Struct NewTransaction 

pub struct NewTransaction {
    pub request_id: String,
    pub request_hash: String,
    pub action_name: String,
    pub risk_level: RiskLevel,
    pub summary: String,
    pub warnings: Vec<String>,
    pub caller_role: CallerRole,
    pub caller_principal: CallerPrincipal,
}

Data provided by the caller when recording a new transaction.

The initial status is always Queued — it is not caller-controllable. Hardcoding this in the store prevents callers from bypassing the state machine by recording a transaction in a terminal state.

Fields

request_id: String

request_hash: String

action_name: String

risk_level: RiskLevel

summary: String

Human-readable description of the planned action.

Chain-hashed at INSERT; intentionally not in the mutable field set.

summary is captured in crate::audit_chain::ChainContent and baked into chain_hash = ed25519_sign(canonical(fields) || prev_hash, key) at the moment the row is written. After that point the stored signature is a one-time commitment.

Do not add an update_summary API (or any equivalent that modifies this field in an existing row). Any such change will cause sysknife audit verify to report VerifyOutcome::Broken for the modified row, because the signature will no longer verify against the stored chain_hash.

If a correction is genuinely needed, use one of the two safe strategies documented on crate::audit_chain::ChainContent:

1. Insert a corrective row that references the original transaction_id.
2. Extend the chain protocol with a dedicated amendment record type.

warnings: Vec<String>

caller_role: CallerRole

Role the daemon resolved for the connection that asked for this action.

Chain-hashed at INSERT alongside summary. Before this field existed the signed record could say what was authorised but not which privilege tier asked; which account asked is caller_principal below. Not caller-supplied over the wire: the dispatcher passes the role it resolved from SO_PEERCRED (or the vsock token), never a value from the request body.

caller_principal: CallerPrincipal

Which account asked, as opposed to what its role permitted.

Chain-hashed at INSERT alongside caller_role. The role alone cannot separate two members of sysknife-admin, so a trail built only from it answers “an Admin did this” and stops there. Like the role, this is resolved by the dispatcher from the connection, never read from the request body. See crate::auth::CallerPrincipal.

Trait Implementations

impl Clone for NewTransaction

fn clone(&self) -> NewTransaction

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NewTransaction

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for NewTransaction

impl PartialEq for NewTransaction

fn eq(&self, other: &NewTransaction) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for NewTransaction