Struct Check 

pub struct Check<'xml, 'document, 'certificate, 'context, X, P> {
    pub xml: &'xml X,
    pub provider: &'context P,
    pub context: &'context CheckContext<'document, 'certificate>,
}

Complete common timestamp execution with original XML input selection.

The caller selects the TSA certificate/key and supplies explicit UTC facts. The resulting common facts/evidence still require caller path, revocation and algorithm-policy acceptance; this object never chooses a trusted certificate.

Fields

xml: &'xml X

Original XML owner, not a serialized or reconstructed document.

provider: &'context P

One selected provider for token signature, ESS and covered-input imprint.

context: &'context CheckContext<'document, 'certificate>

Original candidate certificate/key, producing reader and explicit time facts.

Implementations

impl<'xml, 'document, 'certificate, X: TimestampXml + BinaryXml, P> Check<'xml, 'document, 'certificate, '_, X, P>

pub fn retain_actor<PE, RE>( &self, bound: &Bound<X::Id, X::Document, X::Generation>, stamp: &Timestamp<X>, index: usize, operation: &Reader<'_>, recognizes: impl FnMut(&TokenExtension<'_>, &Execution<'_>) -> Result<bool, RE>, ) -> CheckResult<Option<TimestampActor<'certificate, 'document, X>>, X, PE, RE>

where P: for<'scope> SignatureProvider<'scope, Error = PE>,

Retains positive evidence with the actual selected certificate/key.

A later path/status phase cannot silently replace this signer or its inherited parameters. The same complete token/input kernel runs once; no certificate bytes, provider state or temporary context are copied. Path/status/UTC chronology and application trust remain separate.

pub fn retain<PE, RE>( &self, bound: &Bound<X::Id, X::Document, X::Generation>, stamp: &Timestamp<X>, index: usize, operation: &Reader<'_>, recognizes: impl FnMut(&TokenExtension<'_>, &Execution<'_>) -> Result<bool, RE>, ) -> CheckResult<Option<VerifiedTimestamp<X>>, X, PE, RE>

where P: for<'scope> SignatureProvider<'scope, Error = PE>,

Retains positive common evidence together with its actual XML input role, selected signature and original token identity, without copying evidence. No positive record is returned for a completed negative check. TSA trust, path/status, material completeness and baseline attainment remain separate.

pub fn run<R, PE, RE>( &self, bound: &Bound<X::Id, X::Document, X::Generation>, stamp: &Timestamp<X>, index: usize, operation: &Reader<'_>, recognizes: impl FnMut(&TokenExtension<'_>, &Execution<'_>) -> Result<bool, RE>, visitor: impl for<'checked> FnOnce(CheckedTimestamp<'checked>) -> R, ) -> CheckResult<LocatedValue<R, X>, X, PE, RE>

where P: for<'scope> SignatureProvider<'scope, Error = PE>,

Checks one actual RFC3161 token against its prescribed original XML input.

The scoped visitor receives the common complete-check facts. It may move independently retained Evidence out, but cannot retain borrowed token or decoded XML-buffer models. A readable malformed token remains a common nonconformance refusal rather than producing successful timestamp evidence.

pub fn retain_counter_actor<PE, RE>( &self, counter: &CounterStamp<X::Id, X::Document, X::Generation>, index: usize, operation: &Reader<'_>, recognizes: impl FnMut(&TokenExtension<'_>, &Execution<'_>) -> Result<bool, RE>, ) -> CheckResult<Option<TimestampActor<'certificate, 'document, X>>, X, PE, RE>

where P: for<'scope> SignatureProvider<'scope, Error = PE>,

Check a timestamp belonging to an actual nested countersignature. Its privately bound source scope selects the CHILD input through the root’s same token/profile kernel, without inventing a child baseline binding.

pub fn retain_actor_from<PE, RE>( &self, bound: &Bound<X::Id, X::Document, X::Generation>, stamp: &Timestamp<X>, entry: TokenEntry<'_, '_, X::Id, X::Document, X::Generation>, operation: &Reader<'_>, recognizes: impl FnMut(&TokenExtension<'_>, &Execution<'_>) -> Result<bool, RE>, ) -> CheckResult<Option<TimestampActor<'certificate, 'document, X>>, X, PE, RE>

where P: for<'scope> SignatureProvider<'scope, Error = PE>,

Retain evidence for a root timestamp from its original frozen pool entry. The pool’s selected encoding is reused without decoding or parsing the CMS envelope again. The original token and input must belong to the same timestamp on the bound signature. Declaration conformance remains a separate pool fact.

pub fn retain_counter_from<PE, RE>( &self, counter: &CounterStamp<X::Id, X::Document, X::Generation>, entry: TokenEntry<'_, '_, X::Id, X::Document, X::Generation>, operation: &Reader<'_>, recognizes: impl FnMut(&TokenExtension<'_>, &Execution<'_>) -> Result<bool, RE>, ) -> CheckResult<Option<TimestampActor<'certificate, 'document, X>>, X, PE, RE>

where P: for<'scope> SignatureProvider<'scope, Error = PE>,

Reuse an already decoded/parsed original child token from the frozen pool. The SAME common profile/check kernel supplies evidence; a fresh source reader preserves original and current ceilings without reparsing. Original signature/property/token/role are paid and matched BEFORE any provider or input replay. No receipt can relabel a sibling/root token.