Module identity 

Identity — the id type, what makes one well-formed, and when a document earns one.

An id is a stable, opaque name for a document. This module holds the Id newtype, the alphabet and length it is spelled in, verify — the check-character arithmetic that catches a typo’d id: link before it dangles silently — and the policy half: the trigger set that decides when a document earns an id (Registration) and the IdentityPolicy that produces one (Minter).

Policy lives here rather than a layer up because none of it touches storage. IdentityPolicy::mint is a seeded PRNG and mint_workspace_id is a pure function; neither can see a workspace, so neither can write to one. The actual write — mint-with-rejection against the index, retrying until the id is unheard-of — is prov’s Workspace::register, above this crate’s read-only boundary. Where ids are stored is IdStorage and crate::index.

Identity is optional throughout. The graph and mutation layers operate on paths and never require an id. The default is NoIdentity — identity off, no id ever written. The recommended lazy policy registers an id only when something durably refers to a document (a link-by-id or a publish), keeping the authoritative set as small as possible.

The ID scheme

Prov’s internal IDs share their lineage with diaryx’s ARK blades but carry no NAAN or shoulder — they are workspace-internal, not published permalinks (DESIGN §4’s two identity layers). The primitives come from the moid crate (minimal opaque ID): an ID is BLADE_RANDOM_LEN random characters from the 29-character NOID extended-digit alphabet (moid::Alphabet::noid_xdigit — digits plus consonants: no vowels, so no accidental words; no l, so no ambiguity with 1) plus one NOID check character, so a typo’d ID is detected rather than silently resolving to nothing. The alphabet is the canonical NOID one, so the check character agrees with a real NOID minter and not merely with our own arithmetic. An ID may therefore contain — and begin with — a digit; anything stamping one into metadata must keep it a string (see prov-store’s edit::infer_scalar).

Minting is random (opaque for free), with uniqueness enforced by rejection against the index — including its tombstones, so a deleted document’s ID is never reissued.

Structs

Id

A stable, opaque document identifier.

Minter

The bundled minting policy: NOID xdigit + check IDs from a seeded PRNG.

NoIdentity

Identity disabled — the default. Paths only; no ID is ever minted or written.

Registration

Which events cause a document to be assigned (registered) an ID.

Enums

IdStorage

Where a document’s stable ID is persisted — the identity-storage axis (DESIGN §5). Orthogonal to when an ID is minted (Registration) and to how references are spelled; this is purely the ID’s home.

Trigger

The registration event a caller is asking about (for example, a workspace’s register operation).

Constants

BLADE_LEN

Total ID length: the random body plus one check character.

BLADE_RANDOM_LEN

Random characters per ID (excluding the check character). 29^6 ≈ 595M — collision-free in practice for a workspace, enforced absolutely by mint-with-rejection.

WORKSPACE_NAME_LEN

Total length of a minted workspace name: WORKSPACE_NAME_RANDOM_LEN plus the check character every moid blade ends with.

WORKSPACE_NAME_RANDOM_LEN

Random characters in a minted workspace name — twice a document blade’s BLADE_RANDOM_LEN, for a different uniqueness problem.

Traits

IdentityPolicy

A policy deciding when to register documents and how their IDs are minted.

Functions

mint_workspace_id

Mint an opaque global name for a workspace, randomizing from seed.

verify

Whether id is a well-formed prov ID: correct length, alphabet-only, and a matching trailing check character. This is what catches a typo’d prov: link before it dangles silently.