structured-ltv

Format-neutral long-term validation facts for AdES signatures, with explicit memory and work accounting. The crate supports no_std + alloc and performs no implicit I/O.

EN 319 102-1 defines path validation at a time, revocation material bound to path members, timestamp generation intervals and archive coverage of validation material once for every AdES format. This crate implements those facts over the structured-pkix and structured-cms processors. A format layer (structured-xades today) states only where material and timestamps were written; no XML or PDF type crosses this boundary, and no fact is a trust verdict.

Source identity

source::Source is implemented by a document owner over its own stable node identities: XML elements, CMS attributes or PDF objects. source::Query is one current operation over an expected snapshot of that source; source::Scope implements it for any Source, and a format's own access guard can implement it so that its checks and these share one admission path. A generation change is a processing failure, never a malformed-property finding. Every check runs under the query that performs it; retained facts are never prepaid work.

Facts

• timestamp retains a completed CMS token check as Verified, with the original token, signature, property and Purpose (content, signature, validation data or archive). It derives complete generation intervals from the authority's stated accuracy, associates a signature timestamp with the signer's checked path (signature_time) and holds the complete token obligations of one scope (TimestampRequirements, TimestampPaths).
• pki runs the common PKIX path processor for actor paths, binds CRL and OCSP results to actual path members, closes the validation-authority graph and derives the complete participant census (participants) from the format's receipts: SignerReceipt, CounterReceipts and CredentialReceipts. Later facts require those very receipts, not equal identities.
• material indexes every incorporated certificate, CRL and OCSP value with the format's placement of each occurrence, attributes artifact uses to actors, reports incorporation, and checks each archive input's Coverage against its checked token.
• baseline joins a format's stage reports through BasicStage, X509Material, CredentialMaterial and ArchiveCensus: timestamped, long_term, archive_material and archives. The format layer keeps its own level assessment.

Reports keep detailed negative findings. Material presence does not establish usable revocation status, historical trust, timestamp chronology or algorithm longevity. Source, generation, resource and callback failures remain processing errors, separate from missing or mismatching evidence.

Implementing a format

A format layer implements Source (or Query over its access guard) and the receipt traits on its own checked results, builds TimestampRequirements from every original timestamp in source order, failed and unsupported ones included, and builds a material::Index and one Coverage per archive input.

These receipts carry the format's issuer type, and constructing one takes a value of it. A format defines that type with a private field, so its callers cannot relabel checked timestamp evidence, associate it with another signer or supply a fabricated census, index or coverage. The participant census is derived by pki::participants, which takes the issuer value too, so it comes only from the format's own signer, counter and credential receipts. Receipts of different issuers do not combine. The integration test tests/cms_source.rs drives the participant census and archive coverage over CMS SignerInfo attributes identified by ordinal.

Cryptographic test adapters are development-only oracles, not qualified production providers.