Enum CommitVerdict 

pub enum CommitVerdict {
    Valid {
        signer_did: String,
        root_did: String,
        duplicitous_root: bool,
        as_of: u128,
        freshness: Freshness,
    },
    Unsigned,
    SshSignatureInvalid,
    GpgUnsupported,
    DeviceKelInvalid(String),
    RootKelInvalid(String),
    RootNotPinned(String),
    RootAbandoned,
    NotDelegatedByClaimedRoot {
        device_did: String,
        root_did: String,
    },
    DelegationSealNotFound,
    DeviceRevoked,
    SignedAfterRevocation {
        signer_did: String,
        signed_at: u128,
        revoked_at: u128,
    },
    OutsideAgentScope {
        signer_did: String,
        capability: String,
    },
    AgentExpired {
        signer_did: String,
        expired_at: i64,
        signed_at: i64,
    },
    SignerKeyMismatch,
    SignedBySupersededKey,
    WitnessQuorumNotMet {
        root_did: String,
        collected: usize,
        required: usize,
    },
}

The outcome of KEL-native commit verification. Distinguishable so the CLI/UX can explain why a commit failed (never a generic InvalidSignature).

Variants

Valid

Authorized: the signer is a non-revoked delegate of a pinned root (or the pinned root itself) and the SSH signature matches its current key.

Fields

signer_did: String

The verified signer did:keri:.

root_did: String

The root did:keri: it chains to.

duplicitous_root: bool

True if the root KEL shows a fork (non-fatal warning — trust-on-first-sight).

as_of: u128

The signer-KEL tip sequence this verdict was decided against.

freshness: Freshness

How fresh this verdict is under the verifier’s freshness policy (ADR 009). The positional verifier sets Unknown; a caller with a freshness signal upgrades it via CommitVerdict::with_freshness.

Unsigned

The commit carries no SSH signature.

SshSignatureInvalid

The SSH signature did not validate (tampered commit, wrong namespace, or bad sig).

GpgUnsupported

A PGP-signed commit (out of scope).

DeviceKelInvalid(String)

The signer’s device KEL failed to replay/validate.

RootKelInvalid(String)

The root KEL failed to replay/validate.

RootNotPinned(String)

The root identity is not in the pinned trusted-root set (.auths/roots).

RootAbandoned

The root identity’s KEL is abandoned.

NotDelegatedByClaimedRoot

The device is not delegated by the claimed/pinned root.

Fields

device_did: String

The device’s did:keri:.

root_did: String

The root we verified against.

DelegationSealNotFound

The root never anchored the device’s delegated inception.

DeviceRevoked

The root has revoked this device/agent’s delegation and the commit carries no in-band signing position, so it cannot be ordered against the revocation (conservative flat rejection — preserves the no-position default).

SignedAfterRevocation

The commit was signed at or after the delegator anchored the revocation (its in-band Auths-Anchor-Seq is ≥ the revocation’s KEL position). Distinct from CommitVerdict::DeviceRevoked: a commit signed before the revocation stays CommitVerdict::Valid — revocation is ordered by KEL position, never wall-clock, so legitimate prior history is not retroactively invalidated.

Fields

signer_did: String

The signer’s did:keri:.

signed_at: u128

The signing position claimed in-band (Auths-Anchor-Seq).

revoked_at: u128

The KEL position at which the delegator anchored the revocation.

OutsideAgentScope

The agent signed exercising a capability outside its delegator-anchored scope (the delegator never granted it). Scope is advisory authorization anchored by the delegator (the ACDC upgrade is Epic F).

Fields

signer_did: String

The signer’s did:keri:.

capability: String

The capability the commit claimed that the scope does not grant.

AgentExpired

The agent signed at/after its delegator-anchored expiry. Checked against the signing time via an injected now (no wall-clock in the verifier).

Fields

signer_did: String

The signer’s did:keri:.

expired_at: i64

The expiry instant (Unix epoch seconds) the delegator anchored.

signed_at: i64

The signing time the commit was checked against (injected now).

SignerKeyMismatch

The SSH signer key is not the device’s current key (and not a known prior key).

SignedBySupersededKey

The SSH signer key is a superseded device key (the device rotated since signing).

WitnessQuorumNotMet

Under --require-witnesses, the signer’s root KEL did not reach M-of-N witness quorum for an establishment event (fail-closed).

Fields

root_did: String

The root did:keri: whose KEL is under-quorum.

collected: usize

Distinct valid witness receipts collected.

required: usize

Receipts required by the in-force backer threshold.

Implementations

impl CommitVerdict

pub fn is_valid(&self) -> bool

Whether the commit is authorized (a Valid verdict, regardless of the non-fatal duplicity warning).

pub fn freshness(&self) -> Freshness

This verdict’s freshness (ADR 009). Only meaningful for Valid; a non-Valid verdict reports Freshness::Stale since it is never trusted regardless.

pub fn as_of(&self) -> Option<u128>

The KEL position a Valid verdict was verified as-of (the {as_of, freshness} pair, ADR 009), or None when the verdict is not Valid.

pub fn with_freshness( self, policy: &FreshnessPolicy, evidence: FreshnessEvidence, ) -> Self

Re-classify a Valid verdict’s freshness against a policy and the evidence of a fresher source (a bundle age, or a fresher signer-KEL tip). The positional verifier emits Unknown; the relying party upgrades it here once it has a freshness oracle. A no-op on non-Valid verdicts.

Args:

• policy: the relying party’s freshness policy.
• evidence: what the relying party knows about a source fresher than the slice.

pub fn is_trusted(&self, policy: &FreshnessPolicy) -> bool

Whether this verdict is trusted under a freshness policy: it is Valid, its root KEL is not duplicitous (a fork fails closed — the relying party cannot tell which branch is real), AND its freshness clears the policy. A bare Valid is never trusted without freshness — the relying party’s policy (not the signer) decides the tolerance (ADR 009).

Args:

• policy: the relying party’s freshness policy.

pub fn code(&self) -> &'static str

A stable, machine-readable code for this verdict, suitable for the status field of structured output. Lets a consumer attribute a rejection to its specific cause (e.g. outside-agent-scope) without parsing the human error string. These codes are part of the CLI’s machine contract — keep them stable.

Trait Implementations

impl Clone for CommitVerdict

fn clone(&self) -> CommitVerdict

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CommitVerdict

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for CommitVerdict

impl PartialEq for CommitVerdict

fn eq(&self, other: &CommitVerdict) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for CommitVerdict