Crate klieo_provenance 

Append-only Merkle hash chain with signed evidence bundles.

See the crate-level docs in T1 for context. The public surface is re-exported below; internal modules are private.

Structs

ChainEntry

One entry in the append-only chain.

ChainEntryId

Identifies an entry in the provenance chain.

EcdsaP256Verifier

ECDSA-P256 implementation backed by the p256 crate. Algorithm tag is the literal string "ecdsa-p256". Compatible with the SignatureBytes shape emitted by KMS-rooted signers (examples/aws-kms-signer/, see ADR-009).

Ed25519Verifier

Ed25519 implementation backed by ed25519-dalek. Algorithm tag is the literal string "ed25519".

EvidenceBundle

Regulator-ready evidence pack.

ProvenanceChain

Provenance chain aggregate. Append-only.

ProvenanceEpisodic

Decorator that wraps an EpisodicMemory and mirrors every episode write into a ProvenanceRepository append-only chain.

ProvenanceEvent

A single appendable record in the chain.

SignatureBytes

Detached signature bytes returned by a BundleSigner.

SqliteProvenanceRepository

SQLite-backed append-only provenance repository.

StaticKeyResolver

In-process key resolver backed by a static HashMap.

Enums

ProvenanceError

Errors raised by chain operations, the repository port, and the signer port.

ProvenanceEventKind

What kind of operation this provenance entry records.

VerifyError

Failure cases for evidence-bundle verification.

Constants

GENESIS_HASH_HEX

Genesis hash used as the predecessor of the first entry in any chain.

Traits

BundleSigner

Abstract evidence-bundle signer port.

KeyResolver

Trust store: given a bundle’s key_id, returns the trusted public key bytes. The verifier NEVER reads public_key_hex from the bundle; trust derives exclusively from this resolver.

ProvenanceRepository

Persistent storage port for a per-scope append-only chain.

Signer

Deprecated alias for BundleSigner. Abstract evidence-bundle signer port.

Verifier

Algorithm-specific signature checker.

Functions

chain_from_episodes

Build a Merkle ProvenanceChain over an agent run’s episodes, stamping every entry with actor.

episode_to_event

Map one Episode to a ProvenanceEvent stamped with actor and run_ref.

error_category

Collapse a raw error string into a fixed, PII-free category code.