Struct Record 

pub struct Record {
    pub body: RecordBody,
    pub prev_hash: Digest,
    pub hash: Digest,
    pub signature: Option<KeySignature>,
    /* private fields */
}

A sealed journal entry: body, chain links, and the bytes that were hashed.

Fields

body: RecordBody

prev_hash: Digest

hash: Digest

signature: Option<KeySignature>

Who wrote it, if the plane was configured to say.

Beside the hash rather than inside the body, and that placement is forced: the signature covers the chain hash, so putting it in the body would make the hash cover the signature that covers the hash.

None is an ordinary state, not a defect — a plane that has not been given a Signer writes unsigned records, and history written before signing was configured stays unsigned forever. What must never happen is a verifier silently accepting that; see Record::verify_signed.

Implementations

impl Record

pub const MAX_RECORD_BYTES: usize

The largest a single journal record may be.

A megabyte is generous for a record describing an effect and far too small for an inlined image, which is the intent: media belongs outside a chain that can never forget it. The number is in the same range the field settled on — Temporal caps payloads at 2 MB and claim-checks above 256 KiB — and is deliberately a hard refusal rather than a truncation, because a silently shortened record is a journal that lies.

Enforced in the step Record::seal_signed and Record::seal_at both end in, so no store can be added that quietly skips it.

pub const MAX_RECORD_DEPTH: usize = 100

The deepest a record’s bytes may nest arrays and objects.

Every reader of a record has a nesting limit, and a record past it is one the chain committed to and no reader can parse: this crate’s (serde_json, 127 levels) on every read and every restore, and the second reader’s (Python’s recursion limit, around 1000). The bound sits under the lowest of them with room for the levels an export line wraps a record in, so a record that seals is a record every reader opens.

Enforced where Record::MAX_RECORD_BYTES is, and for the same reason: refusing at seal is the only moment it is still cheap.

pub fn seal(body: RecordBody, prev_hash: Digest) -> Result<Self, StoreError>

Serialize canonically and link into the chain.

pub fn seal_signed( body: RecordBody, prev_hash: Digest, signer: Option<&dyn Signer>, ) -> Result<Self, StoreError>

Seal, and attest it as the given signer.

The signature is taken over the chain hash, which already covers prev_hash ‖ canonical(body). Because the hash chains, this signature transitively commits to every record before this one — so rewriting any part of the prefix invalidates every later signature, not just its own.

pub fn seal_at( body: RecordBody, written: Option<Vec<u8>>, prev_hash: Digest, signer: Option<&dyn Signer>, ) -> Result<Self, StoreError>

Seal at the position a store assigned, keeping the written bytes when the append carries them.

With no written bytes this is Record::seal_signed. With them — a restore — the bytes are hashed against prev_hash as they stand and the body is the store’s index view of them, so they must name the position the store assigned: bytes claiming another seq, epoch or run would land a record under a chain position its own body contradicts.

Errors

StoreError::Corrupt for written bytes that name another position, StoreError::RecordTooLarge above the limit, and whatever Record::seal_signed refuses.

pub fn from_stored_signed( raw: Vec<u8>, prev_hash: Digest, hash: Digest, signature: Option<KeySignature>, ) -> Result<Self, StoreError>

Reconstruct from storage, verifying the link before trusting the content, and carrying whatever signature the store kept.

The body is decoded from raw; the hash is recomputed from raw. A record whose stored hash disagrees is rejected rather than returned with a warning — a journal you cannot trust is worse than no journal, because it produces an audit trail that is quietly a lie.

Reads under the Identity upcaster — this build’s shapes and no others. A store that carries a real upcaster calls from_stored_with instead.

pub fn from_stored_with( upcaster: &dyn Upcaster, raw: Vec<u8>, prev_hash: Digest, hash: Digest, signature: Option<KeySignature>, ) -> Result<Self, StoreError>

Reconstruct, lifting the record forward if it was written at an older shape.

The version is checked on every read, not only when something looks wrong. A record carries v, and a reader that writes it and never reads it back has a version field for decoration: a journal written by a build one shape ahead parses cleanly here, with the fields this build has never heard of dropped on the floor, and every decision downstream is then made over a record nobody fully read. So the version is the first thing asked about the parsed body, and the answer comes from the Upcaster rather than from a constant — which is what makes the seam a live path rather than a declaration waiting for its first migration to also be its first exercise.

The hash stays over the bytes that were written. An upcast produces a body this build understands and leaves raw and hash alone, so tamper evidence is unaffected by the reader’s age — the rule Upcaster states, enforced here by construction because the lift happens after the link is verified and never touches the bytes.

Errors

StoreError::Corrupt if the stored hash does not cover the bytes, StoreError::UnknownRecordVersion if no upcaster can reach this build’s shape from the one on the record, StoreError::UnreadableRecordShape if the record is at the version this build writes and still does not parse — the skew a hard cut produces — and StoreError::Encoding if the bytes are not a record at all.

pub fn raw(&self) -> &[u8]

The exact bytes covered by Self::hash.

pub fn seq(&self) -> Seq

pub fn kind(&self) -> &RecordKind

pub fn effect_key(&self) -> Option<EffectKey>

pub fn admission_source(&self) -> Option<&str>

The producer whose origin_key admitted this run — the key’s source half — when this is the admission record and its key was built that way.

What a served surface asks before it reads or acts on a run it is addressed by id: the source is the authenticated sender the surface keyed the admission with, so it answers “whose run is this” from a field the run already carries.

pub fn admitted_input(&self) -> Option<Tainted<Value>>

The input a run was admitted with, label and field labels and all — what the run’s steps read, live and in replay. None for every other record.

pub fn verify_chain( records: &[Self], from: Digest, ) -> Result<Digest, StoreError>

Verify a contiguous run of records links correctly.

Checks both the chain and the sequence: a gap means records were deleted, which the per-record hash alone would not catch.

pub fn verify_signed( records: &[Self], from: Digest, verifier: &dyn Verifier, require_signature: bool, ) -> Result<Digest, StoreError>

Verify the chain and that a known key signed every record.

Two separate questions, deliberately answered by two separate calls. The chain says the records are consistent with each other; the signatures say who wrote them. A caller that only runs Self::verify_chain is asking the weaker question, and the runtime does exactly that when it replays a run (a store’s read checks less still: each record’s hash against its own bytes, not the links between records) — because a plane without a configured verifier has no basis to reject anything, and failing closed there would make signing impossible to adopt incrementally.

require_signature is what stops that leniency becoming a hole. With it set, an unsigned record is a failure rather than a shrug — which is the posture an auditor wants, and the opposite of the one a plane resuming its own history wants.

Errors

StoreError::Corrupt if the chain is broken, or SignatureError as a corrupt-record detail if a signature is missing or wrong.

Trait Implementations

impl Clone for Record

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Record

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for Record

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Record