Enum Rule 

pub enum Rule {
    RawSniObserved,
    RawHostHeaderObserved,
    RawH2AuthorityObserved,
    SniHostMatch,
    H2AuthorityHostMatch,
    SniCdnProviderMatch,
    JwsSignatureVerified,
    DaneTlsaBound,
    SvidChainVerified,
    EchDetected,
    EncryptedInnerSni,
    MitmHandshakeTerminated,
    GuestProcSpawnObserved,
    GuestProcExitObserved,
    GuestFsInotifyFired,
    GuestCapDenialObserved,
    GuestNetConnectAttempted,
}

Named rules per docs/authority-derivation-graph.md. Adding a new rule requires updating that document AND canonical_class_for_rule.

Variants

RawSniObserved

SNI parsed from ClientHello, no cross-check.

RawHostHeaderObserved

Host header parsed, no cross-check.

RawH2AuthorityObserved

h2 :authority parsed.

SniHostMatch

SNI value byte-equals Host value (post-IDN, post-port-strip).

H2AuthorityHostMatch

h2 :authority matches HTTP/1.x Host on the same flow.

SniCdnProviderMatch

SNI matches a declared cdnAuthority.providers[].hostnamePattern.

JwsSignatureVerified

Workload-signed authority claim verified against cell-ephemeral key.

DaneTlsaBound

Upstream cert chain matches DNSSEC-validated TLSA record.

SvidChainVerified

SPIFFE SVID chain verified (future).

EchDetected

encrypted_client_hello extension present.

EncryptedInnerSni

Successor to ECH_DETECTED when more state available.

MitmHandshakeTerminated

Stack 3 / M2 only.

GuestProcSpawnObserved

In-VM agent declared a process spawn (ADR-0006).

GuestProcExitObserved

In-VM agent declared a process exit (ADR-0006).

GuestFsInotifyFired

In-VM agent declared an inotify watch firing (ADR-0006).

GuestCapDenialObserved

In-VM agent declared a capability denial (ADR-0006).

GuestNetConnectAttempted

In-VM agent declared a connect() attempt (ADR-0006).

Trait Implementations

impl Clone for Rule

fn clone(&self) -> Rule

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Rule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Rule

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Hash for Rule

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for Rule

fn eq(&self, other: &Rule) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Rule

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Copy for Rule

impl Eq for Rule

impl StructuralPartialEq for Rule