vti_common/guards.rs
1//! Executor preconditions carried through the plan → approve → execute
2//! pipeline.
3//!
4//! These live here (rather than in `vta-service`'s trust-task planner) so both
5//! the planner and the `vta-policy` consent model can name them without a
6//! cross-crate cycle. Pure serialisable data — no behaviour.
7
8/// Preconditions the executor checks for itself before committing.
9#[derive(Debug, Clone, Default, PartialEq, serde::Serialize, serde::Deserialize)]
10#[serde(rename_all = "camelCase")]
11pub struct Guards {
12 /// The BIP-32 derivation-path counter the webvh planner peeked, and the
13 /// group it peeked it from.
14 ///
15 /// A peek reserves nothing. If another allocation in the same context lands
16 /// while a human is deciding, the real run derives *different keys* than the
17 /// ones the approver was shown — so the counter has to be pinned and
18 /// re-checked, or the approval authorizes a rotation to a key that never
19 /// existed.
20 pub webvh_path_counter: Option<WebvhPathCounter>,
21}
22
23#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
24#[serde(rename_all = "camelCase")]
25pub struct WebvhPathCounter {
26 pub base_path: String,
27 pub counter: u32,
28}