Skip to main content

verify_execution_nonce

chio_kernel::execution_nonce

Function verify_execution_nonce 

Source 
pub fn verify_execution_nonce(
    presented: &SignedExecutionNonce,
    kernel_pubkey: &PublicKey,
    expected: &NonceBinding,
    now: i64,
    nonce_store: &dyn ExecutionNonceStore,
) -> Result<(), ExecutionNonceError>
Expand description

Verify a signed execution nonce against the expected binding.

Steps, in order:

  1. Schema check.
  2. Expiry check – now < nonce.expires_at.
  3. Binding check – subject, capability, server, tool, parameter_hash.
  4. Signature check – canonical JSON under the kernel’s pubkey.
  5. Replay check – nonce_store.reserve(nonce_id) must return true.