pub struct RotationFloor {
pub car_floor: String,
pub org: String,
pub floor_epoch: u64,
pub rotation_hlc: Hlc,
pub prev_floor_epoch: u64,
pub signature: String,
}Expand description
A signed, monotonic marker that org org rotated to floor_epoch at logical
time rotation_hlc. Remaining members use it via is_authoritative to
stop treating a removed member’s post-cut epoch-<floor_epoch> writes as the
org’s current truth.
The signature (by a TRUSTED granter, the same authority that wraps K_org) is
LOAD-BEARING: an unsigned/unverified floor is a censorship primitive — anyone
could publish floor_epoch = u64::MAX and mark every legitimate op stale.
Always verify_rotation_floor before honoring one.
Fields§
§car_floor: StringAlgorithm tag ([ALG_ROTATION_FLOOR]).
org: String§floor_epoch: u64The epoch at/after which authorship is required for new ops.
rotation_hlc: HlcThe logical time the cut happened. Ops with hlc <= rotation_hlc are
treated as pre-cut history (see the module’s audit note on forgeability).
prev_floor_epoch: u64The floor this one supersedes. verify_rotation_floor checks
floor_epoch > prev_floor_epoch for internal well-formedness ONLY — that
does NOT stop an attacker replaying an OLDER validly-signed floor (whose
own floor_epoch > prev_floor_epoch still holds). Anti-rollback is the
caller’s job: persist the max accepted floor_epoch and reject anything
<= it. See verify_rotation_floor.
signature: StringEd25519 signature (hex) by a trusted granter over
[rotation_floor_transcript]. Verified with verify_strict.
Trait Implementations§
Source§impl Clone for RotationFloor
impl Clone for RotationFloor
Source§fn clone(&self) -> RotationFloor
fn clone(&self) -> RotationFloor
1.0.0 (const: unstable) · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source. Read more