Enum VerifyErrorKind 

pub enum VerifyErrorKind {
    InvalidFormat,
    SignatureInvalid,
    Expired,
    IssuerInvalid,
    AudienceInvalid,
    MissingClaim(String),
    KeysetUnavailable,
    IdTokenAsBearer,
    IdToken(IdTokenFailureKind),
    SessionVersionStale,
    SessionVersionLookupUnavailable,
    SessionRevoked,
    SessionLivenessLookupUnavailable,
    Other,
}

Failure classification — mirrors the VerifyError and IdVerifyError surfaces but lives at the audit layer.

Stable, low-cardinality enum suitable for audit-dashboard pivots. MissingClaim carries the claim name as String (~6 well-known claims in production: "aud", "iat", "jti", "sub", "exp", "client_id") — still low-cardinality at the dashboard layer. The String allocation (vs &'static str in VerifyError::MissingClaim) is the cost of full serde round-trip support; per-event overhead is negligible on the rare-failure emission path.

Other is a flat catch-all — engine M-row identifier goes into AuditEvent::metadata under the key "engine_msg" to keep this enum bounded.

── id_token nesting (Phase 10.11.B) ───────────────────────────────────

OIDC-specific failure rows (M66-M73 + M29-mirror) live inside IdTokenFailureKind under a single nested variant IdToken(_). The audit-pivot pattern callers use:

match event.kind {
    VerifyErrorKind::IdToken(_) => bucket_for("id_token failures"),
    VerifyErrorKind::IdTokenAsBearer => bucket_for("M73 misuse"),
    VerifyErrorKind::Expired => bucket_for("token expired"),
    // ...
}

A single IdToken(_) arm filters the entire OIDC failure family — dashboards do not need to enumerate 14 names. Profile-agnostic JOSE failures (Expired, IssuerInvalid, AudienceInvalid, MissingClaim, SignatureInvalid, KeysetUnavailable, InvalidFormat) reuse the existing flat variants — they are shared between access_token and id_token verify surfaces, and forcing consumers to write a 2nd match arm for “id_token expired” distinct from “access_token expired” would noise the call site without changing the operator action (“token expired, refresh”). The audit log distinguishes the two via AuditEvent::source_id composition (compound azp ‖ aud ‖ kid for id_token vs client_id ‖ kid for access).

Variants

InvalidFormat

SignatureInvalid

Expired

IssuerInvalid

AudienceInvalid

MissingClaim(String)

KeysetUnavailable

IdTokenAsBearer

IdToken(IdTokenFailureKind)

Phase 10.11.B — nested OIDC-specific failure family. See IdTokenFailureKind.

SessionVersionStale

Phase 11.Z — token’s sv claim below authoritative substrate (engine check_epoch reject). Distinct from Expired: stale is revocation-driven, expired is exp-bound. Audit dashboards pivot on this kind to surface break-glass propagation lag.

SessionVersionLookupUnavailable

Phase 11.Z — engine check_epoch could not reach its substrate (cache miss + fetcher transient). Fail-closed surface; audit dashboards pivot on this kind to surface substrate health problems distinct from cryptographic failure.

SessionRevoked

Phase 11.Z 0.10.0 (RFC_2026-05-08 §4.2) — L2 session liveness reject. Token’s sid resolved to a row absent OR with revoked_at set. Distinct from SessionVersionStale (L1): L2 = consumer-DB row revocation; L1 = cross-service break-glass propagation. Pivots help operators distinguish per-session logout traffic from cluster-wide break-glass bumps.

SessionLivenessLookupUnavailable

Phase 11.Z 0.10.0 — L2 session liveness substrate unreachable. Fail-closed surface; audit dashboards pivot on this kind to surface consumer-DB substrate health problems distinct from SessionVersionLookupUnavailable (L1 substrate health).

Other

Trait Implementations

impl Clone for VerifyErrorKind

fn clone(&self) -> VerifyErrorKind

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for VerifyErrorKind

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for VerifyErrorKind

fn deserialize<__D>( __deserializer: __D, ) -> Result<VerifyErrorKind, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for VerifyErrorKind

impl From<&VerifyError> for VerifyErrorKind

Map VerifyError to the audit-layer kind enum.

Lives here (in token/jwt.rs, gated by well-known-fetch) rather than in audit/sink.rs to preserve the dependency direction: the always-compiled audit module knows nothing about VerifyError (which is gated behind feature = "token"); the JWT adapter, which produces VerifyError, maps to the audit-side kind enum at the boundary. Inverting this would force feature = "token" to become transitively required for the audit module, which is the opposite of Phase 9 refinement #3.

fn from(err: &VerifyError) -> VerifyErrorKind

Converts to this type from the input type.

impl PartialEq for VerifyErrorKind

fn eq(&self, other: &VerifyErrorKind) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for VerifyErrorKind

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for VerifyErrorKind