* Decide whether a consent marker file is expired. * A marker that cannot be parsed or has an invalid timestamp can never grant * access again (the

* Match a file path against a glob pattern containing **. * ** matches any sequence of path segments (including zero). * Examples: * src/** match

* Match a file path against a scope entry. * Scope entries can be: * - A directory prefix (e.g., "src/auth/") → matches any file under it * - A

* Match no-op vocabulary, returning only "live" hits - those NOT cited under a * negation. A line where every hit is negated carries no disposition d