Module validation 

RFC5755 profile and supplied-certificate checks, without an authorization verdict.

The component APIs keep signature, paths, holder identity, AA trust, time, targeting/proxy and status facts distinct (RFC5755 §5). usage composes them relative to explicit caller-authenticated protocol/trust inputs. A parsed critical extension is not, by itself, an enforced critical extension. https://www.rfc-editor.org/rfc/rfc5755#section-5

Modules

aa_path

RFC5755 §7.4 restrictions along one explicitly supplied AA certificate path.

authentication

Authenticated issuance and evaluation-window facts, not AC authorization.

digest

Explicit object-digest Holder binding (RFC5755 §7.3), not authorization.

usage

Relying-party AC processing over authenticated issuance and original evidence.

Structs

Profile

Static profile facts borrowing the original AC and owning decoded catalogues. A critical extension’s effect must still be enforced before using the AC.

Rejection

Original source of a completed profile or binding refusal.

Enums

Check

A completed check or a located semantic refusal. Execution failures use Result.

HolderMethod

A Holder alternative explicitly chosen by the authenticating protocol. No fallback or precedence is inferred when several alternatives are written.

Reason

A semantic refusal, never a substitute for resource or decoding failure.

Revocation

The issuer’s written revocation scheme, not an authenticated status answer.

Constants

AUDIT_IDENTITY

id-pe-ac-auditIdentity, RFC5755 §4.3.1.

NO_REV_AVAILABLE

id-ce-noRevAvail, RFC5755 §4.3.6.