Struct AccountabilityStore 

pub struct AccountabilityStore { /* private fields */ }

On-disk store for the accountability fabric.

Implementations

impl AccountabilityStore

pub fn open(storage_root: impl AsRef<Path>) -> Result<Self>

Open (or prepare to create) the store under storage_root.

pub fn load(&self) -> Result<AccountabilityState>

Load the whole set (empty default if the file does not yet exist).

pub fn save(&self, state: &AccountabilityState) -> Result<()>

Persist the whole set (write-to-temp then rename, so a crash can’t leave a half-written chain).

pub fn append_ledger( &self, kind: &str, payload_json: &str, signer: &SigningKey, time_unix: u64, ) -> Result<LedgerEntry>

Append a raw record to the tamper-evident ledger, signed by signer, and persist. Returns the entry.

pub fn verify_ledger(&self) -> Result<Result<(), LedgerTamper>>

Verify the whole ledger chain. Ok(None) = intact; Ok(Some(tamper)) = a detected, named tamper.

pub fn ledger_entries(&self, limit: usize) -> Result<Vec<LedgerEntry>>

The most-recent ledger entries (newest first), capped to limit.

pub fn grant_credential( &self, cred: ConsentCredential, signer: &SigningKey, time_unix: u64, ) -> Result<ConsentCredential>

Grant a consent credential and log it into the ledger. The credential is stored; a "consent_granted" entry (subject → agent, scope, purpose) enters the signed chain.

pub fn revoke_credential( &self, credential_id: &str, signer: &SigningKey, time_unix: u64, ) -> Result<bool>

Revoke a consent credential — crypto-enforced (the wrapped key is destroyed in ConsentCredential::revoke) — and log a "consent_revoked" entry. Returns true if a live credential was revoked. The credential row and every conduct record under it persist: revoking consent removes access, never accountability.

pub fn list_credentials(&self) -> Result<Vec<ConsentCredential>>

All stored credentials (active and revoked — the revoked ones remain as the audit anchor).

pub fn wrapped_key_for( &self, commitment: &PayloadCommitment, agent_did: &str, now_unix: u64, ) -> Result<Option<Vec<u8>>>

The still-live wrapped DEK held by agent_did’s credential for commitment (e.g. the owner’s own credential), so the DEK can be recovered and re-sealed on enactment. None if no such active credential.

pub fn record_conduct( &self, agent_did: impl Into<String>, credential_id: impl Into<String>, action: impl Into<String>, reason: impl Into<String>, commitment: PayloadCommitment, signer: &SigningKey, time_unix: u64, ) -> Result<ConductRecord>

Record an agent’s conduct under a credential — signed by signer (an Attestation::Signature) — into both the durable conduct trail and the tamper-evident ledger. The record binds to the payload commitment (not the payload), so it proves what was acted on without holding the datum, and it survives the credential’s revocation.

pub fn audit_trail(&self, credential_id: &str) -> Result<Vec<ConductRecord>>

The audit view — every conduct record taken under one credential, in order. Exactly the records that survive that credential’s revocation (the accountability the person cannot erase and the agent cannot withhold).

pub fn seal_and_grant_credential( &self, credential_id: impl Into<String>, subject_did: impl Into<String>, agent_did: impl Into<String>, scope: impl Into<String>, purpose: impl Into<String>, plaintext: &[u8], recipient_public: &[u8; 32], storers: Vec<String>, expiry_unix: Option<u64>, signer: &SigningKey, time_unix: u64, ) -> Result<ConsentCredential>

Seal a plaintext payload and grant a consent credential over it — the real envelope-encryption path (as opposed to grant_credential, which takes an already-wrapped key). Generates a random DEK, AEAD-encrypts the plaintext, content-addresses the ciphertext, seals the DEK to recipient_public (the credential’s real wrapped_key), stores the ciphertext in the commons, grants the credential, and logs consent_granted. Returns the granted credential. Nothing is stored in the clear: the plaintext becomes ciphertext, and the DEK survives only sealed inside the credential.

pub fn open_payload_via_credential( &self, credential_id: &str, recipient_secret: &[u8; 32], now_unix: u64, ) -> Result<Vec<u8>>

Open a sealed payload through a credential — the end-to-end decrypt path. Reads the credential’s wrapped_key (present only while active — revocation destroys it), unwraps the DEK with the recipient’s X25519 secret, verifies the content-address commitment, and AEAD-decrypts. Err if the credential is unknown, revoked/expired (no key ⇒ payload unavailable), or its ciphertext is missing.

pub fn arm_dead_mans_switch( &self, switch: DeadMansSwitch, signer: &SigningKey, time_unix: u64, ) -> Result<()>

Arm a dead-man switch over a payload and log it. The owner sets the liveness grace + the gamified trigger (parties + threshold) + the disposition; it fires only when the heartbeat lapses AND a quorum of distinct parties attest.

pub fn dead_mans_alive( &self, commitment: &PayloadCommitment, signer: &SigningKey, time_unix: u64, ) -> Result<bool>

The principal is alive — touch the heartbeat and un-fire a not-yet-enacted switch (the reversibility). Returns whether a switch for commitment was found.

pub fn attest_dead_mans( &self, commitment: &PayloadCommitment, attestation: PartyAttestation, signer: &SigningKey, time_unix: u64, ) -> Result<bool>

Record a party attestation toward a switch’s trigger (the friend-side accumulation). Returns whether the switch was found.

pub fn enact_dead_mans( &self, commitment: &PayloadCommitment, signer: &SigningKey, time_unix: u64, ) -> Result<Option<Disposition>>

Enact the switch if the gamified rule is satisfied (heartbeat lapsed + quorum attested). Records it fired, logs it, and returns the Disposition to carry out (key-release is a separate compose step).

pub fn list_dead_mans_switches(&self) -> Result<Vec<DeadMansSwitchRecord>>

All armed dead-man switch records (with their accumulated attestations).

pub fn enact_dead_mans_release( &self, commitment: &PayloadCommitment, dek: &[u8; 32], party_keys: &[(String, [u8; 32])], subject_did: &str, signer: &SigningKey, time_unix: u64, ) -> Result<Option<Disposition>>

Enact a dead-man switch AND perform the key-release — the composition that makes the disposition real. If the switch fires with Disposition::ReleaseTo, the caller-supplied dek (recovered by unwrapping an owner credential) is re-sealed to each disposition party’s X25519 key and a consent credential is granted to them, so they can now decrypt the payload they previously could not. Each grant is logged. MakePublic / SelfDefinedRules are returned but not key-released here (MakePublic’s irreversibility is a deferred values decision). Returns the disposition (or None if not triggerable).

pub fn reconstruct_and_release( &self, commitment: &PayloadCommitment, recovery_shares: &[Share], party_keys: &[(String, [u8; 32])], subject_did: &str, signer: &SigningKey, time_unix: u64, ) -> Result<Option<Disposition>>

Social-recovery enactment (no owner key): reconstruct the payload DEK from a quorum of friends’ Shamir shares, then enact + release to the disposition parties. This is the true post-death / incapacity path — a quorum of chosen trustees recovers the key without the owner, closing the gap enact_dead_mans_release left (which needed the owner’s derived key).

pub fn arm_incapacity_switch( &self, switch: IncapacitySwitch, signer: &SigningKey, time_unix: u64, ) -> Result<()>

Arm an incapacity switch and log it. Replaces any existing switch for the same principal.

pub fn activate_incapacity( &self, principal_did: &str, attesting_parties: &[String], official_instrument: Option<&str>, signer: &SigningKey, time_unix: u64, ) -> Result<bool>

Activate advocacy if the corroborated trigger is satisfied (quorum + optional official instrument). Returns whether it activated.

pub fn regain_capacity( &self, principal_did: &str, signer: &SigningKey, time_unix: u64, ) -> Result<bool>

Regain capacity — the advocate stands down, control reverts to the principal (the reversibility). Returns whether a switch for the principal was found.

pub fn list_incapacity_switches(&self) -> Result<Vec<IncapacitySwitch>>

All armed incapacity switches.

pub fn record_transparency_cc( &self, cc: TransparencyCc, signer: &SigningKey, time_unix: u64, ) -> Result<()>

Record a transparency cc — the protective “I informed authority X on date Y for purpose Z” note — and log it. Durable: if the authority later betrays or fails to act, that is knowable against this.

pub fn record_disclosure_event( &self, event: DisclosureEvent, signer: &SigningKey, time_unix: u64, ) -> Result<()>

Record a disclosure event (an access or onward-share) and log it — the attributable trail. The event’s accountable_actor (a staffer if a delegate acted, else the recipient) is what a traced leak points to.

pub fn disclosure_chain( &self, commitment: &PayloadCommitment, ) -> Result<Vec<DisclosureEvent>>

The full disclosure chain for a payload — who saw it, via which route, in order.

pub fn actors_with_access( &self, commitment: &PayloadCommitment, ) -> Result<Vec<String>>

The distinct actors who had access to a payload — the set a leak must be within.

pub fn trace_leak( &self, fingerprint: &DisclosureFingerprint, ) -> Result<Option<DisclosureEvent>>

Trace a leak by its per-recipient fingerprint → the disclosure it came from (and thence the accountable actor). Returns the matching event, if any.

pub fn list_transparency_ccs(&self) -> Result<Vec<TransparencyCc>>

All transparency cc records.