Enum PayloadPolicy 

#[non_exhaustive]
pub enum PayloadPolicy<'a, V>
where
    V: PayloadValidator + ?Sized,
{
    Validate(&'a V),
    AcceptUnvalidated,
}

How consume_inbound performs SPEC.md §7.2 item 2 — payload-schema validation.

Read this before reaching for AcceptUnvalidated. In this library, item 2 is mostly already done by the time you hold a TrustTask<P>: deserializing into the generated types enforces required members, member types, additionalProperties: false, and the pattern / minLength constraints typify expresses as validating newtypes. A document that got this far has cleared all of that.

What it has not cleared is everything typify cannot express in a Rust type — minProperties, minItems on an optional array, conditional subschemas. That residue is what Validate catches, and it is why the choice is a required argument rather than a default: a consumer should decide knowingly whether that residue matters to it, not discover later that it never checked.

(The TypeScript binding is in a different position entirely — its types are erased at runtime, so nothing is enforced without a validator. Both libraries take the policy as a required argument so the two reach the same verdict on the same document.)

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Validate(&'a V)

Validate doc.payload against Payload::PAYLOAD_SCHEMA using V. Failures map to malformedRequest per §7.2 item 2.

Where the payload type carries no schema (PAYLOAD_SCHEMA is None, i.e. the hand-modelled trust-task-error) there is nothing to check and the document passes: the Rust type it deserialized into is itself the constraint.

AcceptUnvalidated

Accept the payload on the strength of deserialization alone, without the residual schema check.

Defensible — deserialization is a real check here, not a formality — but it is a decision, and this names it.

This variant carries no validator, so nothing pins V. Write it as PayloadPolicy::<NoValidator>::AcceptUnvalidated.