Module compliance_certificate 

Session compliance certificate issuance with hybrid signing.

A SessionComplianceCertificate is a kernel-signed envelope that attests a session’s receipt log was free of policy violations against a specific crypto_floor and policy_hash. It is the artifact that external auditors consume when they need a compact, signed summary of a session without re-walking the underlying receipt store.

Why this module exists

chio-acp-proxy ships a Sigstore-only compliance certificate that consumes a bare Keypair for Ed25519 signing. The kernel needs the same envelope shape signed through an arbitrary &dyn SigningBackend so a HybridBackend can produce Signature::Hybrid envelopes under crypto_floor=allow_hybrid or pq_required. This module is the kernel-side hybrid path; it wraps a body identical in shape to the acp-proxy form but signs through the chio-core-types backend abstraction.

Spec reference: spec/COMPLIANCE-CERTIFICATE.md.

Threat model row pq_signature_downgrade is the surface this guards.

Structs

SessionComplianceCertificate

A signed session compliance certificate.

SessionComplianceCertificateBody

Body of a session compliance certificate.

Enums

ComplianceCertificateError

Errors raised during compliance certificate issuance and verification.

Functions

issue_session_compliance_certificate

Issue a session compliance certificate signed through backend.

verify_session_compliance_certificate

Verify a session compliance certificate against the configured crypto_floor.