Crate vta_keyspaces

Expand description

Central registry of the VTA’s keyspace names.

Every store.keyspace(..) call in the VTA (vta-service server, offline CLIs, backup, tests) names its keyspace through a const here rather than a bare string literal. This is the single source of truth that killed the "imported" / "imported_secrets" test-vs-production divergence (a test opened a different, empty keyspace than the one production writes). The no_bare_keyspace_literals guard in vta-service keeps it that way by scanning that crate’s source for bare .keyspace("…") literals.

Keyspace names live here; per-keyspace key formats (the key:, seed:, path_counter: … record families inside a keyspace) are a separate concern and are not yet centralised.

A near-leaf crate: it holds the shared keyspace vocabulary (the name constants) plus the Keyspaces handle bundle, so that every VTA subsystem crate can name and pass keyspaces without depending on vta-service. Its only dependency is vti-common (for KeyspaceHandle).

Structs§

Keyspaces: Shared bundle of borrowed keyspace handles passed to operations that need several keyspaces at once.

Enums§

DidDeleteEffect: What happens to a keyspace’s DID-keyed contents when that DID is deleted.

Constants§

ACL: ACL entries + the seal record + the integrity-anchor root.
ALL: Every production keyspace. Partitioned by BACKED_UP + EXCLUDED_FROM_BACKUP; the [tests::backup_partition_is_total] guard asserts the partition stays exhaustive so a newly-added keyspace can’t be silently omitted from the backup decision.
APP_STATE: Versioned, namespaced application state (vta/app-state/{get,put,list, delete,get-many,put-many}/1.0) — the third store, beside VAULT (secrets and credentials) and MEMORY (agent memory), for JSON an application owns and the VTA does not interpret.
AUDIT: Audit log.
AUDIT_KEY: The keyed-hash keys the audit log commits actor and target identifiers under, and their history.
BACKED_UP: Keyspaces whose contents a full export_backup captures (as typed collections — see operations::backup).
BACKUP_BUNDLES: In-flight backup-bundle control-plane records.
BOOTSTRAP: KMS-protected, unencrypted boot keyspace (TEE integrity manifest, etc.).
CACHE: Ephemeral cache (resolver/auth caches).
CONSENT: Inbound-messaging consent: durable grants + TTL’d pending requests (vti_common::consent). The VTA is the first gate for bridged conversations.
CONSENT_APPROVERS: Per-(platform, context) approver bindings — who decides consent and how the prompt routes (vti_common::consent::ApproverBinding).
CONTEXTS: Trust contexts (the BIP-32 key hierarchy roots).
DID_TEMPLATES: Stored DID templates (global + context-scoped).
DRAINS: Persisted protocol-management drain set.
EXCLUDED_FROM_BACKUP: Keyspaces deliberately not in a backup.
IDEMPOTENCY: Idempotency records for keyed Trust Tasks — one row per (actor, idempotency-key), holding the request digest and, for tasks whose response may be replayed, the original response. Lets a client’s retry of a lost reply converge on the first execution instead of producing a second durable effect.
IMPORTED_SECRETS: Imported secret material (KEK-wrapped). Named imported_secrets, not imported — the latter was a long-standing test-only typo that operated on an empty keyspace disjoint from production. Always reference this const.
INTERNAL_KEYS: Non-extractable internal signing keys.
ISSUED_CREDENTIALS: VTA-issued credentials (minted by vta/credentials/issue/0.1, revoked by vta/credentials/revoke/0.1). One record per credential keyed cred:<id>; revocation is a tombstone (revokedAt set in place), not a delete. Distinct from VAULT (which stores credentials the holder holds).
KEYS: Master seed + key records (key:, seed:, path_counter:, active_seed_id, imported_kek_salt, …) and the backup import sentinel.
MEMORY: Per-context key/value store for AI-agent memory (vta/memory/{put,list, delete}/0.1). One record per (contextId, key) pair, keyed mem:<contextId>:<key>; list is a mem:<contextId>: prefix scan. Durable user data → in BACKED_UP.
OUTBOX: Durable reliable-messaging outbox backing vti_common::outbox_store:: VtiOutboxStore for the delivery-layer MessagingService (D2 P2a cut-over). Holds Guaranteed-delivery outbox entries; dormant in P2a (all current sends are BestEffort) but wired so the drain/confirmation loops persist across restarts once P2b adds guaranteed VTA pushes. Runtime state, not backed up.
PASSKEY_VMS: In-flight passkey-as-verificationMethod enrolment state.
PERSONA: The holder’s identity attributes, profiles, bindings and contacts (persona/*) — the fourth store, beside VAULT (secrets and credentials), MEMORY (agent memory) and APP_STATE (uninterpreted application JSON).
POLICY: Rego policy modules for the Policy Decision Point (policy/{upsert,list, delete,evaluate}). One policy::PolicyModule per id, keyed policy:<id>; the active set is every enabled row, priority-ordered. Durable operator security config → in BACKED_UP (a lost policy set would silently drop enforcement on restore).
ROOM_GROUPS: A member’s MLS group state for each data room they belong to (rooms/keys/{welcome,commit,open}), keyed room-group:<roomId>.
ROOM_INVITATIONS: Invitation credentials this VTA has consumed by joining a room (rooms/keys/welcome), keyed room-vic:<credentialId>.
SEALED_NONCES: Sealed-bootstrap anti-replay nonce log.
SERVICE_STATE: Persistent runtime service-enable state (operations::protocol::runtime_state).
SESSIONS: Auth sessions + challenges.
SNAPSHOT: Per-kind previous-config snapshots for fail-forward rollback. (Historically operations::protocol::snapshot::KEYSPACE_NAME.)
TASK_CONSENT: Task-execution consent for the PDP’s requireConsent disposition: pending approvals keyed by payload digest, and granted consents a re-submitted task consumes. Distinct from CONSENT (messaging-bridge conversation consent). One policy::consent::PendingTaskConsent per pending:<digest> and policy::consent::TaskConsentGrant per grant:<digest>:<requester>. Durable operator-facing security state → BACKED_UP.
VAULT: Holder credential vault (third-party secrets stored on this VTA).
WEBVH: WebVH DID records + did.jsonl state.

Functions§

did_delete_effect: The effect a DID deletion has on keyspace, or None if the name is not a keyspace this build knows.