Struct SignedPolicy 

pub struct SignedPolicy { /* private fields */ }

A NamespacePolicy together with the namespace root key’s composite signature over its canonical bytes (the signed, in-log artifact).

The signature is produced by the same single-source-of-truth composite primitive that backs the Slice-3 hybrid checkpoint line, under the versioned context label <namespace>/namespace-policy/v1. ML-DSA signing is hedged, so the signature bytes are not reproducible, but verification is deterministic.

Implementations

impl SignedPolicy

pub fn sign(policy: NamespacePolicy, secret_key_b64: &str) -> Result<Self>

Sign policy with a metamorphic-crypto hybrid composite secret key (base64), binding the signature to the <namespace>/namespace-policy/v1 context.

Errors

Returns Error::HybridSignature if the secret key cannot be decoded/derived or the composite signature cannot be produced, and propagates NamespacePolicy::context_label errors.

pub fn from_parts( policy: NamespacePolicy, signing_public_key: Vec<u8>, signature: Vec<u8>, ) -> Self

Build a signed policy from already-produced parts (e.g. parsed from the log). Does not verify the signature; call SignedPolicy::verify.

pub fn policy(&self) -> &NamespacePolicy

The wrapped policy.

pub fn signing_public_key(&self) -> &[u8]

The namespace root signing public key (metamorphic-crypto composite tag || classical_pk || ml_dsa_pk).

pub fn signature(&self) -> &[u8]

The composite signature bytes over the canonical policy.

pub fn verify(&self) -> Result<&NamespacePolicy>

Verify the policy’s own composite signature under the namespace’s <namespace>/namespace-policy/v1 context. On success returns the verified NamespacePolicy.

A relying party should additionally check that signing_public_key matches the TOFU-pinned namespace root key (this is the application’s first-contact trust decision, not this library’s).

Errors

Returns Error::InvalidSignature if the signature does not verify, and propagates NamespacePolicy::context_label errors. A structurally malformed key/signature is treated as a verification failure, never a panic.

pub fn canonical_bytes(&self) -> Vec<u8>

Build the canonical serialization of the signed envelope:

signed_canonical =
    u32_be(SIGNED_POLICY_FORMAT_VERSION = 1)
 || lp(policy_canonical_bytes)
 || lp(signing_public_key)
 || lp(signature)

This is the Layer-0 leaf placed in the log.

pub fn parse(bytes: &[u8]) -> Result<Self>

Parse a signed envelope from its canonical bytes (does not verify the signature; call SignedPolicy::verify).

Errors

Returns Error::MalformedPolicy for an unknown format version, a length-prefix overrun, an empty key/signature, or trailing bytes; and propagates NamespacePolicy::parse errors.

Trait Implementations

impl Clone for SignedPolicy

fn clone(&self) -> SignedPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SignedPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for SignedPolicy

impl PartialEq for SignedPolicy

fn eq(&self, other: &SignedPolicy) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for SignedPolicy