Struct ConstitutionalKernel 

pub struct ConstitutionalKernel { /* private fields */ }

An ergonomic wrapper around the CGR Kernel.

Provides a minimal adjudication interface suitable for common SDK use cases: a single actor performing an action, with caller-supplied authority signing material, actor-signed provenance, and an active bailment from that authority. Callers needing fine-grained control over the adjudication context should use exo_gatekeeper::Kernel directly.

Examples

use exochain_sdk::kernel::ConstitutionalKernel;
use exo_core::Did;

let authority = exochain_sdk::identity::Identity::generate("authority");
let actor = exochain_sdk::identity::Identity::generate("alice");
let kernel = ConstitutionalKernel::with_authority_identity(authority);
assert!(kernel.verify_integrity());
assert_eq!(kernel.invariant_count(), 8);

let verdict = kernel.adjudicate_as(&actor, "read:profile");
assert!(verdict.is_permitted());

Implementations

impl ConstitutionalKernel

pub fn new() -> Self

Construct a new kernel with the default constitution and all eight constitutional invariants.

Examples

let kernel = ConstitutionalKernel::new();
assert_eq!(kernel.invariant_count(), 8);
assert!(kernel.verify_integrity());

pub fn with_authority_identity(authority: Identity) -> Self

Construct a new kernel with an authority signing identity.

This is the common SDK path: the identity’s DID becomes the authority grantor and bailor for the default adjudication context, and its secret key signs the canonical authority payloads that the kernel verifies. Actor provenance must still be signed by the actor identity through Self::adjudicate_as.

Examples

let authority = Identity::generate("authority");
let kernel = ConstitutionalKernel::with_authority_identity(authority);
assert!(kernel.verify_integrity());

pub fn with_authority( authority_did: Did, authority_public_key: PublicKey, authority_signer: Arc<dyn Fn(&[u8]) -> Signature + Send + Sync>, ) -> Self

Construct a new kernel with caller-supplied authority signing material.

The signer must produce an Ed25519 signature over the message bytes it receives. The supplied public key is embedded in the adjudication context, and the gatekeeper verifies every signature cryptographically.

Examples

let authority_did = crypto::Did::new("did:exo:authority").expect("valid");
let (authority_public_key, authority_secret_key) = crypto::generate_keypair();
let kernel = ConstitutionalKernel::with_authority(
    authority_did,
    authority_public_key,
    Arc::new(move |message: &[u8]| crypto::sign(message, &authority_secret_key)),
);
assert!(kernel.verify_integrity());

pub fn adjudicate(&self, actor: &Did, action: &str) -> KernelVerdict

Adjudicate action performed by actor using the signed SDK context.

The SDK supplies a minimal signed default context:

• A single Judicial role for actor.
• A one-link authority chain from the configured authority to actor granting read.
• An active bailment from the configured authority to actor scoped to the requested permission set.
• Full human-override preservation.
• Signed provenance with timestamp "sdk" when actor is the authority DID itself.

If the kernel was created with Self::new rather than Self::with_authority or Self::with_authority_identity, this method fails closed with a denied verdict.

Passing an arbitrary DID without its signer fails closed. Use Self::adjudicate_as when acting for a distinct SDK identity, or reach for exo_gatekeeper::Kernel directly when building a fully resolved adjudication context.

The action is flagged as is_self_grant = false and modifies_kernel = false by default. Helpers are available for the common deny-cases used in tests: see Self::adjudicate_self_grant, Self::adjudicate_kernel_modification, and Self::adjudicate_without_bailment.

Examples

use exochain_sdk::kernel::ConstitutionalKernel;

let authority = exochain_sdk::identity::Identity::generate("authority");
let actor = authority.did().clone();
let kernel = ConstitutionalKernel::with_authority_identity(authority);
let verdict = kernel.adjudicate(&actor, "data:read");
assert!(verdict.is_permitted());

pub fn adjudicate_as(&self, actor: &Identity, action: &str) -> KernelVerdict

Adjudicate action performed by actor using actor-signed provenance and authority-signed delegation.

This is the normal SDK path for actions performed by a principal other than the configured authority. The actor identity signs the provenance payload, and the trusted provenance key map is populated from that same actor identity rather than from the authority signer.

pub fn adjudicate_self_grant(&self, actor: &Did, action: &str) -> KernelVerdict

Same as Self::adjudicate but sets is_self_grant = true so the kernel can enforce the NoSelfGrant invariant.

Useful for exercising the invariant in tests: a permitted verdict here would indicate a constitutional defect.

Examples

use exochain_sdk::kernel::ConstitutionalKernel;

let authority = exochain_sdk::identity::Identity::generate("authority");
let actor = exochain_sdk::identity::Identity::generate("self-granter");
let kernel = ConstitutionalKernel::with_authority_identity(authority);
let verdict = kernel.adjudicate_self_grant_as(&actor, "escalate-self");
assert!(verdict.is_denied());

pub fn adjudicate_self_grant_as( &self, actor: &Identity, action: &str, ) -> KernelVerdict

Same as Self::adjudicate_as but sets is_self_grant = true.

pub fn adjudicate_kernel_modification( &self, actor: &Did, action: &str, ) -> KernelVerdict

Same as Self::adjudicate but sets modifies_kernel = true so the kernel can enforce the KernelImmutability invariant.

Examples

use exochain_sdk::kernel::ConstitutionalKernel;

let authority = exochain_sdk::identity::Identity::generate("authority");
let actor = exochain_sdk::identity::Identity::generate("patcher");
let kernel = ConstitutionalKernel::with_authority_identity(authority);
let verdict = kernel.adjudicate_kernel_modification_as(&actor, "patch-kernel");
assert!(verdict.is_denied());

pub fn adjudicate_kernel_modification_as( &self, actor: &Identity, action: &str, ) -> KernelVerdict

Same as Self::adjudicate_as but sets modifies_kernel = true.

pub fn adjudicate_without_bailment( &self, actor: &Did, action: &str, ) -> KernelVerdict

Same as Self::adjudicate but omits the default bailment so the kernel can enforce the ConsentRequired invariant.

Examples

use exochain_sdk::kernel::ConstitutionalKernel;

let authority = exochain_sdk::identity::Identity::generate("authority");
let actor = exochain_sdk::identity::Identity::generate("unauth");
let kernel = ConstitutionalKernel::with_authority_identity(authority);
let verdict = kernel.adjudicate_without_bailment_as(&actor, "read-data");
assert!(verdict.is_denied());

pub fn adjudicate_without_bailment_as( &self, actor: &Identity, action: &str, ) -> KernelVerdict

Same as Self::adjudicate_as but omits the default bailment.

pub fn verify_integrity(&self) -> bool

Verify that the kernel’s stored constitution hash matches the configured constitution text.

Returns false if the constitution in memory has drifted from the hash the kernel was initialised with — which should never happen in practice, but is checked defensively because constitutional integrity is a load-bearing invariant.

Examples

let kernel = ConstitutionalKernel::new();
assert!(kernel.verify_integrity());

pub fn invariant_count(&self) -> usize

Number of constitutional invariants enforced by this kernel (always 8).

Examples

assert_eq!(ConstitutionalKernel::new().invariant_count(), 8);

Trait Implementations

impl Debug for ConstitutionalKernel

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ConstitutionalKernel

fn default() -> Self

Returns the “default value” for a type.