Enum AphError 

pub enum AphError {
    InvalidEnvelopeSignature,
    InvalidFlowTransition {
        from: String,
        to: String,
    },
    MandateExpired {
        mandate_id: String,
    },
    RoleViolation {
        role: String,
        operation: String,
    },
    ChannelNotAllowed {
        channel: String,
    },
    NotarySignatureInvalid,
    HumanAuthenticationRequired,
    NotaryServiceUnreachable,
    EnvelopeBodyHashMismatch {
        expected: String,
        actual: String,
    },
    UnsupportedAlgorithm {
        alg: String,
    },
    PrincipalSignatureInvalid,
    AttestationModeRefused {
        required: String,
        actual: String,
    },
    ProofChainInvalid {
        reason: String,
    },
    NotaryKeyNotPublished {
        surface: String,
    },
    MandateRevoked {
        mandate_id: String,
    },
}

APH protocol error with structured codes and suggestions.

Variants

InvalidEnvelopeSignature

APH_E001 — the envelope’s proof.proofValue did not verify against the notary’s public key over the canonical form.

InvalidFlowTransition

APH_E002 — a notarization flow was driven along an edge the state machine does not define.

Fields

from: String

State the flow was in.

to: String

State the caller attempted to move to.

MandateExpired

APH_E003 — the referenced mandate is outside its validity window.

Fields

mandate_id: String

Identifier of the expired mandate.

RoleViolation

APH_E004 — a party attempted an operation its role does not permit under the §5 permission matrix.

Fields

role: String

Role of the party that made the attempt.

operation: String

Operation that was attempted.

ChannelNotAllowed

APH_E005 — the channel is not listed in the delegation mandate’s allowedChannels.

Fields

channel: String

Channel kind that fell outside the granted scope.

NotarySignatureInvalid

APH_E006 — a mandate’s notarySignature did not verify (distinct from APH_E001, which covers the envelope-level proof).

HumanAuthenticationRequired

APH_E007 — the operation requires a human decision that has not been obtained.

NotaryServiceUnreachable

APH_E008 — a protocol-mandated fetch from a notary-hosted surface did not succeed, so no decision could be made either way: the service itself could not be reached, or a document it is contracted to serve could not be reached, parsed, or validated — a DID Document (spec §8.4.4) or a revocation status list credential (spec §6.3.3.4 case 2, which folds TLS, parse, proof, issuer, purpose and freshness failures into this one code because the verifier’s action and the operator’s remedy are identical in all of them; log the specific cause, do not mint a code for it). Distinct from APH_E014, which means the surface ANSWERED and published nothing.

EnvelopeBodyHashMismatch

APH_E009 — the delivered body does not hash to the value the envelope attests, indicating tampering or a mismatched payload.

Fields

expected: String

Hash recorded in communication.bodySha256.

actual: String

Hash recomputed over the received body.

UnsupportedAlgorithm

APH_E010 — the declared algorithm is outside the allow-list (ES256, EdDSA); alg: none is always rejected here.

Fields

alg: String

The rejected algorithm identifier.

PrincipalSignatureInvalid

APH_E011 — a signature made by the HUMAN’s key did not verify: the principal proof of a chain, or an embedded delegation mandate’s principalSignature. Deliberately distinct from APH_E001 and APH_E006, which are both NOTARY signatures — conflating them would report a forged authorization as a notary misconfiguration.

AttestationModeRefused

APH_E012 — the verifier requires PrincipalSigned and the envelope is NotaryAttested. Not a defect in the envelope: a refusal to accept the weaker claim, which the spec forbids doing silently.

Fields

required: String

The mode the verifier’s policy demands.

actual: String

The mode the envelope actually declares.

ProofChainInvalid

APH_E013 — the proof chain is malformed: wrong length, wrong proofPurpose for a position, or a previousProof that is missing, dangling, duplicated, or cyclic.

Fields

reason: String

What specifically is wrong with the chain.

NotaryKeyNotPublished

APH_E014 — no notary key is published at the queried discovery surface: the DNS TXT name carries no APH record (or none matching the named kid), or a fetched DID Document names no key under the queried fragment. Deliberately distinct from APH_E008, which means the surface could not be REACHED: §8.4.6’s no-downgrade rule turns on exactly this distinction — absence advances the fallback sequence, failure must stop it — and a taxonomy that flattens the two forces every consumer’s error surface to flatten them again.

Fields

surface: String

Which discovery surface answered “nothing is published here”.

MandateRevoked

APH_E015 — the parent delegation mandate’s bit is SET in the revocation status list its issuing notary publishes (spec §6.3.3): the human withdrew the standing authority this envelope was issued under. The signatures are still valid — this is a WITHDRAWN authorization, not a forged one, so reporting it as a signature failure would send an operator to inspect key material when the answer is a human decision. Deliberately distinct from APH_E003, which is authority that ran out on schedule rather than authority that was pulled.

Carries the mandate id alone, mirroring APH_E003: the revocation timestamp lives in the notary’s status state, not in the refusal.

Fields

mandate_id: String

Identifier of the revoked delegation mandate.

Implementations

impl AphError

pub fn code(&self) -> &'static str

Returns the APH error code string (e.g., "APH_E001").

pub fn suggestion(&self) -> &'static str

Returns a human-readable suggestion for resolving this error.

pub fn invalid_flow_transition( from: impl Into<String>, to: impl Into<String>, ) -> Self

Builds an APH_E002 naming the illegal edge that was attempted.

pub fn mandate_expired(mandate_id: impl Into<String>) -> Self

Builds an APH_E003 naming the expired mandate.

pub fn notary_key_not_published(surface: impl Into<String>) -> Self

Builds an APH_E014 naming the surface that published nothing.

pub fn role_violation( role: impl Into<String>, operation: impl Into<String>, ) -> Self

Builds an APH_E004 naming the role and the denied operation.

pub fn channel_not_allowed(channel: impl Into<String>) -> Self

Builds an APH_E005 naming the out-of-scope channel.

pub fn envelope_body_hash_mismatch( expected: impl Into<String>, actual: impl Into<String>, ) -> Self

Builds an APH_E009 carrying both the attested and the recomputed hash so an investigator can tell which side diverged.

pub fn unsupported_algorithm(alg: impl Into<String>) -> Self

Builds an APH_E010 naming the rejected algorithm.

pub fn attestation_mode_refused( required: impl Into<String>, actual: impl Into<String>, ) -> Self

Builds an APH_E012 recording both modes, so an operator can see what was demanded and what arrived without re-parsing the envelope.

pub fn proof_chain_invalid(reason: impl Into<String>) -> Self

Builds an APH_E013 naming what is wrong with the chain.

pub fn mandate_revoked(mandate_id: impl Into<String>) -> Self

Builds an APH_E015 naming the revoked delegation mandate.

Trait Implementations

impl Clone for AphError

fn clone(&self) -> AphError

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AphError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for AphError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for AphError

impl Error for AphError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl PartialEq for AphError

fn eq(&self, other: &AphError) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for AphError