Struct Custody 

pub struct Custody {
    pub mode: CustodyMode,
    pub signer: String,
    pub on_behalf_of: String,
    pub reason: Option<String>,
}

Who signed, when that is not the actor itself.

This is a separate axis from attestation_class, and keeping them separate is the point. attestation_class grades how evidence was captured (self / runtime / countersigned). Custody grades who held the key. They vary independently: a service-mediated room can have excellent runtime-captured evidence and still be custodially signed, and an agent signing for itself can have nothing but its own word.

Collapsing them is the same error EffectConfidence and EffectFinality exist to avoid – one label carrying two unrelated questions, where a reader cannot tell which one a value is answering.

The distinction is not cosmetic. Under self-custody, forging a participant’s action requires that participant’s key. Under delegated custody, a compromised service can mint any history it likes for every actor it signs for. Same receipt shape, different threat model, so the receipt says which.

Fields

mode: CustodyMode

Custody mode. Only delegated is ever serialized – self-custody is represented by the whole section being absent, so existing receipts stay byte-identical and “no custody block” cannot be misread as “custody unknown”.

signer: String

The identity whose key actually produced the signature, e.g. svc://gateway-rooms. This is who a verifier is really trusting.

on_behalf_of: String

The actor the signature is claimed to be for, e.g. agent://fizz. A verifier can confirm signer signed; it cannot confirm this actor agreed, and must not present it as though it could.

reason: Option<String>

Optional human-readable reason the actor did not sign for itself (e.g. “browser-mediated room; participants hold no local key”).

Implementations

impl Custody

pub fn delegated( signer: impl Into<String>, on_behalf_of: impl Into<String>, ) -> Self

A service signing for an actor that holds no key of its own.

pub fn with_reason(self, reason: impl Into<String>) -> Self

Attach the reason the actor did not sign for itself.

Trait Implementations

impl Clone for Custody

fn clone(&self) -> Custody

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Custody

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Custody

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Custody

impl PartialEq for Custody

fn eq(&self, other: &Custody) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Custody

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Custody