Enum AttestationSignerPolicy 

#[non_exhaustive]
pub enum AttestationSignerPolicy {
    Predecessor,
    OperatorRoot,
    SelfSigned,
}

Signer policy for AuditReceiptKeyPolicy::attestation.

Each AuditReceiptKeyPolicy entry’s attestation signature binds the inventory entry to some signing authority — but “which authority” is an operator-policy choice the runtime merely records. Three variants cover the expected operator topologies; #[non_exhaustive] lets additive variants land without breaking existing wire bytes.

The enum is paired with AuditReceiptKeyPolicy::attestation at the same struct level — currently no other event references it, so cohesion is preferred over abstraction. If a second user emerges, the enum can be lifted to a shared type with no wire-format change (additive non-breaking refactor).

Copy derive — forward-compat constraint: the derive constrains future variants to be field-less. A variant carrying data (e.g., HardwareAttestation { tpm_version: u32 } or threshold-signature parameters) would require the Copy derive to be removed, which is a breaking API change. Field-less policy reservation is the contract; data-bearing variants would arrive alongside the Copy removal as a coordinated breaking change.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Predecessor

Successor key signed by predecessor key — rotation chain integrity. The recipient verifies the attestation against the predecessor entry’s public_key.

OperatorRoot

Direct signature by an operator-root authority (HW-signed or air-gapped key per docs/release-keys.md §3 co-custody). The recipient verifies against the operator-root public key pinned in the runtime’s release-keys metadata.

SelfSigned

Genesis self-signed proof-of-possession — the signing key signs its own inventory entry. Reserved for the very first inventory entry (no predecessor, no operator-root yet pinned). Recipient verification = fixed-point check against the entry’s own public_key.

Trait Implementations

impl Clone for AttestationSignerPolicy

fn clone(&self) -> AttestationSignerPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AttestationSignerPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AttestationSignerPolicy

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for AttestationSignerPolicy

fn eq(&self, other: &AttestationSignerPolicy) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for AttestationSignerPolicy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Copy for AttestationSignerPolicy

impl Eq for AttestationSignerPolicy

impl StructuralPartialEq for AttestationSignerPolicy