Enum EpochEnforcement 

pub enum EpochEnforcement {
    Enforced(Arc<dyn EpochRevocation>),
    EnforcedElsewhere {
        gate: &'static str,
    },
    Unenforced {
        reason: &'static str,
    },
}

Required typed stance on the sv epoch axis (RFC_202607150428 §7 Q3, resolved 2026-07-17).

Every super::VerifyConfig carries exactly one of these — the former epoch: Option<Arc<dyn EpochRevocation>> slot let four shipped consumers silently skip the axis (None was both “not yet wired” and “deliberately unwired”, indistinguishable). Silence is now unrepresentable: a verify site that does not enforce the axis must SAY SO, in a variant whose name and payload are greppable and whose boot declaration is visible in logs (STANDARDS_FAILURE_MODE §4 — emission IS declaration).

── Variant semantics ──────────────────────────────────────────────

• Enforced — the engine gates every verify through the port (check_epoch::run): missing sv rejects (unstamped, S6), stale sv rejects, substrate-down rejects fail-closed. The only variant that reaches the port.
• EnforcedElsewhere — the axis IS enforced on this request path, by a named gate outside this engine call. Sole legitimate case today: PAS self-verify, where port.current(sub) would self-loop into the same session_version_repo that performs the bump, so the session::liveness single gate checks sv AFTER verify (accounts-api/src/auth.rs). Boot-declares at INFO — a correct configuration must not cry wolf at WARN.
• Unenforced — a declared, bounded gap: this deployment has no epoch substrate (RCW/CTW: no KVRocks, separate DB, published-SDK consumers — RFC_202607150428 §6·S5 deferral). Boot-declares at WARN so the gap is permanently visible in logs.

The engine short-circuits (admits past the sv axis) for both named non-Enforced variants — identical wire behavior to the retired None, but the stance is now typed, named, and logged.

Variants

Enforced(Arc<dyn EpochRevocation>)

sv axis gated through the port on every verify (fail-closed).

EnforcedElsewhere

sv axis enforced by a NAMED gate elsewhere on the same request path (engine skips; the gate runs outside this verify call).

Fields

gate: &'static str

The gate that owns the check, e.g. "session::liveness".

Unenforced

sv axis NOT enforced at this deployment — a declared, bounded gap. declare() WARNs at boot.

Fields

reason: &'static str

Why the substrate is absent and what bounds the gap.

Implementations

impl EpochEnforcement

pub fn declare(&self, face: &str)

Boot-time declaration — call ONCE per long-lived verifier / perimeter, not per request. Emission IS declaration: the stance a face runs under must be readable from its boot log.

Trait Implementations

impl Clone for EpochEnforcement

fn clone(&self) -> EpochEnforcement

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EpochEnforcement

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.