Struct RotationAttestation 

pub struct RotationAttestation {
    pub schema: u32,
    pub uuid: String,
    pub algorithm: String,
    pub old_pubkey: String,
    pub new_pubkey: String,
    pub old_key_version: u32,
    pub new_key_version: u32,
    pub rotated_at: String,
    pub reason: RotationReason,
    pub signature: String,
    pub bootstrap: bool,
}

Cryptographic proof of an identity-key rotation.

signature is multibase base58btc Ed25519 over canonical_bytes() (which serializes every field except signature itself).

For reason = Emergency, signature MAY be empty — those rotations require out-of-band admin approval to take effect.

Fields

schema: u32

Schema version. Always 1 for now.

uuid: String

Agent UUIDv7 — stable across rotations.

algorithm: String

Signing algorithm. “ed25519” for now.

old_pubkey: String

Outgoing pubkey (multibase). Empty string for the bootstrap entry only.

new_pubkey: String

Incoming pubkey (multibase). Always present.

old_key_version: u32

new_key_version: u32

= old_key_version + 1 for non-emergency rotations.

rotated_at: String

RFC3339 timestamp.

reason: RotationReason

signature: String

Multibase Ed25519 signature over canonical_bytes(). Empty for Emergency reason or for the bootstrap entry.

bootstrap: bool

True only for the create-time entry (no prior key existed).

Implementations

impl RotationAttestation

pub fn new( uuid: impl Into<String>, old_pubkey: impl Into<String>, new_pubkey: impl Into<String>, old_key_version: u32, new_key_version: u32, rotated_at: impl Into<String>, reason: RotationReason, ) -> Self

Build a new (unsigned) attestation.

pub fn into_bootstrap(self) -> Self

Mark this attestation as the bootstrap entry written at agent create time. Bootstrap entries have empty old_pubkey and empty signature; they exist only to anchor the rotation chain.

pub fn canonical_bytes(&self) -> Vec<u8>

Canonical bytes used for signing. Serializes every field of self EXCEPT signature (which is being computed) using JSON with sorted keys and no whitespace.

pub fn sign(&mut self, signing: &SigningKey)

Compute the Ed25519 signature using the given signing key and store it in self.signature. Idempotent.

pub fn verify(&self, old_pubkey: &str) -> Result<(), IdentityError>

Verify self.signature against the supplied multibase-encoded old_pubkey. Returns Ok(()) on a valid signature.

Bootstrap entries (bootstrap = true) are accepted unconditionally — they have nothing to verify against. Emergency entries (reason = Emergency) with empty signature are REJECTED here; callers must use verify_or_emergency if they want the emergency-allowed semantics.

pub fn verify_or_emergency(&self, old_pubkey: &str) -> Result<(), IdentityError>

Like verify, but accepts emergency rotations with empty signature. Caller is responsible for the out-of-band approval check.

Trait Implementations

impl Clone for RotationAttestation

fn clone(&self) -> RotationAttestation

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RotationAttestation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for RotationAttestation

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for RotationAttestation

fn eq(&self, other: &RotationAttestation) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for RotationAttestation

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for RotationAttestation

impl StructuralPartialEq for RotationAttestation