klieo-provenance 3.4.0

Append-only Merkle hash chain with signed evidence bundles for agent and audit provenance.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

//! Errors raised by the provenance crate.

use thiserror::Error;

/// Errors raised by chain operations, the repository port, and the signer port.
#[non_exhaustive]
#[derive(Debug, Error)]
pub enum ProvenanceError {
    /// Generic invalid input or invalid chain state.
    #[error("invalid: {0}")]
    Invalid(String),

    /// The chain failed integrity verification at the given sequence.
    #[error("chain broken at sequence {sequence}: {reason}")]
    ChainBroken {
        /// The sequence at which verification failed.
        sequence: u64,
        /// Human-readable reason.
        reason: String,
    },

    /// Underlying repository (database, in-memory store, etc.) failed.
    #[error("repository error: {0}")]
    Repository(String),

    /// `ChainEntry::compute_hash_for_version` was called with an unrecognised
    /// `chain_version`. Supported versions are 1 (legacy) and 2 (ADR-037).
    /// Unknown versions cannot be verified and the verifier MUST reject the
    /// entry rather than fall back to a default.
    #[error("unsupported chain_version {0}: known versions are 1, 2")]
    UnsupportedChainVersion(u8),

    /// Serialising an [`klieo_core::Episode`] (or other chain payload) to its
    /// canonical bytes failed. Hashing empty bytes on this path would silently
    /// produce a tamper-evident commitment over the wrong payload, so the
    /// projection propagates the failure instead of swallowing it.
    #[error("serialization failed")]
    Serialization(#[source] serde_json::Error),
}