hardbound 0.0.1

Hardbound — public trait surface for the enterprise hardware-bound trust tier of Web4. Implementations of these traits anchor identity, vault, witness chain, and policy in TPM 2.0 / YubiKey / Secure Enclave hardware. The reference closed-source implementation is at metalinxx.io; this crate is the contract any compatible implementation must satisfy.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

//! # Hardbound
//!
//! Public trait surface for the hardware-bound enterprise trust tier of
//! Web4. Hardbound implementations anchor identity, vault keys, witness
//! chain signatures, and policy decisions in hardware (TPM 2.0,
//! YubiKey, Secure Enclave, HSM, etc.).
//!
//! This crate is **the contract**, not the implementation. The
//! reference closed-source implementation lives at
//! `https://metalinxx.io`. Any compatible implementation that
//! satisfies these traits can plug into the [Hestia][hestia] daemon at
//! the hardware-trust extension point.
//!
//! ## Four primitives
//!
//! | Trait | Replaces in consumer Hestia |
//! |---|---|
//! | [`TrustedKeyProvider`] | software-derived sovereign LCT |
//! | [`SealedVault`] | passphrase-derived AEAD key |
//! | [`AttestationSigner`] | Phase-1 placeholder signer LCT |
//! | [`OversightPolicy`] | default-allow stub |
//!
//! See `https://github.com/dp-web4/hestia/blob/main/demo/enterprise/README.md`
//! for the architectural map and the rationale behind each replacement.
//!
//! ## Status
//!
//! `0.0.1` — initial contract. Trait shapes may shift before `0.1.0`.
//! Implementations should pin a minor version and watch the changelog.
//!
//! [hestia]: https://github.com/dp-web4/hestia

#![cfg_attr(docsrs, feature(doc_cfg))]
#![deny(missing_docs)]

mod attestation;
mod error;
mod policy;
mod sealed_vault;
mod trusted_key;

pub use attestation::{Attestation, AttestationSigner};
pub use error::{Error, Result};
pub use policy::{OversightPolicy, PolicyAction, PolicyDecision};
pub use sealed_vault::SealedVault;
pub use trusted_key::TrustedKeyProvider;

/// Crate version, for runtime banner messages.
pub const VERSION: &str = env!("CARGO_PKG_VERSION");