Enum AttestationState 

pub enum AttestationState {
    NotChecked,
    Unattested,
    Attested {
        key_id: String,
        attester_id: String,
        covers_content: bool,
    },
    NoTrustedKey {
        key_id: String,
    },
    UnknownAlgorithm {
        algorithm: String,
    },
    UnusableEvidence,
    Invalid {
        verdict: AttestationVerdict,
    },
}

What a host found when it checked one frame’s attestation (ADR 0016 §4).

Named outcomes rather than a boolean, for the reason AttestationVerdict is named: NoTrustedKey is a configuration gap an operator closes in a minute, and Invalid carrying CommitmentMismatch is an incident. Collapsing them sends someone hunting the wrong one.

None of these states removes a frame from a composition. F9 makes an unverifiable attestation a degradation to unattested, never a disqualification.

Variants

NotChecked

No attestation check was performed on this frame — the host composed it without consulting a trust store. Distinct from Unattested: “I did not look” is not “there was nothing to find”.

Unattested

The provider offered no attestation for this frame.

Attested

The signature verified against a key this host trusts for this provider.

This means exactly “signed by a key this operator chose to trust”. It does not mean the content is true, and it carries no weight for a second host that holds no key (ADR 0016 Consequences).

Fields

key_id: String

The key that verified it.

attester_id: String

The attesting authority the attestation names — who is accountable for the claim, as distinct from the key that produced it.

covers_content: bool

Whether the signature covers the frame’s content bytes.

A frame commitment is over (provider_id, frame_id, content_digest) plus the provenance chain head (SPEC.md §6.5.2), and content_digest is optional. So a frame that declares none has a perfectly valid signature over its identity and its provenance and nothing at all over its text: the same provider can re-serve different content under the same frame id and this signature still verifies.

false says so out loud, so a host does not render such a frame as though its words were signed. It is not a failure — the frame is attested — it is a narrower claim than a reader would otherwise assume, and assuming it is the mistake this field exists to prevent.

NoTrustedKey

An attestation was offered, but this host holds no trusted key under that key_id for that provider. A configuration gap, not a forgery finding: the signature was never checked, so nothing is known about it.

Fields

key_id: String

The key_id the attestation named, so an operator knows what to add.

UnknownAlgorithm

The attestation names a signature scheme this build cannot check (SPEC.md F8). A refusal to guess, not a failure to validate.

Fields

algorithm: String

The scheme the attestation named.

UnusableEvidence

An entry named this frame and this host could not turn it into a check: an inclusion proof with no signed result_attestation root to prove membership of, or an entry carrying neither a signature nor a proof.

F9: the frame is served, and every decision treats this as unattested. The state is named rather than folded into Unattested because the two say different things about the provider — one chose not to sign, the other sent evidence that does not resolve — and only the second is worth an operator’s attention. was_offered is true here.

Invalid

A trusted key was found and the check did not succeed — a forgery, a frame altered after signing, or an attestation too malformed to check. The verdict says which.

Fields

verdict: AttestationVerdict

The named finding from contextgraph_types::attest.

Implementations

impl AttestationState

pub fn is_attested(&self) -> bool

Whether this frame is attested by a key this host trusts. Every other state — including NotChecked — is false, because “I could not check it” is never “it is good” (SPEC.md F8).

pub fn covers_content(&self) -> bool

Whether the signature covers the frame’s content bytes as well as its identity and provenance — see Attested::covers_content. false for every state that is not Attested.

pub fn was_offered(&self) -> bool

Whether an attestation was offered at all. A host reports on NoTrustedKey differently from Unattested: the first is the host’s gap, the second is the provider’s choice.

Trait Implementations

impl Clone for AttestationState

fn clone(&self) -> AttestationState

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AttestationState

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AttestationState

fn default() -> AttestationState

Returns the “default value” for a type.

impl Eq for AttestationState

impl PartialEq for AttestationState

fn eq(&self, other: &AttestationState) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for AttestationState