Enum CommandOrigin 

#[non_exhaustive]
pub enum CommandOrigin {
    DirectSafeUserAct {
        evidence_digest: Digest,
    },
    ConfirmedInteraction {
        interaction_id: InteractionId,
        payload_hash: Digest,
        interaction_kind: InteractionKind,
        action_class: ActionClass,
        channel: ResolutionChannel,
    },
    InternalPolicy {
        policy_key: String,
    },
    ExternalCallback {
        callback_id: String,
        signature_verified: bool,
    },
}

Who or what authorized a command (spec §14.2).

The enum grows as new authorization sources appear, so downstream matches need a wildcard arm.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

DirectSafeUserAct

A low-risk act grounded directly in validated user evidence.

Fields

evidence_digest: Digest

Digest of the validated evidence set.

ConfirmedInteraction

A stored option of a persisted interaction was chosen.

The three qualifying fields answer what was confirmed: the shape of the card, what its chosen option authorizes, and how the answer arrived. Without them a click on a “which trip did you mean?” card would be indistinguishable from a qualified signature (I12).

Fields

interaction_id: InteractionId

The interaction.

payload_hash: Digest

Hash of the payload the user saw.

interaction_kind: InteractionKind

Shape of the card that was answered.

action_class: ActionClass

What the chosen option authorizes.

channel: ResolutionChannel

How the answer reached the server.

InternalPolicy

A server-side policy decided the command (e.g. automatic follow-up, or a qualified professional’s review recorded out of band).

Fields

policy_key: String

Key of the policy.

ExternalCallback

An external system called back.

Fields

callback_id: String

Callback identifier.

signature_verified: bool

Whether the signature was verified. Unverified callbacks are untrusted.

Implementations

impl CommandOrigin

pub fn is_trusted(&self) -> bool

Returns true when the origin may authorize commands above RiskClass::ReversibleLowRisk (I12).

A confirmed interaction is trusted only when the chosen option actually authorizes commands and the answer did not come from an inference: a dismissed card and a model-interpreted “yes” are both untrusted.

pub fn satisfies_confirmation(&self, confirmation: ConfirmationPolicy) -> bool

Returns true when this origin is the specific authorization ConfirmationPolicy demands (spec §14.3, §15.7).

The mapping is deliberately narrow, because a confirmation is a statement about one act by one authority:

Policy	Accepted origin
None	any
ReviewCard, ExplicitClick	a ConfirmCommand or ReviewChanges card whose chosen option authorizes commands
Reauthentication	a Reauthenticate card, or a verified external callback
QualifiedSignature	an ExternalSignature card, or a verified external callback
HumanProfessionalReview	an internal policy or a verified external callback — never the end user’s own click

A ResolutionChannel::ModelInterpreted answer satisfies no policy but ConfirmationPolicy::None.

Trait Implementations

impl Clone for CommandOrigin

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CommandOrigin

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for CommandOrigin

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for CommandOrigin

impl Hash for CommandOrigin

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for CommandOrigin

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for CommandOrigin

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for CommandOrigin