Struct ProvenanceSigner 

pub struct ProvenanceSigner { /* private fields */ }

In-process HMAC-SHA256 signer for the recall hot path.

Caller-side responsibility: rotate (key_id, key) on whatever cadence your security posture demands and keep the historical pairs accessible to the verifier. The struct holds a single key; to handle multiple keys (active + historical) wrap several ProvenanceSigners in a Keystore (see crate::encryption::ContentEncryption for the equivalent pattern on the at-rest side).

Implementations

impl ProvenanceSigner

pub fn new(key_id: impl Into<String>, key: &[u8]) -> Self

Construct from a 32-byte key + a stable identifier.

Operators should set the key from secure storage (Vault, AWS KMS, etc.) and choose an id like "mnemo-prov-2026-04" that survives logging.

pub fn key_id(&self) -> &str

pub fn sign( &self, agent_id: impl Into<String>, query: &str, records: &[MemoryRecord], ) -> Result<ReadProvenance, ProvenanceError>

Build a signed ReadProvenance for one recall.

Trait Implementations

impl Clone for ProvenanceSigner

fn clone(&self) -> ProvenanceSigner

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProvenanceSigner

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ProvenanceKeystore for ProvenanceSigner

Single-key implementation for the common case.

fn lookup(&self, key_id: &str) -> Option<&ProvenanceSigner>