Crate affidavit 

affidavit — The Provenance Layer

affidavit is a high-assurance provenance engine that assembles and certifies provenance receipts: append-only, content-addressed chains of operation-events.

Philosophy: Certify, Don’t Decide

The core doctrine of affidavit is that the verifier never decides whether a process is “honest” or “correct” — those questions are often undecidable. Instead, it checks a witness (the receipt) against a fixed format standard. Every check in the pipeline is decidable, providing a mathematical guarantee of structural and cryptographic integrity.

Key Concepts

• Receipt: An immutable, append-only BLAKE3 chain of operation-events.
• Operation-Event: A discrete record of a process action, including logical sequence numbers and commitments to payloads.
• Certify Pipeline: A 7-stage decidable process that validates receipts from raw bytes to a final verdict.
• Unconstructable Bypass: The library uses the “Seal” pattern to ensure that valid receipts can only be constructed through canonical, auditable seams.

Quick Start

use affidavit::chain::ChainAssembler;
use affidavit::ocel::{build_event, object_ref, SeqCounter};
use affidavit::verifier::verify;

// Build a receipt by appending events.
let mut assembler = ChainAssembler::new();
let mut counter = SeqCounter::new();
let event = build_event(
    "build",
    vec![object_ref("repo", "git")],
    b"payload data",
    &mut counter,
)
.expect("event is well-formed");
assembler.append(event).expect("event admitted");

// Finalize the receipt (produces an immutable, sealed chain).
let receipt = assembler.finalize();

// Verify the receipt against the core standard.
let verdict = verify(&receipt);
assert!(verdict.accepted);

Integrated Verticals

Quality & Monitoring: Real-time statistical process control (Western Electric rules) via quality.

SBOM & Supply Chain: Software Bill of Materials generation, compliance checking (NTIA), and vulnerability aggregation via sbom, sbom_compliance, sbom_vulnerability.

Object-Centric Event Logs: OCEL integration and conversion via ocel.

Feature Flags

• default: Includes the core library and standard profiles.
• discovery: Enables type schema discovery and introspection.
• lsp: Exposes LSP diagnostics for receipt verification.
• predictive: Enables predictive analysis and trend forecasting.
• advanced-crypto: The advanced witness capability set (hand-written consumer modules). Individually: smt (sparse Merkle tree inclusion and absence proofs + the SMT-backed authority_fence), threshold-quorum (FROST t-of-n), zk-range (bulletproofs bounded metrics), causal-graph (Tarjan cycle refusal), jcs (RFC 8785 canonical bytes), binary-envelope (postcard), ed25519, secp256k1 (BIP-340/ECDSA verification), bls (BLS12-381 non-interactive committee aggregation), replay-filter (cuckoo screen), seq-bitmap (roaring contiguity), hlc (in-tree hybrid logical clocks), iso8601 (canonical timestamps), zero-copy (rkyv archives), wasm-court (fuel-bounded wasmtime sandbox), policy-cedar (Lean-verified Cedar gate).

Errors

Most operations return a crate::error::AffidavitError which encapsulates various failure modes including I/O, serialization, and cryptographic mismatches.

Examples

For a full end-to-end example of the provenance pipeline, see examples/full_pipeline.rs.

Panics

This crate is designed to be panic-free in production paths. Invariant checks that could lead to panics are isolated to unreachable code branches or explicit boundary checks.

Re-exports

pub use architecture::ArchitectureQualificationReceipt;

pub use architecture::ArchitectureRefusal;

pub use architecture::ArchitectureStanding;

pub use architecture::ArchitectureStandingLedger;

pub use architecture::EvidenceSource;

pub use architecture::QualificationEvidence;

pub use architecture::Supersession;

pub use architecture::ARCHITECTURE_QUERY_SCHEMA;

pub use architecture::ARCHITECTURE_RECEIPT_SCHEMA;

pub use ecosystem::certify_ecosystem;

pub use ecosystem::EcosystemMember;

pub use ecosystem::EcosystemObservation;

pub use ecosystem::EcosystemReceipt;

pub use ecosystem::EcosystemRefusal;

pub use ecosystem::EcosystemRole;

pub use ecosystem::RoleCoverage;

pub use ecosystem::RoleRequirement;

pub use ecosystem::ECOSYSTEM_AUTHORITY_CEILING;

pub use ecosystem::ECOSYSTEM_CLAIM_CEILING;

pub use ecosystem::ECOSYSTEM_PROFILE;

pub use errc::certify_errc;

pub use errc::ErrcClaim;

pub use errc::ErrcMeasure;

pub use errc::ErrcObservation;

pub use errc::ErrcQuadrant;

pub use errc::ErrcReceipt;

pub use errc::ErrcRefusal;

pub use errc::ErrcSource;

pub use errc::PreservedInvariant;

pub use errc::QuadrantCounts;

pub use errc::ERRC_CLAIM_CEILING;

pub use errc::ERRC_PROFILE;

pub use errc::ERRC_SOURCE_ARTIFACT;

pub use errc::ERRC_SOURCE_COMMIT;

pub use errc::ERRC_SOURCE_REPOSITORY;

pub use errc_claim_assurance::certify_errc_claim_assurance;

pub use errc_claim_assurance::ErrcClaimAssuranceReceipt;

pub use errc_claim_assurance::ErrcClaimAssuranceRefusal;

pub use errc_claim_assurance::ErrcClaimWitness;

pub use errc_claim_assurance::ERRC_CLAIM_ASSURANCE_CEILING;

pub use errc_claim_assurance::ERRC_CLAIM_ASSURANCE_PROFILE;

pub use errc_claim_assurance::ERRC_CLAIM_ASSURANCE_SOURCE_ARTIFACT;

pub use error::AffidavitError;

pub use federation::CourtOutcome;

pub use federation::STANDING_CAPABILITY;

pub use federation::STANDING_CAPABILITY_DIGEST;

pub use standing::certify_standing;

pub use standing::AuthorityBinding;

pub use standing::ExecutionEvidence;

pub use standing::ReplayEvidence;

pub use standing::Standing;

pub use standing::StandingObservation;

pub use standing::StandingReceipt;

pub use standing::StandingRefusal;

pub use standing::SubjectIdentity;

pub use standing::VerificationEvidence;

pub use standing::STANDING_PROFILE;

pub use types::canonical_bytes;

pub use types::Blake3Hash;

pub use types::CheckOutcome;

pub use types::ObjectRef;

pub use types::OperationEvent;

pub use types::ProfileId;

pub use types::Receipt;

pub use types::Verdict;

Modules

admission

Admission gate: the Layer 2 seam where the structural law decides whether a receipt may become Admitted.

architecture

Deterministic enterprise-architecture qualification standing.

bench

COMBINATORIAL MAXIMALISM: Benchmarking Core

brce

BRCE receipt ledger and zero-unreceipted-actuation court.

catalog

Logic for the affi receipt catalog verb (Feature 1.4).

chain

Receipt assembly: append events, compute the rolling BLAKE3 chain hash, serialize and deserialize receipts.

cli

Command implementations for the affi CLI: emit, assemble, verify, show.

dfcm

Working-backwards Design for Combinatorial Maximalism release closure.

diag

Stable error codes, diagnostic types, and exit-code catalog.

diff

Core diffing logic for affi receipt diff (Micro-Task 1.2).

doctor_check

DoctorCheck framework — linkme-based registry of environment health checks.

ecosystem

Cross-repository evidence federation for the Chatman ecosystem.

errc

Formal ERRC reconstruction receipts.

errc_claim_assurance

Claim-assurance refinement for formal ERRC receipts.

error

Error types for the Affidavit provenance layer.

event_builder

Type-safe builder for OperationEvent — the preferred public API for constructing events before appending them to a chain.

execution_manifest

Immutable execution-manifest binding for consequence receipts.

federation

Federation courts — the reachable CLI surface over the v26.9.x evidence federation kernel.

fixture_db

COMBINATORIAL MAXIMALISM: Feature 3.5 — Test Fixture Database

gall

GALL-007 evidence-only twelve-gate Chicago crown certification. GALL evidence-only Chicago standing crown.

handlers

Consumer-side handlers behind the delegation seam.

mining

COMBINATORIAL MAXIMALISM: Feature 2.1 (Model Logic)

model_mining

COMBINATORIAL MAXIMALISM: Feature 2.1 (Model Logic)

ocel

OCEL event/object/relationship model + builders.

output

The Out handle — a single, testable output abstraction.

portable_protocol

Structural verification for foreign portable-consequence receipts.

quality

Code quality measurement and Western Electric statistical process control.

quality_correlation

Multi-dimensional quality metric correlation detection.

quality_extended

Extended Western Electric statistical process control rules.

quality_object_level

Fine-grained quality metrics at file, module, and package levels.

quality_ocel

OCEL (Object-Centric Event Logs) integration for quality monitoring.

registry

Verb Registry — Single Source of Truth for All 100 Verbs

replay_nullifier

Replay nullifier calculation and double-spend detection for CTRT receipts.

sbom

Software Bill of Materials (SBOM) — canonical model and multi-format ingest.

sbom_artifacts

SBOM artifact collection and forensics bundle creation

sbom_compliance

Supply-chain COMPLIANCE gates over a canonical SBOM.

sbom_ocel

OCEL (Object-Centric Event Logs) integration for SBOM supply-chain provenance.

sbom_supply_chain

Supply-chain graph analytics and provenance over a canonical Sbom.

sbom_vulnerability

Vulnerability and VEX correlation over a canonical SBOM.

standing

Receipt-bound standing certification for the Chatman ecosystem.

tracing

Operation span recording for the affidavit pipeline.

trajectory_folding

Trajectory folding: associative binary operator (R_A ⊕ R_B) over 352-byte CTRT receipts.

types

Shared interface contract for the Provenance Layer.

verbs

Rendered verb modules.

verifier

The 7-stage certify pipeline returning a Verdict with per-stage outcomes.

visualize

Logic for building a graph representation of a receipt and exporting it to Graphviz DOT or JSON formats.

wire_ctrt

Strict 352-byte CTRT (Court Receipt Token) binary wire format.

Macros

emit

High-level macro for recording process events with stable sequence numbers.

Functions

run

Main entry point for the affi CLI application.