Module signed_writes 

Signed Writes — pure logic for CREATE COLLECTION ... SIGNED_BY (...).

A collection with a non-empty signer registry rejects every INSERT that does not carry a valid Ed25519 signature produced by one of the currently-allowed signer keys. This module provides the deterministic, side-effect-free pieces of that contract:

• The reserved column names + byte widths injected on SIGNED_BY collections.
• A SignerRegistry holding the currently allowed keys plus an append-only SignerHistoryEntry log of admin mutations.
• The SignedWriteError taxonomy that the engine maps onto HTTP 400 / 401 responses.
• verify_insert — the single entry point the insert path will call to validate one row.

Issue #522 wires this into the runtime insert path, REST error mapping, and the catalog persistence of the registry. This file is intentionally self-contained so the wiring is a thin adapter on top of audited logic.

Structs

InsertSignatureFields

Result of looking at the row-supplied signer + signature columns before verification. None for either side means the caller passed NULL / omitted column entirely.

SignerHistoryEntry

One entry in the append-only admin history of a signer registry.

SignerRegistry

Mutable signer registry attached to a SIGNED_BY collection.

Enums

SignedWriteError

Failure modes for a signed-writes INSERT. The runtime maps each variant onto an HTTP status:

SignerHistoryAction

Action recorded in SignerRegistry::history.

Constants

RESERVED_SIGNATURE_COL

Reserved column auto-added to every signed-writes collection. Holds the 64-byte raw Ed25519 signature over the canonical payload.

RESERVED_SIGNER_PUBKEY_COL

Reserved column auto-added to every signed-writes collection. Holds the 32-byte Ed25519 public key the signer used to sign the row.

SIGNATURE_LEN

Length of a raw Ed25519 signature, in bytes.

SIGNER_PUBKEY_LEN

Length of a raw Ed25519 public key, in bytes.

Functions

reverify_row

Re-verify a previously-accepted row by its stored signer_pubkey + signature + canonical payload. Used by integrity scans (/admin/verify-collection) — does NOT consult the registry, so rows signed by since-revoked keys still re-verify Ok. This is the property the issue calls out:

verify_insert

Top-level insert-time verification.