Module cognitum 

Optional Cognitum ADR-154/155 release-record verifier (ADR-100 section 6.2). Off unless super::VerifyPolicy::accept_cognitum_release is set.

The record’s detached signature is Ed25519 (PureEdDSA) over the canonical statement {"release":<record minus seededAt and provenance.detachedSignature>,"schema":"cognitum.cog.release-provenance.v1"} with payloadDigest = sha256:<hex of that statement>, matching upstream scripts/cog_release_provenance_lib.py::canonical_payload.

Scope: the operator pins the Cognitum release key directly by key id. The upstream trust-registry v3 quorum, key status windows and builder / workflow allow-lists are not re-evaluated here. A record binds the cog id, version, source commit and one binary digest; it does not cover cog.toml. A package trusted through a record alone is therefore accepted only when (a) the record’s sourceCommit matches the package’s recorded source commit and (b) the package’s cog.toml hash is one the operator pinned (super::VerifyPolicy::record_cog_toml_pins). Packages an operator signed are not subject to (a) and (b), but an attached record is still verified.

Structs

CheckedRecord

A verified attached record: what it binds and who vouches for it.

RecordFacts

Facts a verified record binds.

Constants

COGNITUM_RECORD_KIND

Attestation kind carried in a cog package for a Cognitum record.

PROVENANCE_SCHEMA

Upstream statement / envelope schema.

Functions

canonical_statement

Canonical upstream statement bytes for record.

check_attached

If the package carries a Cognitum record, verify it and its binding to the package (cog id, version, and every binary’s SHA-256 equal to binaryDigest). Ok(None) when no record is attached.

require_record_only_binding

Extra conditions for trusting a package through a Cognitum record alone: the record’s sourceCommit must match the package’s source commit, and the package’s cog.toml hash must be operator-pinned.

verify_release_record

Verify a release record against pinned Cognitum keys.