Struct VerificationPolicy 

pub struct VerificationPolicy {
    pub validate_body_schema: bool,
    pub allow_unknown_status: bool,
    pub receipts: ReceiptPolicy,
    pub historical_keys: HistoricalKeyPolicy,
    pub lineage_head: LineageHeadPolicy,
    pub revocations: RevocationPolicy,
}

Consumer-tunable strictness for VerifiedContext::fetch_with_policy, VerifiedContext::fetch_current_with_policy, and the fetch_report* family (VerifiedContext::fetch_report, VerifiedContext::fetch_report_with_fetcher, VerifiedContext::fetch_report_diagnose). All three surfaces consult the same policy fields through the same verify_retrieved spine — but they do not always agree, because VerifiedContext::fetch_report_diagnose differs in more than just how a failure surfaces:

• VerifiedContext::fetch_report and VerifiedContext::fetch_report_with_fetcher run verify_retrieved directly once their own top-level probes pass, and surface a phase failure as Err.
• VerifiedContext::fetch_report_diagnose runs its own independent, strict, assertionMethod-only signature probe first (recorded as VerificationReport::signature_ok). That probe has no historical-key fallback and runs before verify_retrieved is ever invoked. If it fails, diagnose withholds the VerifiedContext handle with policy_phase_error: None — the spine never ran, so there is no phase error to record — even in cases where verify_retrieved itself, as run by fetch_report, would have accepted the key historically under the default historical_keys: HistoricalKeyPolicy::AcceptWithReceipt plus a verified receipt. Concretely: for a key rotated out of assertionMethod with a valid receipt, fetch_report returns Ok with KeyAuthorization::HistoricallyAuthorized, while diagnose returns no handle at all for the same input and policy. Only once diagnose’s own probes all pass does it fall through to verify_retrieved and, from that point on, withhold the handle / record VerificationReport::policy_phase_error instead of returning Err — that part of the behavior is shared with the other two.

For ACDP v0.1.0 the verification profile is always strict:

• did:web is required for every producer identity — enforced unconditionally by verify_signature_envelope (RFC-ACDP-0001 §5.4), regardless of any policy field.
• Embedded DataRef hashes are verified by acdp_validation::validate_body whenever validate_body_schema is set.

Only the fields below have real effect in this version; there are no relaxed-mode did:web or embedded-hash knobs.

Fields

validate_body_schema: bool

If true, run acdp_validation::validate_body (structural schema checks plus embedded-DataRef hash verification) before any cryptographic check. Default true. Set false only in diagnostic paths that want to attempt signature verification despite a body known to fail structural checks.

The fetch_report* family forces this field off unconditionally on the internal policy it derives from the caller’s — they run validate_body_structural (schema only) themselves and record per-DataRef embedded-hash outcomes in VerificationReport::data_ref_embedded instead of treating a mismatch as fatal. This field’s value as set by the caller is otherwise irrelevant to the report family.

allow_unknown_status: bool

If true, accept Status::Other values (degrade to active per RFC-ACDP-0004 §4.1). When false, reject unknown statuses. Default true.

receipts: ReceiptPolicy

Registry-receipt handling (ACDP 0.2, RFC-ACDP-0010). Default ReceiptPolicy::VerifyIfPresent.

historical_keys: HistoricalKeyPolicy

Historical-key handling (ACDP 0.2, WS-B). Default HistoricalKeyPolicy::AcceptWithReceipt.

lineage_head: LineageHeadPolicy

Lineage-head receipt handling on /current fetches (ACDP 0.3, RFC-ACDP-0011). Only consulted by VerifiedContext::fetch_current_with_policy; plain retrieval preserves any lineage_head_receipt verbatim without verifying it. Default LineageHeadPolicy::default. This is the ONE field on this struct with restricted scope — allow_unknown_status, receipts, historical_keys, and revocations above and below are each honored by every entry point that accepts a VerificationPolicy, including the fetch_report* family.

revocations: RevocationPolicy

Key-revocation handling (ACDP 0.3, RFC-ACDP-0014 §7). Default: no known revocations — the phase is inert.

Implementations

impl VerificationPolicy

pub fn strict_v0_1_0() -> Self

The v0.1.0 strict verification profile (RFC-ACDP-0001 §5.11, §9.2).

Runs the full §5.11 pipeline: body schema validation, content_hash recomputation, did:web key resolution, signature verification, and embedded data_ref.content_hash checks. Returns on the first failure.

This is the only mode covered by the acdp-consumer conformance profile. Relaxed modes (Diagnostic, UnsafeForTests) are NOT available in this crate in v0.1.0 — they would be separately-named opt-ins per §9.2, and are not currently implemented.

NOT identical to Default::default() as of 0.2: the default policy is receipt-aware (VerifyIfPresent + AcceptWithReceipt), while this named profile preserves the exact v0.1.0 semantics — receipts inert (ReceiptPolicy::Ignore) and only assertionMethod keys accepted (HistoricalKeyPolicy::Reject). Callers pinned to this constructor keep v0.1.0 behavior across the 0.2 upgrade.

Trait Implementations

impl Clone for VerificationPolicy

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for VerificationPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for VerificationPolicy

fn default() -> Self

Returns the “default value” for a type.

impl Eq for VerificationPolicy

impl PartialEq for VerificationPolicy

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for VerificationPolicy