Enum ProofPolicy 

#[non_exhaustive]
pub enum ProofPolicy<'a, V>
where
    V: ProofVerifier + ?Sized,
{
    Verify(&'a V),
    RejectIfPresent,
    AcceptUnverified,
}

How consume_inbound handles a document’s proof member, per SPEC.md §7.2 item 7.

consume_inbound does not assume what kind of integrity guarantees the consumer relies on. Some deployments verify Data Integrity proofs in-band; some have transport-layer integrity (signed DIDComm, mTLS- bound HTTPS) and accept in-band proofs only opportunistically; some have no integrity guarantees at all. The variants below make that decision explicit at the call site.

Payload::IS_PROOF_REQUIRED is consulted independently of the policy: a spec that requires a proof rejects a proofless document regardless of which policy was chosen.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Verify(&'a V)

Verify the proof when present using V. When doc.proof is Some, the verifier is consulted and failures map to proof_invalid. This is the safe default for any consumer that expects to honour in-band proofs.

RejectIfPresent

Reject documents that carry an in-band proof with malformed_request. Use this when the consumer has integrity guarantees from another layer (e.g. transport-bound signing) and is deliberately not verifying in-band proofs — silently dropping a producer-supplied proof would mislead the producer about the guarantees of the exchange, so the framework rejects the document instead.

AcceptUnverified

SECURITY: accept any document, with or without a proof, without verifying. Use only when the transport already provides equivalent integrity end-to-end (or the consumer has accepted the policy decision not to honour in-band proofs from this counterparty). This is the explicit opt-out — the variant name is deliberately uncomfortable to type.