# M3b task 03: a grant path that cannot be mounted is invalid

**Branch:** `m3b` (run `git switch m3b`; `git status --short` must be empty, otherwise stop)
**Commit subject:** `Refuse grant paths that cannot be mounted`

## Goal

From M3b, a grant's paths are mounted into the tool container as `--volume=<path>:<path>:ro`. In
that argument `:` and `,` are separators, so a path containing either would be read as something
else. A grant with such a path is **invalid**, which (as for every invalid grant) makes the whole
set invalid and denies every call until it is fixed.

## Files

- Copy: `crates/brokerd/tests/grants_mount.rs`
- Modify: `crates/brokerd/src/grants.rs`, `docs/implementer-log.md`

## The rule

In `check_grant`, the loop over `inner.constraints.paths` has two cases today: the path is `/`, or
it is not a valid path. Add a third, checked **only when the first two did not apply** (a path that
is already reported as invalid is not reported twice):

```rust
} else if path.contains([':', ',']) {
    // Mounted as `--volume=<path>:<path>:ro`, where both are separators.
    push(problems, file.clone(), None,
         format!("{:?} cannot be mounted: it contains ':' or ','", path));
}
```

So a grant file with `paths = ["/home/kyle/a:b"]` gives exactly one problem, for that file, whose
text contains `cannot be mounted`. Other punctuation (space, `;`, `=`, `.`, `-`, `_`) stays fine.

## Steps

- [ ] **1. Copy.** `git switch m3b`, then
  `cp docs/plans/M3b/files/crates/brokerd/tests/grants_mount.rs crates/brokerd/tests/`
- [ ] **2. See it fail.** `cargo test -p brokerd --test grants_mount`. Expected: 1 of 2 fails
  (`a_path_with_a_colon_or_a_comma_makes_the_set_invalid`).
- [ ] **3. Add the rule.** Run `cargo fmt --all`.
- [ ] **4. See it pass.** `cargo test -p brokerd --test grants_mount --test grants`. Expected: 2 and
  17 passed.
- [ ] **5. Run the gate.** `make gate`. Expected last line: `gate: ok`.
- [ ] **6. Log and commit.** `git add crates/brokerd docs/implementer-log.md Cargo.lock && git commit`

## Done when

- Both suites pass; `make gate` prints `gate: ok`.

## Stop and report if

- A given test wants a path with `:` or `,` to be accepted, or wants two problems for one path.