) |
fn belongs_to(stored : & str, source_root : Option <& str>) -> bool |
pub const WORKSPACE_ONLY_SQL: & str |
fn scope_predicate(source_root : Option <& str>) ->(& 'static str, Option <String>) |
SourceRootError
Logical source references: @hooks-rs/src/ruleset.rs means "the path
| Item |
|---|
pub enum SourceRootError |
fn validate_name(name : & str) -> Result <(), SourceRootError> |
fn logical_ref(source_root : Option <& str>, relative : & str) -> Result <String, SourceRootError> |
SourceRootRegistry
Logical source references: @hooks-rs/src/ruleset.rs means "the path
| Item |
|---|
pub struct SourceRootRegistry |
SourceRootRegistry :: fn from_rows <I, S, P>(rows : I) -> Result <Self, SourceRootError> where I : IntoIterator <Item =(S, P)>, S : AsRef <str>, P : AsRef <Path>, |
SourceRootRegistry :: fn is_registered(& self, name : & str) -> bool |
SourceRootRegistry :: fn physical_root(& self, name : & str) -> Option <& Path> |
SourceRootRegistry :: fn resolve(& self, stored : & str, workspace_root : & Path) -> Result <PathBuf, SourceRootError> |
How to use it
No examples/ target and no doctest in this crate's rustdoc. The tests listed under Verification are the closest executable usage.
Module structure
No public modules: the crate root is its whole surface.
Public surface
`crate root`
| Item | What it is |
|---|---|
pub const SIGIL: char | Marks a logical source reference |
pub enum SourceRootError | — |
fn validate_name(name : & str) -> Result <(), SourceRootError> | A source-root name is an identity, so it is spelled like one: the same shape capability.capability_key requires, minus the dots |
fn logical_ref(source_root : Option <& str>, relative : & str) -> Result <String, SourceRootError> | The canonical reference for relative within source_root |
fn split_ref(stored : & str) ->(Option <& str>, & str) | Split a stored ref into (source root, relative path) |
fn belongs_to(stored : & str, source_root : Option <& str>) -> bool | True when this stored ref belongs to source_root (None = workspace). |
pub const WORKSPACE_ONLY_SQL: & str | The SQL predicate for "this row is in the workspace namespace", for a query that takes no parameter |
fn scope_predicate(source_root : Option <& str>) ->(& 'static str, Option <String>) | The SQL predicate selecting exactly one namespace's rows, and the value to bind to it |
pub struct SourceRootRegistry | The registered source roots: name → physical root on this machine |
SourceRootRegistry :: fn from_rows <I, S, P>(rows : I) -> Result <Self, SourceRootError> where I : IntoIterator <Item =(S, P)>, S : AsRef <str>, P : AsRef <Path>, | Build from registry rows (datasource.name, datasource.root_path) |
SourceRootRegistry :: fn is_registered(& self, name : & str) -> bool | — |
SourceRootRegistry :: fn physical_root(& self, name : & str) -> Option <& Path> | — |
SourceRootRegistry :: fn resolve(& self, stored : & str, workspace_root : & Path) -> Result <PathBuf, SourceRootError> | Turn a stored ref into a path on this machine |
No pub use re-exports: every item above is declared in this crate.
Boundary
Depends on no other workspace tier.
Shares tier foundation with 29 other crates: foundation-audit-log, foundation-basemodels, foundation-bounded-io, foundation-conversation-closure, foundation-crypto-sign, foundation-decisioning, foundation-encounter-vocabulary, foundation-fs-metadata, … (29 total).
_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._
Where it sits
| Tier (ontology) | foundation |
| Architectural role (taxonomy) | value_object |
| Location | crates/foundation/source-ref |
| Vocabulary in force (lexicon) | current |
Dependencies
Runtime, from outside the workspace.
| Crate | Requirement | Features | Optional | Only on |
|---|---|---|---|---|
thiserror | ^2 | — | no | always |
Development. None.
Build. None.
Depended on by. 2 workspace crates.
Signal flow — what reaches this crate, and what it reaches.
flowchart LR n_operations_control_plane["operations-control-plane"] -->|uses| SELF n_tools_corpus["tools-corpus"] -->|uses| SELF SELF["foundation-source-ref"] classDef self fill:#1f883d,stroke:#1f883d,color:#fff; class SELF self;
Feature flags
No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.
Targets
| Kind | Name | Source |
|---|---|---|
| lib | foundation_source_ref | `src/lib.rs` |
Error model
| Error type | Named by |
|---|---|
SourceRootError | logical_ref, validate_name |
Operational characteristics
| Property | Evidence |
|---|---|
| async public surface | none detected |
| async runtime | none detected |
| database access | none detected |
| network I/O | none detected |
| unsafe code | none detected |
| environment variables | none detected |
No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.
Configuration
No environment variable is read with a literal name anywhere in this crate. A variable whose key is computed at run time cannot be listed here, and is not claimed to be absent.
Related capabilities
2 workspace crates depend on this one: operations-control-plane, tools-corpus.
Verification
| Kind | Count |
|---|---|
| Unit tests | 9 |
| Integration tests | 0 |
| Examples | 0 |
| Doctests | 0 |
Evidence by module. How often each public module is named by something executable.
| Module | Tests | Examples | Consumers |
|---|---|---|---|
crate root | 9 | 0 | 8 |
What the tests establish, by name:
a_name_is_an_identity_and_is_spelled_like_one—src/lib.rsa_ref_cannot_climb_out_of_its_registered_root—src/lib.rsa_scope_selects_one_namespace_and_only_that_one—src/lib.rsa_workspace_ref_keeps_its_bare_path—src/lib.rsan_at_sign_that_is_not_a_namespace_stays_opaque—src/lib.rsan_external_root_ref_carries_its_namespace—src/lib.rsan_unregistered_root_refuses_rather_than_guessing_a_location—src/lib.rsresolving_is_the_only_road_from_a_logical_ref_to_a_file—src/lib.rsthe_same_relative_path_under_two_roots_is_two_identities—src/lib.rs
Documentation coverage
| Measure | Documented | Total |
|---|---|---|
| Public items with rustdoc | 10 | 13 |
Public modules with a //! block | 0 | 0 |
pie showData
title Public items with rustdoc
"Documented" : 10
"No rustdoc detected" : 3
Metrics
| Metric | Value |
|---|---|
| Rust source files | 1 |
| Source lines | 349 |
| Code lines | 221 |
| Public API items | 13 |
| Public modules | 0 |
| Tests | 9 |
| Examples | 0 |
| Cargo features | 0 |
| Direct runtime dependencies | 1 |
| Workspace reverse dependencies | 2 |
pie showData
title Public API by kind
"constant" : 2
"enum" : 1
"function" : 5
"method" : 4
"struct" : 1
pie showData
title Rust source composition
"Code" : 221
"Blank or comment" : 128
Generation
Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.