spine/
subtree.rs

1//! Subtree descriptor for structured appends.
2//!
3//! A leaf carries raw payload bytes. The n-ary subtree recovers full Merkle
4//! generality below the proof spine.
5
6/// Describes a subtree to be appended as a single logical unit.
7/// Leaves are the atomic data items (czds).
8/// Nodes define intermediate n-ary nodes (transactions, commits).
9///
10/// # Opacity contract
11///
12/// A `Leaf` is byte-identical whether it carries a raw payload or a child
13/// tree's root digest: the kernel **never branches on a leaf's origin**.
14/// Callers must never attach an `is_embedded` tag or any other origin marker
15/// to a leaf, because doing so would let the kernel inspect origin and break
16/// this contract. An auditor cannot tell whether a leaf is a raw payload or
17/// an embedded subtree root — that indistinguishability is the security
18/// guarantee.
19#[derive(Debug, Clone, PartialEq, Eq)]
20pub enum Subtree {
21    /// A single leaf containing raw payload bytes.
22    ///
23    /// Whether those bytes are a raw application payload or a child tree's root
24    /// digest is opaque: the kernel treats both identically (no origin tag).
25    Leaf(Vec<u8>),
26    /// An n-ary internal node with a list of children.
27    Node(Vec<Subtree>),
28}
spine/subtree.rs

spine/
subtree.rs
