AcceptedRisk

A risk the host has explicitly acknowledged: a warning `code` it accepts, the `reason` that makes the acceptance honest (mandatory — accepting a risk without saying why silences it, and a silenced warning is exactly what `acceptedRisks` exists to prevent), and an optional `expires` date after which the acceptance no longer applies. The engine keeps an accepted warning visible in the report and, when it has not expired, does not let it degrade the status; the caller supplies the clock (`ResolutionInput::$evaluatedAt`) so expiry is evaluated deterministically, never against an ambient wall clock. A date-only `expires` means 00:00 UTC of that day — the acceptance is void the moment the named day begins (failing toward visibility); the acceptance still holds at the exact expiry instant (the comparison is strict). A pure value object: {@see fromArray()} validates, {@see toArray()} serializes.

public function __construct(string $code, string $reason, ?string $expires = null):

Parameters

Throws

InvalidManifestException When `expires` is present but not a valid ISO-8601 date (validated on EVERY construction path — a relative expression like "now" reaching the engine would read the wall clock and break purity).

public static function fromArray(array $data): self

Build an accepted risk from a decoded array. `reason` is required — its absence is a hard error that teaches why (acceptance without a reason is silencing); `expires`, when present, must be a parseable ISO-8601 date.

Parameters

Throws

InvalidManifestException When `code` or `reason` is missing/empty, or `expires` is not ISO-8601.

public function toArray(): array

Serialize to an array with a fixed, deterministic key order; `expires` is always present (null when the acceptance does not lapse) so consumers never guard for its existence.