Module disclosure_trace 

Disclosure traceability — so a betrayal is knowable and attributable.

The high-stakes case (Timothy, 2026-07-06): a person seeking protection from serious crime “cc“s a transparency credential to an oversight authority — their local member of parliament, a minister — to get help / put them on notice. But the perpetrator may be a PEP (politically-exposed person) or a political donor with influence over that very authority. If the authority — or their staff — leaks the disclosure to the perpetrator, threats follow. The system must make that knowable: who accessed or was told what, when, under which credential, and — crucially — by whom (including a delegate such as an MP’s staffer acting under the MP’s credential), with a per-recipient fingerprint so a leaked copy (or leaked knowledge) traces back to its source.

This is the anti-corruption / anti-retaliation substrate for the knowledge economy around protection — and it is particularly load-bearing for UN / World-Bank development-funding and human-rights support use-cases, where beneficiaries and whistle-blowers face capture and reprisal, and where “who knew, and who told” must survive powerful actors’ attempts to hide it.

It composes with crate::consent_credential: disclosures are of the durable, un-deletable EncryptedCommonsPayload (so the trace itself cannot be erased by a betrayer), each carrying the payload’s commitment. The real per-recipient watermark / traitor-tracing scheme and the tamper-evident store (signed WAL + commons) are the crypto/storage composition (coordinate); this is the domain model + the invariants: the trace makes the leak knowable, and attributable to a specific actor.

Structs

DisclosureEvent

One traced access / disclosure event — durable and tamper-evident (of the commons payload; a person revoking access, or a betrayer, cannot erase it). Says who was given/took access to what, when, under which credential, and by whom (including a delegate).

TransparencyCc

A “cc” / transparency credential note — the record that the person informed an oversight authority (MP / minister) for transparency / protection. The record is itself protective and durable: “I informed them on date X for purpose Y” is provable, so if the authority betrays or fails to act, that is knowable against this record.

Enums

DisclosureKind

What kind of disclosure an event records.

Functions

actors_with_access

The distinct actors who had access to a payload (recipients + any acting delegates) — the set the leak must be within. If the perpetrator demonstrably knows something disclosed only here, the leak is one of these.

disclosure_chain

Every disclosure of a given payload, in order — the audit chain: who could have leaked this, and by which route (direct access vs onward share). Tamper-evident; survives revocation.

trace_leak

Trace a leak by its fingerprint — the disclosure it came from — making the betrayal knowable. A leaked copy (or knowledge recovered from a leak) carrying leaked is matched to the exact disclosure, and thence to the accountable_actor (the authority, or their staffer).

Type Aliases

DisclosureFingerprint

A per-recipient tracing fingerprint — a unique tag bound to one disclosure to one party, so a leaked copy (or knowledge recovered from a leak) can be traced to whose disclosure it came from. The real mechanism is per-recipient watermarking / traitor-tracing; here it is the tag the trace keys on.