Skip to main content

classify_subagent_spawn

Function classify_subagent_spawn 

Source
pub fn classify_subagent_spawn(
    trust: &RoleTrustSet<SubagentRole>,
    spawn: &SubagentSpawn,
) -> SignatureVerdict
Expand description

Classifies the provenance signature on spawn against trust.

The verdict is SignatureVerdict::Verified only when the signature checks out against the embedded signed_by key AND trust holds that key for the sub-agent role. A good signature from a key outside trust reads as SignatureVerdict::Untrusted. Bad hex, a bad signature, and a malformed key all read as SignatureVerdict::Invalid. The function never panics.