Compile-verifier for replicant do sensitive [...] end (surfaced as a Spark
diagnostic; build-blocking under --warnings-as-errors).
Every name in sensitive must resolve to a real encrypted / binary write
target, or be excluded — otherwise the mirror writes the classified column as
plaintext. A name passes if it is any of:
- (a) an AshCloak cloak attribute (
name in AshCloak.Info.cloak_attributes!/1), guarded to resources that actually use AshCloak; - (b) a declared attribute whose storage type is
:binary(Ash.Type.storage_type(type, constraints) == :binary); or - (d) listed in
skip(never written).
Otherwise it fails closed. This checks the TYPE SHAPE, not ciphertext — encrypting is the host resource's (AshCloak's) job. Messages are value-free: they name schema structure (column/attribute names), never a row value.
AshCloak is the single source of truth for encryption: a hand-rolled
encrypted_<name> attribute WITHOUT AshCloak is NOT accepted — there is no
encryptor the verifier can confirm, and AshReplicant.Resolver would mirror
the column as plaintext (it routes to encrypted_<name> only for real AshCloak
cloak attributes), so blessing that shape would leak plaintext.