Enum VerifyErrorKind 

pub enum VerifyErrorKind {
    InvalidFormat,
    SignatureInvalid,
    Expired,
    IssuerInvalid,
    AudienceInvalid,
    MissingClaim(String),
    KeysetUnavailable,
    IdTokenAsBearer,
    IdToken(IdTokenFailureKind),
    Other,
}

Failure classification — mirrors the VerifyError and IdVerifyError surfaces but lives at the audit layer.

Stable, low-cardinality enum suitable for audit-dashboard pivots. MissingClaim carries the claim name as String (~6 well-known claims in production: "aud", "iat", "jti", "sub", "exp", "client_id") — still low-cardinality at the dashboard layer. The String allocation (vs &'static str in VerifyError::MissingClaim) is the cost of full serde round-trip support; per-event overhead is negligible on the rare-failure emission path.

Other is a flat catch-all — engine M-row identifier goes into AuditEvent::metadata under the key "engine_msg" to keep this enum bounded.

── id_token nesting (Phase 10.11.B) ───────────────────────────────────

OIDC-specific failure rows (M66-M73 + M29-mirror) live inside IdTokenFailureKind under a single nested variant IdToken(_). The audit-pivot pattern callers use:

match event.kind {
    VerifyErrorKind::IdToken(_) => bucket_for("id_token failures"),
    VerifyErrorKind::IdTokenAsBearer => bucket_for("M73 misuse"),
    VerifyErrorKind::Expired => bucket_for("token expired"),
    // ...
}

A single IdToken(_) arm filters the entire OIDC failure family — dashboards do not need to enumerate 14 names. Profile-agnostic JOSE failures (Expired, IssuerInvalid, AudienceInvalid, MissingClaim, SignatureInvalid, KeysetUnavailable, InvalidFormat) reuse the existing flat variants — they are shared between access_token and id_token verify surfaces, and forcing consumers to write a 2nd match arm for “id_token expired” distinct from “access_token expired” would noise the call site without changing the operator action (“token expired, refresh”). The audit log distinguishes the two via AuditEvent::source_id composition (compound azp ‖ aud ‖ kid for id_token vs client_id ‖ kid for access).

Variants

InvalidFormat

SignatureInvalid

Expired

IssuerInvalid

AudienceInvalid

MissingClaim(String)

KeysetUnavailable

IdTokenAsBearer

IdToken(IdTokenFailureKind)

Phase 10.11.B — nested OIDC-specific failure family. See IdTokenFailureKind.

Other

Trait Implementations

impl Clone for VerifyErrorKind

fn clone(&self) -> VerifyErrorKind

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for VerifyErrorKind

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for VerifyErrorKind

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for VerifyErrorKind

fn eq(&self, other: &VerifyErrorKind) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for VerifyErrorKind

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for VerifyErrorKind

impl StructuralPartialEq for VerifyErrorKind