Module remediation 

Machine-readable remediation hints for a denial (#459).

DenialContext (ADR-0023) says what was refused. It does not say what to do about it, and until now the only place that did was CLI text — the = help: block from #443. An agent driving doiget over MCP, or a CI job reading batch --json, got the refusal and nothing else.

That gap has a concrete cost. A hybrid-OA paper whose only free copy sits in a university repository is refused with redirect_not_in_allowlist, and is fetchable after one line of config — either the host, or the trust_academic_repos flag that already knows about *.ac.uk. An agent that cannot find that line reports “this paper is not available”, which is false.

So the hints live here, in core, computed once and rendered by every surface. The CLI’s = help: block, the MCP envelope and the batch --json record all read the same Remediation list; #454 is the recent lesson about what happens when two surfaces each keep their own copy of a rule.

Structs

Remediation

One suggested change, with the reason it is being suggested.

Enums

RemediationKind

What kind of change would lift this denial.

Functions

for_denial

Suggestions that would lift denial, most specific first.

trust_flag_for_host

The [network] trust flag that already covers host, if any.

widening_suggestions

Widening suggestions for a refused host, most specific first (#443).