[
 ["marker", "marker_is_owner_prefixed_lowercase_hex_bound_to_the_binder_path",
  "Sha256::digest(binder.as_os_str().as_bytes())",
  "Sha256::digest(b\"\")"],
 ["owned", "owned_accepts_only_this_versions_full_lowercase_hex_identity",
  "digest.len() == 64",
  "digest.len() >= 63"],
 ["ufw_scope", "ufw_scope_accepts_only_unrestricted_single_tcp_port_allowances",
  "        .filter(|port| *port != 0)\n        .ok_or_else(|| format!(\"owned UFW rule {} is not a single TCP port",
  "        .ok_or_else(|| format!(\"owned UFW rule {} is not a single TCP port"],
 ["identifier", "identifier_matches_nfts_unquoted_name_grammar",
  "(index > 0 && c.is_ascii_digit())",
  "(index < 99 && c.is_ascii_digit())"],
 ["nft_input", "nft_input_requires_exactly_one_unrestricted_inet_filter_input_chain",
  " || chain.get(\"dev\").is_some()",
  ""],
 ["nft_owned", "nft_owned_collects_only_exactly_shaped_owned_tcp_accepts",
  "        if !comment.starts_with(OWNER) {\n            continue;\n        }",
  "        if !comment.starts_with(OWNER) && false {\n            continue;\n        }"],
 ["reconcile", "reconcile_refuses_port_zero_before_touching_any_host_firewall",
  "requires the actual nonzero bound TCP port",
  "requires the actual bound TCP port"],
 ["backend_from", "backend_from_ranks_an_active_manager_above_the_backend_it_writes_into",
  "    if ufw {\n        Ok(Backend::Ufw)\n    } else if firewalld {\n        Ok(Backend::Firewalld)\n",
  "    if firewalld {\n        Ok(Backend::Firewalld)\n    } else if ufw {\n        Ok(Backend::Ufw)\n"],
 ["parse_ufw_rules", "parse_ufw_rules_reads_a_numbered_listing_and_refuses_every_other_shape",
  "    if !text.lines().any(|line| line.trim() == \"Status: active\") {\n        return Err(\"UFW is inactive or its numbered rule listing is unrecognized\".into());\n    }\n",
  ""],
 ["ufw_preflight", "ufw_preflight_never_adopts_a_rule_it_does_not_own",
  "destination == port.to_string() || destination == format!(\"{port}/tcp\")",
  "false"]
]