Module pushed 

Console-pushed policy, layered on top of the local sandbox config.

The console publishes a policy bundle; pvctl console-sync --pull-policies hands it to the daemon, which compiles it into one PushedRules value and swaps it into the running crate::Sandbox. Pushed rules only ever add restrictions:

• budgets are merged with [BudgetSpec::tightened_by], so the stricter cap wins on every dimension;
• allowlist rules run after the local policy chain, so a call must pass both;
• schema rules run after the local schema, so arguments must satisfy both.

A compromised console can therefore block calls the host allows, but it can never let through a call the host’s own config refuses.

Structs

PushedAllowlist

One pushed allowlist policy, limited to the tools its scope names.

PushedRules

Everything the daemon applied from one console bundle.

PushedSchema

One pushed argument schema for one tool.

ToolPattern

A tool-name pattern taken from a policy scope (tool.*, tool.create_payment, tool.payments.*). * matches any run of characters, including none.