Enum SensingInterestFrame 

pub enum SensingInterestFrame {
    CapabilityRegistration {
        capability_id: CapabilityId,
        constraints: Vec<u8>,
        constraints_digest: Digest256,
        work_latency: WorkLatencyEnvelope,
        providers: ProviderSelector,
        result_mode: ResultMode,
        interest_digest: Digest256,
        requested_sample_interval: Duration,
        soft_state_ttl: Duration,
        audience_scope: AudienceScopeCommitment,
        consumer: u64,
    },
    ProviderRegistration {
        target: u64,
        capability_id: CapabilityId,
        constraints: Vec<u8>,
        constraints_digest: Digest256,
        work_latency: WorkLatencyEnvelope,
        providers: ProviderSelector,
        result_mode: ResultMode,
        disclosure_class: DisclosureClass,
        audience_scope: AudienceScopeCommitment,
        interest_digest: Digest256,
        requested_sample_interval: Duration,
        soft_state_ttl: Duration,
    },
    Deregister {
        interest_digest: Digest256,
        target: Option<u64>,
    },
    OrgCapabilityRegistration {
        capability_id: CapabilityId,
        constraints: Vec<u8>,
        constraints_digest: Digest256,
        work_latency: WorkLatencyEnvelope,
        providers: ProviderSelector,
        result_mode: ResultMode,
        interest_digest: Digest256,
        requested_sample_interval: Duration,
        soft_state_ttl: Duration,
        audience_scope: AudienceScopeCommitment,
        consumer: u64,
        subscriber_membership: OrgMembershipCert,
    },
    OrgProviderRegistration {

        target: u64,
        capability_id: CapabilityId,
        constraints: Vec<u8>,
        constraints_digest: Digest256,
        work_latency: WorkLatencyEnvelope,
        providers: ProviderSelector,
        result_mode: ResultMode,
        disclosure_class: DisclosureClass,
        audience_scope: AudienceScopeCommitment,
        interest_digest: Digest256,
        requested_sample_interval: Duration,
        soft_state_ttl: Duration,
        subscriber_membership: OrgMembershipCert,
    
},
}

One frame of the sensing-interest subprotocol family (plan §4.2). See the module docs for the two-leg shape and the SI-0/SI-1 boundary.

Variants

CapabilityRegistration

Consumer → leader: the provider-free capability interest, carrying the full canonical predicate + selector + mode so the leader can re-derive the digest, coalesce BEFORE provider selection, and resolve bounded candidates.

Fields

capability_id: CapabilityId

Capability the predicate targets.

constraints: Vec<u8>

Inline canonical constraint bytes C (super::identity::CanonicalConstraints::canonical_bytes, ≤ max_constraint_bytes).

constraints_digest: Digest256

Digest the inline bytes must hash to (truncation/tampering detection, plan §4.2).

work_latency: WorkLatencyEnvelope

Provider-evaluated latency envelope L.

providers: ProviderSelector

The provider population — the leader needs it to resolve.

result_mode: ResultMode

The result cardinality — the leader needs it to bound exploration.

interest_digest: Digest256

The sender’s claimed interest identity. Cross-checked by re-derivation at the leader; never the coalescing identity by itself.

requested_sample_interval: Duration

D — the delivery-continuity interval (min-dominance upstream; not identity).

soft_state_ttl: Duration

Per-downstream soft-state lifetime.

audience_scope: AudienceScopeCommitment

Wire scope claim (v1: the owner-root commitment). Cross-checked against the session-proven root, never load-bearing (plan §4.10).

consumer: u64

The registering consumer’s node id. Bound to the authenticated routed origin at the leader — NEVER trusted alone (plan §4.10, review 7).

ProviderRegistration

Leader → provider: the provider-targeted readiness interest. The provider evaluates the predicate, not the population — but selector, result mode, and disclosure class ride along for COMPLETE digest verification (review 7 sign-off, plan §4.2): the provider re-derives the full interest identity and signs only the VALIDATED digest, never an opaque claim.

Fields

target: u64

The provider this branch targets (routes via next_hop(target)).

capability_id: CapabilityId

Capability the predicate targets.

constraints: Vec<u8>

Inline canonical constraint bytes C.

constraints_digest: Digest256

Digest the inline bytes must hash to.

work_latency: WorkLatencyEnvelope

Provider-evaluated latency envelope L.

providers: ProviderSelector

The provider population. Carried for digest verification only — it never affects provider-side predicate evaluation (plan §4.2, review 7).

result_mode: ResultMode

The result cardinality. Carried for digest verification only.

disclosure_class: DisclosureClass

The disclosure class. Carried for digest verification only.

audience_scope: AudienceScopeCommitment

Wire scope claim (cross-checked, never load-bearing); also digest-bound as the interest audience.

interest_digest: Digest256

The capability-interest identity this branch serves — re-derived from the COMPLETE carried fields and validated at the provider before anything is evaluated or signed (Self::validate_provider_registration).

requested_sample_interval: Duration

Aggregated (strictest) D for the branch.

soft_state_ttl: Duration

Soft-state lifetime of the branch registration.

Deregister

Withdraw an interest: leader-addressed when target is None, provider-addressed (one branch) when Some.

Fields

interest_digest: Digest256

The interest identity to withdraw.

target: Option<u64>

Provider branch to withdraw, or None for the leader-addressed (whole-interest) withdrawal.

OrgCapabilityRegistration

Organization-authenticated leader-addressed registration (OLB org-auth slice) — the Self::CapabilityRegistration semantic fields plus the registering hop’s membership certificate. Postcard variant index 3 (appended; the legacy indices 0/1/2 are frozen). The membership is validated at every receiving hop BEFORE any table mutation (verify_org_sensing_registration, commit 2); this variant is structurally dark until that gate exists.

Fields

capability_id: CapabilityId

Capability the predicate targets.

constraints: Vec<u8>

Inline canonical constraint bytes C.

constraints_digest: Digest256

Digest the inline bytes must hash to.

work_latency: WorkLatencyEnvelope

Provider-evaluated latency envelope L.

providers: ProviderSelector

The provider population — the leader needs it to resolve.

result_mode: ResultMode

The result cardinality — the leader needs it to bound exploration.

interest_digest: Digest256

The sender’s claimed interest identity (re-derived + cross checked; never the coalescing identity by itself).

requested_sample_interval: Duration

D — the delivery-continuity interval (not identity).

soft_state_ttl: Duration

Per-downstream soft-state lifetime.

audience_scope: AudienceScopeCommitment

Wire scope claim — the owner-root/organization commitment; cross-checked against subscriber_membership.org_id’s canonical sensing commitment, never load-bearing alone.

consumer: u64

The registering consumer’s node id (bound to the authenticated origin at intake, never trusted alone).

subscriber_membership: OrgMembershipCert

The registering hop’s organization membership certificate. Rides the wire as its canonical 156-byte encoding (the type’s manual serde); verified at every receiving hop.

OrgProviderRegistration

Organization-authenticated provider-addressed registration (OLB org-auth slice) — the Self::ProviderRegistration semantic fields plus the re-registering hop’s membership certificate. Postcard variant index 4 (appended). A relay re-authors this with its OWN membership; it never forwards the downstream consumer’s certificate (commit 3). Structurally dark until the membership gate exists (commit 2).

Fields

target: u64

The provider this branch targets.

capability_id: CapabilityId

Capability the predicate targets.

constraints: Vec<u8>

Inline canonical constraint bytes C.

constraints_digest: Digest256

Digest the inline bytes must hash to.

work_latency: WorkLatencyEnvelope

Provider-evaluated latency envelope L.

providers: ProviderSelector

The provider population (carried for digest verification).

result_mode: ResultMode

The result cardinality (carried for digest verification).

disclosure_class: DisclosureClass

The disclosure class (carried for digest verification).

audience_scope: AudienceScopeCommitment

Wire scope claim (cross-checked; also digest-bound).

interest_digest: Digest256

The capability-interest identity this branch serves.

requested_sample_interval: Duration

Aggregated (strictest) D for the branch.

soft_state_ttl: Duration

Soft-state lifetime of the branch registration.

subscriber_membership: OrgMembershipCert

The re-registering hop’s own organization membership certificate (never the consumer’s). Canonical 156-byte encoding; verified at every receiving hop.

Implementations

impl SensingInterestFrame

pub fn capability_registration( spec: &InterestSpec, requested_sample_interval: Duration, soft_state_ttl: Duration, consumer: u64, ) -> Self

Build the leader-addressed registration for a spec: inline constraint bytes, both digests, and the consumer binding all derived from the same source, so an honest sender cannot produce an internally inconsistent frame.

pub fn provider_registration( spec: &InterestSpec, target: u64, requested_sample_interval: Duration, soft_state_ttl: Duration, ) -> Self

Build the provider-addressed registration for a resolved branch of a spec. Selector, mode, and disclosure class are carried so the provider can verify the COMPLETE digest it will sign (review 7 sign-off, plan §4.2).

pub fn org_capability_registration( spec: &InterestSpec, requested_sample_interval: Duration, soft_state_ttl: Duration, consumer: u64, subscriber_membership: OrgMembershipCert, ) -> Self

Build the organization-authenticated leader-addressed registration for a spec, carrying the registering hop’s membership certificate (OLB org-auth slice). Same semantic derivation as Self::capability_registration.

pub fn org_provider_registration( spec: &InterestSpec, target: u64, requested_sample_interval: Duration, soft_state_ttl: Duration, subscriber_membership: OrgMembershipCert, ) -> Self

Build the organization-authenticated provider-addressed registration for a resolved branch, carrying the re-registering hop’s OWN membership certificate (OLB org-auth slice). Same semantic derivation as Self::provider_registration.

pub fn reconstruct_spec( &self, constraints: CanonicalConstraints, ) -> Option<InterestSpec>

Rebuild the COMPLETE InterestSpec a registration frame carries, given the already-validated parse of its inline constraint bytes. None for Self::Deregister (it carries no spec).

The leader-addressed leg does not carry a disclosure class on the wire; v1 is owner-root-only (plan §4.10), so it reconstructs as DisclosureClass::Owner — exactly what every v1 sender digested.

This is the single reconstruction BOTH legs share; callers almost always want Self::validated_spec, which also validates the constraints and cross-checks the re-derived digest against the frame’s claim.

pub fn validated_spec( &self, counters: &SensingCounters, ) -> Result<InterestSpec, FrameSpecError>

The shared registration-intake pipeline (plan §4.2, review 7 — used by BOTH legs: the leader’s gate (r) intake and the provider’s transcript invariant):

1. canonicalize + digest-validate the inline constraint bytes (validate_interest_constraints, which owns the invalid-constraints/security counting);
2. reconstruct the COMPLETE InterestSpec from the carried fields (Self::reconstruct_spec);
3. re-derive interest_digest and cross-check the frame’s claim — a mismatch is protocol-invalid input (SensingCounters::protocol_invalid);
4. only then hand back the validated spec. The RE-DERIVED identity — never the claim — is what coalesces at the leader and what the provider signs.

pub fn validate_provider_registration( &self, counters: &SensingCounters, ) -> Result<ValidatedProviderRegistration, FrameSpecError>

Provider-side intake for the provider-addressed leg (the SI-1 transcript invariant, review 7 sign-off): the provider must never evaluate — let alone sign — against an opaque, unvalidated interest-digest claim. Runs Self::validated_spec and hands back the validated spec together with the branch parameters the provider needs.

Checking that target names this node, and that the frame arrived from an authenticated upstream, is the dispatch layer’s job (SI-2) — exactly as the leader’s consumer/origin cross-check lives at ITS intake.

Trait Implementations

impl Clone for SensingInterestFrame

fn clone(&self) -> SensingInterestFrame

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SensingInterestFrame

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SensingInterestFrame

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for SensingInterestFrame

impl PartialEq for SensingInterestFrame

fn eq(&self, other: &SensingInterestFrame) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for SensingInterestFrame

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SensingInterestFrame