Enum MutationTrust 

pub enum MutationTrust {
    Unverified,
    VerifiedChannel,
    VerifiedRelay,
}

Channel/relay scope derived from ingress provenance, mirroring RB-09 ControlTrust. Scope only, never leaf identity: a verified SC ingress asserts the channel/relay validation, not that a claimed SNET/SADR leaf is the authenticated peer. Provenance alone never authorizes; only the policy does (no static allowlist).

Direct ingress exposes its verified leaf as MutationAuthorizationContext::principal; this enum remains scope-only. The SC VMAC is payload-claimed inside the TLS channel and is not bound to the operational certificate. An unknown origin (including a hub-mediated unknown leaf, which arrives TransportProvenance::unverified) never satisfies a baseline-only allow rule; receive-permission (e.g. an accepted COV subscription or audit receipt) is never write-permission.

Variants

Unverified

Unverified legacy origin, including hub-mediated unknown leaves.

VerifiedChannel

Authenticated immediate SC-TLS channel; leaf identity is separate.

VerifiedRelay

Independently validated SC-hub relayed origin (post source admission; the hub peer is not the leaf).

Implementations

impl MutationTrust

pub fn from_provenance(provenance: &TransportProvenance) -> Self

Derive the channel/relay scope from one reassembled ingress snapshot.

Trait Implementations

impl Clone for MutationTrust

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for MutationTrust

impl Debug for MutationTrust

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for MutationTrust

impl PartialEq for MutationTrust

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for MutationTrust