Struct Validator 

pub struct Validator { /* private fields */ }

The constraint validator.

Validates proposed changes against a set of constraints and the current committed state. Violations are resolved via declarative policies:

• AUTO_RESOLVED — policy handles it (e.g., LAST_WRITER_WINS)
• DEFERRED — queued for exponential backoff retry (CASCADE_DEFER)
• WEBHOOK_REQUIRED — caller must POST to webhook for decision
• ESCALATE — route to dead-letter queue (fallback)

Implementations

impl Validator

pub fn new(constraints: ConstraintSet, dlq_capacity: usize) -> Self

Create a new validator with default (ephemeral) policies.

pub fn new_with_policies( constraints: ConstraintSet, dlq_capacity: usize, policies: PolicyRegistry, deferred_capacity: usize, ) -> Self

Create a new validator with custom policies and deferred queue.

pub fn mark_bitemporal(&mut self, collection: impl Into<String>)

Register a collection as bitemporal. UNIQUE constraints for rows in this collection will scope to currently-live rows only.

pub fn is_bitemporal(&self, collection: &str) -> bool

Is the given collection registered as bitemporal?

pub fn dlq(&self) -> &DeadLetterQueue

Access the dead-letter queue.

pub fn dlq_mut(&mut self) -> &mut DeadLetterQueue

Mutable access to the DLQ (for dequeue/retry).

pub fn policies(&self) -> &PolicyRegistry

Access the policy registry.

pub fn policies_mut(&mut self) -> &mut PolicyRegistry

Mutable access to the policy registry.

pub fn deferred(&self) -> &DeferredQueue

Access the deferred queue.

pub fn deferred_mut(&mut self) -> &mut DeferredQueue

Mutable access to the deferred queue.

pub fn set_delta_verifier(&mut self, verifier: DeltaSigner)

Set the delta signature verifier. When set, deltas with non-zero signatures in their CrdtAuthContext will be verified before validation.

pub fn delta_verifier(&self) -> Option<&DeltaSigner>

Access the delta verifier.

pub fn delta_verifier_mut(&mut self) -> Option<&mut DeltaSigner>

Mutable access to the delta verifier.

impl Validator

pub fn validate_with_policy( &mut self, state: &CrdtState, peer_id: u64, auth: CrdtAuthContext, change: &ProposedChange, delta_bytes: Vec<u8>, hlc_timestamp: u64, ) -> Result<PolicyResolution>

Validate with declarative policy resolution.

This is the new core validation method. It attempts to resolve violations via policy before falling back to the DLQ.

Arguments

• state — current CRDT state
• peer_id — source peer ID
• change — proposed change
• delta_bytes — raw delta bytes
• hlc_timestamp — Hybrid Logical Clock timestamp of the incoming write

Returns:

• Ok(PolicyResolution::AutoResolved(_)) if the policy auto-fixed the violation
• Ok(PolicyResolution::Deferred { .. }) if deferred for retry (entry already enqueued)
• Ok(PolicyResolution::WebhookRequired { .. }) if webhook call needed (caller’s responsibility)
• Ok(PolicyResolution::Escalate) if escalating to DLQ (entry already enqueued)
• Err(_) if an internal error occurred

impl Validator

pub fn validate( &self, state: &CrdtState, change: &ProposedChange, ) -> ValidationOutcome

Validate a proposed change against all applicable constraints.

Returns Accepted if all constraints pass, or Rejected with detailed violation information.

pub fn validate_or_reject( &mut self, state: &CrdtState, peer_id: u64, auth: CrdtAuthContext, change: &ProposedChange, delta_bytes: Vec<u8>, ) -> Result<()>

Validate and apply declarative policy resolution.

Replay protection

When auth.delta_signature is non-zero, the following steps execute in this order to prevent replay attacks at minimum cost:

1. Cheap seq_no check — seq_no > last_seen[(user_id, device_id)]. Fails fast before any HMAC computation.
2. HMAC verification — constant-time comparison prevents timing attacks.
3. Atomic seq update — last_seen advances only on success.

For accepted changes, returns Ok(()). For violations, applies policy and:

• If AutoResolved: returns Ok(())
• If Deferred/Webhook/Escalate: returns appropriate error