Module authority 

Authority: logical form, canonical indexed form, attenuation.

• logical — the application-facing Logical Context of Authority: optional identity_context and execution { invariants, contract };
• indexed — the deterministic canonicalization into the Indexed Authority Map, which removal bitmaps and additions address by section-local numeric index;
• bitmap — canonical LSB-first removal bitmaps;
• attenuation — materialization of accepted attenuations and the non-expansion order.

Modules

attenuation

Attenuation and materialization (Profile 0.2).

bitmap

Removal bitmaps (Profile 0.2).

indexed

The canonical Indexed Authority Map (Profile 0.2).

logical

The Logical Context of Authority: the application-facing JSON form.

Structs

Attenuations

Parsed attenuations of one transition.

IndexedAuthorityMap

The canonical Indexed Authority Map carried by context_of_authority inside the PIC PCA COSE payload.

Invariant

One executable authority invariant: (scope, operation, resourceType, resourceId).

InvariantTuple

A [scope, operation, resourceType, resourceId] tuple. Element order is normative.

LogicalAuthority

The Logical Context of Authority: the application-facing JSON form { identity_context?, execution: { invariants, contract } }.

LogicalExecution

The execution member of the Logical Context of Authority.

ReferenceProfile

The reference attenuation profile: invariants and identity entries use subset inclusion; execution-contract constraints may only be preserved or extended (accumulating with AND).

RemoveBitmap

A canonical removal bitmap over the section-local indexes of one Indexed Authority Map section.

Enums

AuthorityValue

A logical authority value: a non-empty string or a non-empty array of non-empty strings. Profile 0.2 rejects numbers, booleans, objects, null, empty strings, and empty arrays in the logical input domain.

TupleValue

A canonical tuple value: a string, or the boolean true used as the canonical denormalized membership representation.

Traits

AttenuationOrder

The profile-defined attenuation order ≤ used for non-expansion validation. A Verifier rejects a state whose order it cannot evaluate deterministically.

Functions

materialize

Materializes the successor authority: predecessor map plus the accepted attenuations of one transition. Removal never adds authority; contract entries are never removed, replaced, or weakened.

Type Aliases

KvTuple

A [key, value] tuple for identity_context / execution_contract.