Enum CommitVerdict 

pub enum CommitVerdict {
    Valid {
        signer_did: String,
        root_did: String,
        duplicitous_root: bool,
    },
    Unsigned,
    SshSignatureInvalid,
    GpgUnsupported,
    DeviceKelInvalid(String),
    RootKelInvalid(String),
    RootNotPinned(String),
    RootAbandoned,
    NotDelegatedByClaimedRoot {
        device_did: String,
        root_did: String,
    },
    DelegationSealNotFound,
    DeviceRevoked,
    SignedAfterRevocation {
        signer_did: String,
        signed_at: u128,
        revoked_at: u128,
    },
    OutsideAgentScope {
        signer_did: String,
        capability: String,
    },
    AgentExpired {
        signer_did: String,
        expired_at: i64,
        signed_at: i64,
    },
    SignerKeyMismatch,
    SignedBySupersededKey,
    WitnessQuorumNotMet {
        root_did: String,
        collected: usize,
        required: usize,
    },
}

The outcome of KEL-native commit verification. Distinguishable so the CLI/UX can explain why a commit failed (never a generic InvalidSignature).

Variants

Valid

Authorized: the signer is a non-revoked delegate of a pinned root (or the pinned root itself) and the SSH signature matches its current key.

Fields

signer_did: String

The verified signer did:keri:.

root_did: String

The root did:keri: it chains to.

duplicitous_root: bool

True if the root KEL shows a fork (non-fatal warning — trust-on-first-sight).

Unsigned

The commit carries no SSH signature.

SshSignatureInvalid

The SSH signature did not validate (tampered commit, wrong namespace, or bad sig).

GpgUnsupported

A PGP-signed commit (out of scope).

DeviceKelInvalid(String)

The signer’s device KEL failed to replay/validate.

RootKelInvalid(String)

The root KEL failed to replay/validate.

RootNotPinned(String)

The root identity is not in the pinned trusted-root set (.auths/roots).

RootAbandoned

The root identity’s KEL is abandoned.

NotDelegatedByClaimedRoot

The device is not delegated by the claimed/pinned root.

Fields

device_did: String

The device’s did:keri:.

root_did: String

The root we verified against.

DelegationSealNotFound

The root never anchored the device’s delegated inception.

DeviceRevoked

The root has revoked this device/agent’s delegation and the commit carries no in-band signing position, so it cannot be ordered against the revocation (conservative flat rejection — preserves the no-position default).

SignedAfterRevocation

The commit was signed at or after the delegator anchored the revocation (its in-band Auths-Anchor-Seq is ≥ the revocation’s KEL position). Distinct from CommitVerdict::DeviceRevoked: a commit signed before the revocation stays CommitVerdict::Valid — revocation is ordered by KEL position, never wall-clock, so legitimate prior history is not retroactively invalidated.

Fields

signer_did: String

The signer’s did:keri:.

signed_at: u128

The signing position claimed in-band (Auths-Anchor-Seq).

revoked_at: u128

The KEL position at which the delegator anchored the revocation.

OutsideAgentScope

The agent signed exercising a capability outside its delegator-anchored scope (the delegator never granted it). Scope is advisory authorization anchored by the delegator (the ACDC upgrade is Epic F).

Fields

signer_did: String

The signer’s did:keri:.

capability: String

The capability the commit claimed that the scope does not grant.

AgentExpired

The agent signed at/after its delegator-anchored expiry. Checked against the signing time via an injected now (no wall-clock in the verifier).

Fields

signer_did: String

The signer’s did:keri:.

expired_at: i64

The expiry instant (Unix epoch seconds) the delegator anchored.

signed_at: i64

The signing time the commit was checked against (injected now).

SignerKeyMismatch

The SSH signer key is not the device’s current key (and not a known prior key).

SignedBySupersededKey

The SSH signer key is a superseded device key (the device rotated since signing).

WitnessQuorumNotMet

Under --require-witnesses, the signer’s root KEL did not reach M-of-N witness quorum for an establishment event (fail-closed).

Fields

root_did: String

The root did:keri: whose KEL is under-quorum.

collected: usize

Distinct valid witness receipts collected.

required: usize

Receipts required by the in-force backer threshold.

Implementations

impl CommitVerdict

pub fn is_valid(&self) -> bool

Whether the commit is authorized (a Valid verdict, regardless of the non-fatal duplicity warning).

Trait Implementations

impl Clone for CommitVerdict

fn clone(&self) -> CommitVerdict

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CommitVerdict

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for CommitVerdict

impl PartialEq for CommitVerdict

fn eq(&self, other: &CommitVerdict) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for CommitVerdict