Versions in this module Expand all Collapse all v0 v0.1.1 Aug 18, 2026 v0.1.0 Aug 17, 2026 Changes in this version + const FaultBoundaryExclusionDropped + const FaultBoundaryMaxImpact + const FaultBoundaryMaxPrivilegeDelta + const FaultBoundaryQuotaDropped + const FaultBoundaryQuotaExceeded + const FaultBoundaryQuotaNotInParent + const FaultChainCycle + const FaultChainDepthExceeded + const FaultChainDepthUnstated + const FaultChainEmpty + const FaultChainLinkBreak + const FaultChainNotRoot + const FaultConstraintDropped + const FaultConstraintLooserPrefix + const FaultConstraintTypeMismatch + const FaultDelegationNotAllowed + const FaultObligationLoosened + const FaultObligationMissing + const FaultScopeActionNotCovered + const FaultScopeActionsUnstated + const FaultScopeResourceNotCovered + const FaultScopeResourcesUnstated + const FaultScopeTraversalUnconstrained + const FaultScopeUnconstrainedEscalation + const ProtocolVersion + const ScopeDimensionActions + const ScopeDimensionResources + var ErrAnchorExists = errors.New("xap: a trust anchor is already registered for this key id") + var ErrAnchorRoleMismatch = errors.New("xap: trust anchor is not registered for this artifact kind") + var ErrBoundaryExceeded = errors.New("delegation: child boundary exceeds parent boundary") + var ErrConstraintNotStricter = errors.New("delegation: child constraint looser than parent") + var ErrDelegationCycle = errors.New("delegation: cyclic authorization graph") + var ErrDelegationDepthExceeded = errors.New("delegation: depth exceeds parent allowance") + var ErrDelegationNotAllowed = errors.New("delegation: parent does not permit delegation") + var ErrIssuerKeyMismatch = errors.New("xap: MAT issuer key id does not match the verifying anchor") + var ErrNoTrustAnchor = errors.New("xap: no trust anchor for key id") + var ErrObligationsNotSuperset = errors.New("delegation: child proof obligations omit a parent obligation") + var ErrScopeNotSubset = errors.New("delegation: child scope exceeds parent scope") + func DecodeAny(payload []byte) (kind string, obj any, err error) + func FaultPath(err error) string + func UnverifiedPayload(envelope []byte) ([]byte, error) + func ValidateChain(chain []*MAT) error + func ValidateDerivation(parent, child *MAT) error + func VerifyExpiry(mat *MAT, at time.Time) error + type ActionCompliance struct + Action string + BoundaryCheck bool + Code string + CommitmentCheck bool + ConstraintOutcome bool + ScopeCheck bool + type AttestationRef struct + Category string + KeyDigest []byte + type ChainLink struct + ArtifactID string + CommitmentDigest []byte + ParentDigest []byte + ReceiptID string + func ReconstructProvenance(receipts []*Receipt) ([]ChainLink, error) + type Check struct + Detail string + Name string + Pass bool + Status CheckStatus + type CheckStatus string + const CheckFailed + const CheckNotPerformed + const CheckPassed + type CommitmentBinding struct + ArtifactID string + ConstraintDigest []byte + type CommitmentObject struct + ActionWindow *TemporalValidity + AgentIdentity MachineIdentity + Binding CommitmentBinding + DeclaredActions DeclaredActionSet + ID string + Provenance *CommitmentProvenance + ResourceTargets []string + SessionID string + TemporalValidity TemporalValidity + Version string + func UnmarshalCommitment(payload []byte) (*CommitmentObject, error) + func (c *CommitmentObject) Digest() ([]byte, error) + func (c *CommitmentObject) Marshal() ([]byte, error) + func (c *CommitmentObject) ValidateTemporal(at time.Time) error + func (c *CommitmentObject) VerifyBinding(gov *MAT) error + func (c *CommitmentObject) WithinScopeOf(gov *MAT) error + type CommitmentProvenance struct + ParentArtifactID string + ParentCommitmentDigest []byte + type Constraint struct + Equals string + ID string + In []string + Key string + Max *float64 + MaxMS int64 + MaxRate *int64 + Min *float64 + NotAfter string + NotBefore string + Param string + Type string + Zones []string + func (c Constraint) Evaluate(ctx RuntimeContext) bool + type ConstraintOutcome struct + Code string + ConstraintID string + Satisfied bool + type DeclaredActionSet struct + ActionTypes []string + ParamRanges []Constraint + Resources []string + Unconstrained []string + func (d DeclaredActionSet) Covers(action, resource string) error + type DelegationRights struct + Allowed bool + MaxDepth int + type DerivationFault struct + Err error + Path string + func (f *DerivationFault) Error() string + func (f *DerivationFault) Unwrap() error + type EvidenceRef struct + Category string + Digest []byte + Fresh bool + type ExecutionScope struct + Actions []string + Policy string + Resources []string + Unconstrained []string + type HybridPublicKey struct + ECDSA *ecdsa.PublicKey + MLDSA *mldsa65.PublicKey + type IssuerIdentity struct + ID string + KID []byte + type MAT struct + Boundary PermissionBoundary + Constraints []Constraint + Delegation DelegationRights + ID string + Issuer IssuerIdentity + MachineIdentity MachineIdentity + ParentID string + ProofObligations []ProofObligation + Replay ReplayProtection + Scope ExecutionScope + TrustVector TrustVector + Version string + func UnmarshalMAT(payload []byte) (*MAT, error) + func (m *MAT) ConstraintDigest() ([]byte, error) + func (m *MAT) CoversOperation(action, resource string) error + func (m *MAT) Expired(at time.Time) bool + func (m *MAT) Marshal() ([]byte, error) + func (m *MAT) ScopeReproducible(action, resource string) bool + func (m *MAT) ValidateAt(at time.Time) error + func (m *MAT) ValidateStructure() error + type MachineIdentity struct + Attestation *AttestationRef + CertRef string + Composite []MachineIdentity + Kind string + PublicKey []byte + type PermissionBoundary struct + Exclusions []string + MaxImpact int64 + MaxPrivilegeDelta int64 + ResourceQuotas map[string]int64 + type ProofObligation struct + Category string + MaxAgeSeconds int64 + type ProvenanceRef struct + ParentArtifactID string + ParentCommitmentDigest []byte + type Receipt struct + Action string + ArtifactID string + CommitmentCompliance *ActionCompliance + CommitmentDigest []byte + Confirms []byte + ConstraintOutcomes []ConstraintOutcome + ContextDigest []byte + Controls []string + Decision string + EnforcementPoint string + EnforcementPointKID []byte + EvidenceRefs []EvidenceRef + ID string + PolicyDigest []byte + PriorReceiptHash []byte + Provenance *ProvenanceRef + RationaleCodes []string + Resource string + ResourceKeys []string + ResourceStateDigest []byte + Speculative bool + Timing Timing + Version string + func UnmarshalReceipt(payload []byte) (*Receipt, error) + func (r *Receipt) Digest() ([]byte, error) + func (r *Receipt) Marshal() ([]byte, error) + type ReplayProtection struct + InstanceID string + Nonce []byte + NotAfter string + NotBefore string + type ReplaySeenSet interface + Seen func(receiptDigest []byte) bool + type RuntimeContext struct + NetworkZone string + Params map[string]float64 + Rate map[string]int64 + ResourceState map[string]string + RiskScore int + Time string + func (r RuntimeContext) Digest() ([]byte, error) + type SignedCommitment struct + Commitment CommitmentObject + Envelope []byte + SigningKID []byte + func ParseCommitment(envelope []byte, anchors *TrustAnchorSet) (*SignedCommitment, error) + type SignedMAT struct + Envelope []byte + MAT MAT + SigningKID []byte + func ParseMAT(envelope []byte, anchors *TrustAnchorSet) (*SignedMAT, error) + type SignedReceipt struct + Envelope []byte + Receipt Receipt + SigningKID []byte + func ParseReceipt(envelope []byte, anchors *TrustAnchorSet) (*SignedReceipt, error) + type SignerRole string + const RoleAgent + const RoleEnforcementPoint + const RoleIssuer + type TemporalValidity struct + NotAfter string + NotBefore string + type Timing struct + Complete string + ElapsedMS int64 + MaxMS int64 + Start string + type TrustAnchor struct + Algorithm constants.SignatureAlg + KID []byte + PublicKey crypto.PublicKey + Roles []SignerRole + Subject string + func (a TrustAnchor) Permits(role SignerRole) bool + type TrustAnchorSet struct + func NewTrustAnchorSet() *TrustAnchorSet + func (s *TrustAnchorSet) AddECDSAP256(kid []byte, roles []SignerRole, pub *ecdsa.PublicKey) error + func (s *TrustAnchorSet) AddEd25519(kid []byte, roles []SignerRole, pub ed25519.PublicKey) error + func (s *TrustAnchorSet) AddHybrid(kid []byte, roles []SignerRole, ec *ecdsa.PublicKey, ml *mldsa65.PublicKey) error + func (s *TrustAnchorSet) Get(kid []byte) (TrustAnchor, bool) + func (s *TrustAnchorSet) Len() int + func (s *TrustAnchorSet) SetSubject(kid []byte, subject string) error + type TrustVector struct + Level string + Score int + type VerificationResult struct + ArtifactID string + Checks []Check + Decision string + NotPerformed []string + Speculative bool + Valid bool + func (v VerificationResult) Failed() []string + type Verifier struct + Anchors *TrustAnchorSet + func NewVerifier(anchors *TrustAnchorSet) *Verifier + func (v *Verifier) Verify(in VerifyInput) VerificationResult + type VerifyInput struct + CommitmentEnvelope []byte + ConfirmedReceipt *SignedReceipt + MATEnvelope []byte + PriorReceipt *SignedReceipt + ReceiptEnvelope []byte + Replay ReplaySeenSet + ReproducedContext *RuntimeContext v0.1.0-rc.1 Aug 12, 2026
Go to main page