Struct OwnerCapability 

pub struct OwnerCapability {
    pub format_version: u32,
    pub owner_id: Vec<u8>,
    pub issuer_state_hash: Vec<u8>,
    pub parent_capability_id: Vec<u8>,
    pub subject: Option<CapabilityPrincipal>,
    pub grants: Vec<SpoolCapabilityGrant>,
    pub not_before_unix_seconds: i64,
    pub expires_at_unix_seconds: i64,
    pub nonce: Vec<u8>,
    pub capability_id: Vec<u8>,
}

V1 canonicalization and signature remain unchanged. The alpha.5 format-2 timeline grant is a hard cut: reject it. For format_version=3, canonical_owner_capability_v3 uses the v1 field order and encodings, but every grant appends one presence byte after action (exactly 0x01) followed by scope fields 1..6. Byte fields are counted; credential_identity uses precisely the origin transcript’s tag (0x01 or 0x02) and counted IDs, not a protobuf serialization; class is u32be. The scope is included both with and without capability_id. The v3 capability_id is SHA-256( UTF8(“heddle-owner-capability-v3”) || canonical body without capability_id); its owner signature is Ed25519 over SHA-256 of that domain followed by the canonical body WITH capability_id. The v1 domain and body never change. Unknown fields and unsupported versions fail closed. A v3 chain is direct (parent_capability_id empty), has one signed capability and a single-block subject Biscuit bound to its exact subject key/kind/ID and grant. Its authority block has the v1 owner_subject, owner_capability, owner_validity facts plus exactly one owner_timeline_accept_server(“<spool_uuid_hex>”, “<path_hex>”, “<principal_uuid_hex>”, “<credential_id_hex>”, “<pop_sha256_hex>”, <class_u32>, “<thread_id_hex>”, “<origin_sha256_hex>”) OR owner_timeline_accept_offline(“<spool_uuid_hex>”, “<path_hex>”, “<principal_uuid_hex>”, “<issued_ancestor_credential_id_hex>”, “<terminal_revocation_id_hex>”, “<derivation_path_sha256_hex>”, “<pop_sha256_hex>”, <class_u32>, “<thread_id_hex>”, “<origin_sha256_hex>”) fact, selected exactly by the original credential_identity variant. IDs are lowercase raw-byte hex only inside this Biscuit fact; path_hex is the v1 u32-length-prefixed canonical path segments as lower-case hex. Reject extra facts, attenuation blocks, duplicate grants and any PURGE fact; this direct exact grant cannot be widened by a later block. The grant selector MUST equal the actual canonical Spool UUID/path and MUST have include_descendants=false. V1 PURGE verifiers reject v3 rather than treating this action as purge or ordinary spool-write authority.

Fields

format_version: u32

1 for PURGE or 3 for exact-subject timeline acceptance.

owner_id: Vec<u8>

issuer_state_hash: Vec<u8>

parent_capability_id: Vec<u8>

Empty only for a direct owner grant.

subject: Option<CapabilityPrincipal>

grants: Vec<SpoolCapabilityGrant>

not_before_unix_seconds: i64

expires_at_unix_seconds: i64

nonce: Vec<u8>

Exactly 32 random bytes.

capability_id: Vec<u8>

Recomputed from the matching canonical v1/v3 body without capability_id.

Trait Implementations

impl Clone for OwnerCapability

fn clone(&self) -> OwnerCapability

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OwnerCapability

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for OwnerCapability

fn default() -> OwnerCapability

Returns the “default value” for a type.

impl Message for OwnerCapability

fn encoded_len(&self) -> usize

Returns the encoded length of the message without a length delimiter.

fn clear(&mut self)

Clears the message, resetting all fields to their default.

fn encode(&self, buf: &mut impl BufMut) -> Result<(), EncodeError>

where Self: Sized,

Encodes the message to a buffer.

fn encode_to_vec(&self) -> Vec<u8>

where Self: Sized,

Encodes the message to a newly allocated buffer.

fn encode_length_delimited( &self, buf: &mut impl BufMut, ) -> Result<(), EncodeError>

where Self: Sized,

Encodes the message with a length-delimiter to a buffer.

fn encode_length_delimited_to_vec(&self) -> Vec<u8>

where Self: Sized,

Encodes the message with a length-delimiter to a newly allocated buffer.

fn decode(buf: impl Buf) -> Result<Self, DecodeError>

where Self: Default,

Decodes an instance of the message from a buffer.

fn decode_length_delimited(buf: impl Buf) -> Result<Self, DecodeError>

where Self: Default,

Decodes a length-delimited instance of the message from the buffer.

fn merge(&mut self, buf: impl Buf) -> Result<(), DecodeError>

where Self: Sized,

Decodes an instance of the message from a buffer, and merges it into self.

fn merge_length_delimited(&mut self, buf: impl Buf) -> Result<(), DecodeError>

where Self: Sized,

Decodes a length-delimited instance of the message from buffer, and merges it into self.

impl PartialEq for OwnerCapability

fn eq(&self, other: &OwnerCapability) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for OwnerCapability