agent_mesh_protocol/
error.rs

1//! Crate-wide error type for `agent-mesh-protocol`.
2//!
3//! Every fallible operation in this crate returns [`Result<T>`] (an
4//! alias for `Result<T, MeshError>`). The variants are deliberately
5//! coarse — they cover *what* went wrong well enough that the CLI can
6//! print a useful message, without forcing every caller to enumerate
7//! a giant matrix of internal failure modes.
8
9use thiserror::Error;
10
11/// Errors that can arise from agent-mesh primitives.
12#[derive(Debug, Error)]
13pub enum MeshError {
14    /// Underlying I/O failure (file read/write, permission, etc.).
15    #[error("io error: {0}")]
16    Io(#[from] std::io::Error),
17
18    /// A key blob (private or public) was malformed or rejected by
19    /// the underlying crypto library.
20    #[error("invalid key format: {0}")]
21    InvalidKey(String),
22
23    /// An ed25519 signature failed to verify against its claimed key
24    /// and message.
25    #[error("signature verification failed")]
26    BadSignature,
27
28    /// A cert chain was structurally valid but semantically wrong —
29    /// e.g. the user pubkey didn't sign the embedded metadata.
30    #[error("invalid cert chain: {0}")]
31    InvalidCertChain(String),
32
33    /// A delegated agent's caveats are not `⊑` its parent's — delegation is
34    /// attenuation-only, so a child may never grant more authority than the
35    /// parent it chains to.
36    #[error(
37        "caveat amplification: a delegated agent may not grant more authority than its parent"
38    )]
39    CaveatAmplification,
40
41    /// A cert's causal-generation scope could not be honoured (§9.1). Either it
42    /// was verified context-free (`verify()`) while declaring a *bounded*
43    /// `valid_for_generation` — which cannot be checked without a current
44    /// generation, so it is refused rather than ignored (fail-closed) — or its
45    /// scope does not include the supplied generation. Causal generation is the
46    /// authoritative revocation axis (wall-clock is not).
47    #[error("generation: {0}")]
48    Generation(String),
49
50    /// A credential or envelope was rejected because it claims an
51    /// expired validity window.
52    #[error("expired: {0}")]
53    Expired(String),
54
55    /// A wire envelope was structurally malformed (wrong shape, wrong
56    /// CID, missing fields).
57    #[error("malformed envelope: {0}")]
58    MalformedEnvelope(String),
59
60    /// A duplicate nonce was observed (replay detection).
61    #[error("replay detected: nonce already seen")]
62    Replay,
63
64    /// An envelope arrived with the wrong sequence number for its
65    /// sender's session.
66    #[error("sequence error: expected {expected}, got {actual}")]
67    BadSequence { expected: u64, actual: u64 },
68
69    /// A serialization/deserialization failure (hex, serde, etc.).
70    #[error("encoding error: {0}")]
71    Encoding(String),
72}
73
74/// Convenience alias for the crate's `Result` type.
75pub type Result<T> = std::result::Result<T, MeshError>;
agent_mesh_protocol/error.rs

agent_mesh_protocol/
error.rs
