Enum AttestLevel 

pub enum AttestLevel {
    Unsigned,
    SelfSigned,
    PeerAttested,
    SignedByPeer,
    DaemonSigned,
}

v0.7 Track H — attestation level for a memory_links row.

H2 (#566) and H3 (#572) already write the three string variants directly into the memory_links.attest_level TEXT column ("unsigned", "self_signed", "peer_attested"). H4 formalises the enum so the memory_verify MCP tool — and any future verifier surface — can reason in terms of a closed set rather than an open-ended string.

#[serde(rename_all = "snake_case")] keeps the wire shape byte- identical to what the database column already holds. The AttestLevel::from_str / AttestLevel::as_str helpers exist because the column is read as a String in many call sites that are not deserialising through serde (e.g. rusqlite::Row::get).

Variants

Unsigned

No signature on the row, or no key enrolled for observed_by on the receiver. Federation back-compat default — unsigned rows still land but downstream consumers know they cannot verify.

SelfSigned

Row was signed locally by this writer (H2 outbound path).

PeerAttested

Row arrived from a peer with a signature that verified against the enrolled observed_by public key on this host (H3 inbound path).

SignedByPeer

v0.7.0 #1389 L4 / RFC-0001 — capture_turn host-signed memory. Distinct from PeerAttested (which is federation H3 inbound): SignedByPeer means an out-of-process HOST supplied a host_signature_b64 + host_pubkey_b64; the substrate verified the signature against AI_MEMORY_L4_HOST_PUBKEY_ALLOWLIST and the canonical-bytes encoding. Used at src/mcp/tools/capture_turn.rs::556. Closes F-C9 spec-drift (#1430).

DaemonSigned

v0.7.0 — daemon-signed governance-audit row. Used by crate::governance::audit::sign_with_daemon_key when a daemon keypair is installed and the substrate emits a Custom-action refusal row to the signed_events chain. Distinct from SelfSigned (H2 link-write outbound) — this variant is the substrate’s OWN signature on its OWN audit emissions, not on content the substrate received from a caller. Closes F-C9 spec-drift (#1430).

Implementations

impl AttestLevel

pub fn from_str(s: &str) -> Option<Self>

Parse the string form stored in memory_links.attest_level / signed_events.attest_level.

Returns None for unknown values so callers can decide whether to treat the column as legacy/unsigned or surface an error. Keeps the unit-of-truth on the database column shape — H2/H3 already write the canonical lowercase snake_case strings. v0.7.0 #1389 L4 + governance-audit additions parse via the signed_by_peer and daemon_signed arms.

pub const fn as_str(&self) -> &'static str

Canonical wire string for this variant. Mirrors the serde rename_all and the literals every writer (H2/H3/L4/governance- audit) already writes to the DB.

Trait Implementations

impl Clone for AttestLevel

fn clone(&self) -> AttestLevel

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for AttestLevel

impl Debug for AttestLevel

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AttestLevel

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for AttestLevel

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for AttestLevel

impl PartialEq for AttestLevel

fn eq(&self, other: &AttestLevel) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for AttestLevel

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for AttestLevel