Enum CustodyOp 

pub enum CustodyOp {
    Request {
        credential: CredentialName,
        request: EgressRequest,
        slots: usize,
    },
    Sign {
        credential: CredentialName,
        alg: SignatureAlg,
        derivation: Vec<String>,
        payload_b64: String,
    },
    Verify {
        credential: CredentialName,
        alg: SignatureAlg,
        payload_b64: String,
        signature_b64: String,
    },
    Derive {
        credential: CredentialName,
        context: String,
    },
    Wrap {
        credential: CredentialName,
        plaintext_b64: String,
        label: Value,
        context: String,
    },
    Unwrap {
        credential: CredentialName,
        envelope: Envelope,
        context: String,
    },
    Mint {
        credential: CredentialName,
        scope: Vec<String>,
        ttl_secs: u64,
        exchange: EgressRequest,
        extraction: MintExtraction,
        exchange_slots: usize,
    },
}

One custody operation. Externally tagged by op, and the vocabulary is closed: a message with "op": "get" — or any name outside this list — fails to deserialize.

Variants

Request

Substitute at marked slots, egress, return the response.

Fields

credential: CredentialName

request: EgressRequest

slots: usize

How many sentinel slots the CONSTRUCTING program placed, declared out of band from the request text itself. The custodian finds sentinels by scanning finished text, which cannot tell a slot the author wrote from one that arrived inside interpolated data; if a value could carry a sentinel into a header, URL or body, the custodian would fill it with real material at a position the author never designated — and the raw form would put the bare secret there. Declaring the count out of band makes any such injection a refusal rather than a substitution: data can add an occurrence but cannot remove the author’s, so the totals disagree.

Sign

Keyed signature, optionally through a derivation chain (§7): the custodian folds HMAC over the chain from the sealed material, then signs the payload with the final key. For AWS SigV4 the chain is [date, region, service, "aws4_request"] and whip never holds kSigning, which is itself a credential.

Fields

credential: CredentialName

alg: SignatureAlg

derivation: Vec<String>

payload_b64: String

Verify

Constant-time verification (§6) — in the custodian, since a timing oracle in whip leaks the key.

Fields

credential: CredentialName

alg: SignatureAlg

payload_b64: String

signature_b64: String

Derive

HKDF subkey; returns a handle, never material.

Fields

credential: CredentialName

context: String

Wrap

Envelope-encrypt application data whip may persist but not read back without the custodian (§13).

Fields

credential: CredentialName

plaintext_b64: String

label: Value

context: String

Unwrap

Open an envelope. Legitimately returns plaintext to whip — wrapped data is application data, not credential material — so unwrap is scoped, budgeted, and audited like any other use (§13).

Fields

credential: CredentialName

envelope: Envelope

context: String

Mint

Credential exchange, custodian-executed so whip never sees the token in the response body. Returns a handle plus the non-secret half.

Fields

credential: CredentialName

scope: Vec<String>

ttl_secs: u64

exchange: EgressRequest

extraction: MintExtraction

exchange_slots: usize

Slots the constructing program placed in exchange, declared out of band for the same reason as CustodyOp::Request::slots: the exchange is whip-constructed text carrying the PARENT credential’s sentinels, so an injected slot here would present the parent to a position the author never designated.

Implementations

impl CustodyOp

pub fn operation(&self) -> Operation

pub fn credential(&self) -> &CredentialName

Trait Implementations

impl Clone for CustodyOp

fn clone(&self) -> CustodyOp

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CustodyOp

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for CustodyOp

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for CustodyOp

impl PartialEq for CustodyOp

fn eq(&self, other: &CustodyOp) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for CustodyOp

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for CustodyOp