Module provenance_section 

.10d ProvenanceSidecar section (P1) — the provenance half of an asset, bundled physically inside the container so context is byte-inseparable from the data it attests.

The hypermedia library records provenance semantically (an asset’s prov:wasDerivedFrom / hasProvenance edges — see crate::hypermedia). That is queryable, but the source bytes / licence / verifiable-credential live outside the sealed .10d, so a .10d copied on its own loses them. This section carries them in-envelope: the immutable source bytes the asset was derived from, its media type, its licence (the never-strip- context field), and an optional verifiable credential attesting the chain — all under the .10d’s own section-table CRC-32C.

Validate-before-use. validate_provenance is the gate a consumer runs before trusting the asset as citable: the carried source bytes must hash to the declared source_digest (self-authenticating — the bytes really are the attested source), and a licence must be present (context was not stripped). The renderer’s governance path already keys “citable” off the presence of a provenance section (render/portal/mod.rs sets has_attestation); this section makes that attestation real and checkable rather than merely reserved.

Layout: a 32-byte ProvenanceMiniHeader (magic + version + flags + source_digest + field lengths) followed by the concatenated fields — [source_bytes][source_media_type utf8][licence utf8][vc bytes]. The mini-header is repr(C), naturally aligned, no implicit padding. Two encodes of the same sidecar are byte-identical; the section-table CRC-32C catches a flipped bit.

Structs

ProvenanceMiniHeader

The 80-byte ProvenanceSidecar-section mini-header. repr(C), naturally aligned, no implicit padding.

ProvenanceSidecar

An owned provenance sidecar to bundle into a .10d — the source bytes an asset was derived from, their media type, the licence (required), and an optional verifiable credential.

ProvenanceSidecarView

A zero-copy read view over a decoded provenance-section payload.

Enums

ProvenanceSectionError

Provenance-section read/write/validate error.

Constants

FLAG_HAS_VC

flags bit 0: a verifiable credential is present (vc_len must be > 0).

MAX_PROVENANCE_FIELD

Upper bound per variable-length field — bounds a hostile/malformed file. 16 MiB comfortably holds a source document, its media-type label, a licence string, and a VC while staying well under the 42 MB Sentinel ceiling.

PROVENANCE_MAGIC

Magic tag at the head of a provenance-section payload (b"PRV1", LE).

PROVENANCE_MINI_HEADER_SIZE

Section payload mini-header size in bytes.

PROVENANCE_SECTION_VERSION

Provenance-section payload version.

Functions

decode_provenance_section

Parse the mini-header and slice the fields out of a provenance-section payload (zero-copy). Validates magic, version, reserved, flag consistency, field bounds, and utf8 — but does not run the trust gate; call validate_provenance before using the sidecar as an attestation.

encode_provenance_section

Encode a provenance sidecar into a caller-supplied buffer. Returns the number of bytes written. Deterministic (two encodes are byte-identical).

encoded_len

Encoded payload length in bytes for a sidecar (mini-header + fields).

validate_provenance

The validate-before-use gate: return Ok only if the sidecar can be trusted as the asset’s provenance. Two independent checks: