Struct ClockSample 

pub struct ClockSample {
    pub wall_ns: u64,
    pub monotonic: Instant,
}

A single paired capture of wall-clock and monotonic time.

Take one per admission with Self::now, then use wall_ns for every certificate/grant/proof freshness check and Self::monotonic_deadline_for to translate the proof’s wall-clock expiry into the monotonic deadline the replay guard retains it under — all relative to the SAME sample.

Fields

wall_ns: u64

Wall-clock now, unix NANOSECONDS. Every freshness check reads this — never a freshly-sampled clock.

monotonic: Instant

Monotonic now, paired with wall_ns. Replay-retention deadlines derive from this so a wall-clock jump cannot shift retention out from under a freshness check.

Implementations

impl ClockSample

pub fn now() -> Self

Capture both clocks together. A pre-epoch system clock saturates wall_ns to 0 (the same fail-safe the org module’s current_timestamp uses).

§33 — what that fail-safe actually buys, corrected. The previous note said admission “treats every finite expiry as in the future, which is fine”. The first half is right and the conclusion is not: with wall_ns == 0, check_expiry_at(0, skew) can never expire a proof and its TTL ceiling collapses to MAX_ORG_PROOF_TTL + skew, so proof FRESHNESS is entirely defeated, not merely permissive.

The call is still denied — but by an unrelated check: is_valid_at_with_skew(0, skew) returns NotYetValid for any real certificate, because no certificate’s not_before is 0. So the composition is fail-closed today for a reason this comment did not state, and any future ClockSample consumer that checks only an UPPER time bound would fail OPEN on a machine that boots with a dead RTC.

Reachable in practice: a board with a dead battery comes up at the epoch, and this is exactly when an operator is least likely to be watching admission decisions.

pub fn monotonic_deadline_for(&self, wall_deadline_ns: u64) -> Instant

The monotonic deadline corresponding to a wall-clock expiry (wall_deadline_ns, unix ns), derived RELATIVE to this one sample: monotonic + max(0, wall_deadline_ns - wall_ns).

A deadline already at or behind wall_ns yields self.monotonic (a zero-length retention — the proof is never held beyond its own life), so a proof that just failed freshness cannot be retained, and one that just passed is retained by exactly its remaining validity — consistent with the freshness check that used the same wall_ns.

pub fn wall_secs(&self) -> u64

This sample’s wall clock in whole unix seconds — the single ns→s conversion the second-granularity credential checks (is_valid_at_with_skew, provider self_verify_at) share, so caller AND provider verification read the SAME instant with no hidden second wall read (AV-6 item 6).

Trait Implementations

impl Clone for ClockSample

fn clone(&self) -> ClockSample

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ClockSample

impl Debug for ClockSample

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.