Module carrier 

Multi-modal semantic binding logic (§29, legal_logic.md) — the content-addressed carrier binding + extraction.

SCOPE (honest): this is the tamper-evident binding between a media blob and its semantic graph, plus extraction — the part that matters for provenance and evidence. The actual binary container codecs (PDF/A-3, XMP, PNG, Open Badges v3 byte layout) are task #9; this module does NOT write those container formats. It content-addresses the blob (real BLAKE3) and verifies that the carried graph is bound to that exact media (any edit breaks it).

Structs

StreamHasher

A streaming content-hash accumulator — feed chunks of a massive blob (e.g. via DirectStorage) without ever holding it whole in RAM, then finalize to the 64-bit media tag. Zero-heap (the BLAKE3 state is fixed-size on the stack; chunks are borrowed, not retained).

Functions

extract_payload

Extract the payload quins carried alongside a medium into out (Extract(C_VC) → Σ(Quins)). Returns the count written. Zero-heap (caller-supplied out).

media_tag

Content-address a media blob → a 64-bit media tag (the low 8 bytes of its BLAKE3 hash, into the one identifier space). Hash(Blob) → Tag_Media. Real cryptographic hash, not a toy.

merkle_node

Hash an internal Merkle-DAG node from its ordered children tags: BLAKE3 over the little-endian concatenation. Order-sensitive (a node commits to its ordered children). Zero-heap (fixed-size BLAKE3 state on the stack).

multisig_satisfied

A k-of-n multi-signature over the payload is satisfied iff at least k distinct valid signer attestations are present. The individual signatures are verified by the crypto layer (Ed25519 / post-quantum ML-DSA via fiduciary_crypto); this is the threshold gate. valid_signers = the count of distinct verified signers.

redaction_preserves_root

Verifiable redaction: a redacted blob hides content while preserving the signature/binding. Each leaf is committed by its hash in a Merkle root; redacting a leaf replaces its content with its hash tag — the leaf tags (redacted or not) still recompute the original root. Returns true iff the (possibly-redacted) leaf_tags still hash to original_root.

verify_binding

Verify a carrier’s binding: re-hash blob and confirm it matches the bound_media_tag the carrier recorded. Tamper-evident — any change to the media breaks the binding to its graph.

verify_merkle_node

Verify a Merkle-DAG node tag against its children (recompute + compare). Tamper-evident.