Module digest 

Explicit object-digest Holder binding (RFC5755 §7.3), not authorization.

A key assertion covers DER effective SubjectPublicKeyInfo, not just key bits or the subject’s parameter-less SPKI. A certificate assertion covers the entire original DER Certificate, including its signature. Input selection is explicit; other Holder alternatives are never tried as a fallback. https://www.rfc-editor.org/rfc/rfc5755#section-7.3

Structs

BoundObject

A hash comparison bound to this original AC and this explicitly supplied object. No certificate trust, key possession or authorization follows from it.

Enums

Binding

Bound facts, semantic refusal and unavailable capability remain distinct.

BindingError

Original execution failures and provider contract failures, never mismatch.

Capability

A capability the selected provider cannot supply.

Failure

A completed semantic refusal; processing and callback failures use Result.

Object

The caller’s explicit object. A key need not have a public-key certificate.

Phase

Where a selected-provider operation failed.

Traits

ObjectDigestProvider

The selected digest provider’s representation check, before key hashing.