Module types 

Ratify Protocol v1 types.

Every public key and every signature is a hybrid pair: one Ed25519 component and one ML-DSA-65 (FIPS 204) component. Both must verify.

Structs

AgentIdentity

An AI agent’s identity.

Anchor

Optional external binding for higher-assurance identity.

Constraint

First-class bound on when/where/how much an agent may exercise its scopes.

DelegationCert

Signed authorization from a principal to an agent.

HumanRoot

Master identity for a human (or tenant admin).

HybridPrivateKey

Both component private keys. Never serialized to the wire.

HybridPublicKey

Ed25519 + ML-DSA-65 public key pair.

HybridSignature

Ed25519 + ML-DSA-65 signature pair over the same canonical bytes.

KeyRotationStatement

Signed continuity statement from an old root key to a new root key.

PolicyVerdict

HMAC-bound cached policy decision (SPEC §17.6). The policy equivalent of SessionToken: issued once by a commercial policy backend, accepted locally by the verifier for the rest of valid_until without re-calling the backend.

ProofBundle

Proof an agent presents to a verifier.

ReceiptParty

One party to a TransactionReceipt.

ReceiptPartySignature

Hybrid signature by a party over the canonical receipt signable.

RevocationList

Signed list of revoked cert IDs, served by the issuer.

RevocationPush

v1.1 signed push notification of newly revoked cert IDs.

SessionToken

v1.1 verifier-issued credential that caches a verified chain. MAC = HMAC-SHA256(session_secret, session_token_sign_bytes(token)). The session secret is private to the verifier and never leaves its trust boundary.

StreamContext

Verifier state tracked per stream_id for v1.1 stream-bound bundles.

TransactionReceipt

v1.1 canonical envelope for a multi-party, atomic transaction.

TransactionReceiptResult

Outcome of verify_transaction_receipt.

VerificationReceipt

Verifier-signed attestation that a specific ProofBundle was verified at a specific moment with a specific outcome (SPEC §17.5).

VerifierContext

Application-supplied inputs for evaluating first-class constraints. A cert bearing a constraint whose required context field is absent will be rejected with constraint_unverifiable (fail-closed).

VerifyOptions

Options passed to verify_bundle.

VerifyResult

Deterministic output of verify_bundle. Always check valid first.

WitnessEntry

v1.1 element in a hash-chain append-only witness log.

Enums

IdentityStatus

Identity status values in a VerifyResult (SPEC §5.9). Granular failure statuses (scope_denied, constraint_denied, etc) let callers route on the enum directly — they do not have to parse error_reason text.

Constants

CHALLENGE_WINDOW_SECONDS

ED25519_PUBLIC_KEY_SIZE

ED25519_SIGNATURE_SIZE

MAX_DELEGATION_CHAIN_DEPTH

MLDSA65_PUBLIC_KEY_SIZE

MLDSA65_SIGNATURE_SIZE

PROTOCOL_VERSION

Traits

AnchorResolver

Resolves a verified human_id to its external-identity binding (SPEC §17.8). Errors are non-fatal: the verifier MUST NOT fail the bundle because the resolver errored — it silently leaves VerifyResult.anchor None and continues.

AuditProvider

Pluggable audit-receipt persistence (SPEC §17.3).

ConstraintEvaluator

Pluggable evaluator for extension constraint types (SPEC §17.7).

PolicyProvider

Pluggable evaluator for verifier-local policy (SPEC §17.2).

RevocationProvider

Pluggable provider for revocation state (SPEC §17.1).