Module identity 

Human-centric identity & data-rights SHACL extensions.

Four structural enforcements the Webizen Sentinel needs, each grounded in the project’s identity principles (identifiers-not-identity, out-of-band-remainder-is-freedom, governance-topology-relational):

1. Identity as an enumerated state — an identity is validated as a bounded set of cryptographically-attested identifiers with a confidence relation, never collapsed to one definitive identifier. A binding asserting certainty (confidence >= 1.0) is a DefinitiveCollapse and is rejected: the out-of-band remainder (the un-resolvable link to the natural person) is what keeps the person free, so it is a hard invariant here, not an afterthought.
2. Decentralized shape-target routing — shapes are bound to storage loci (personal data stores / peers); validation is dispatched to where the data lives (local-first) instead of pulling everything into a central index.
3. Real-time severity degradation — off-grid, non-critical violations degrade to non-blocking so a partial subgraph stays usable; Critical violations (identity / consent / safety) never degrade — they fail closed. This mirrors the deontic non-derogable rule.
4. Verifiable-Credential-gated targets — a SHACL target applies to a focus node only when a verified W3C VC is presented about it (origin-authenticated data-rights property validation; the VC layer checks the signature/expiry first).

All four runtime predicates are zero-heap: bounded slices in, scalars / enums / caller out buffers out. The TTL/opcode emitters write constants or into a caller slice.

Structs

CredentialGate

A credential gate on a SHACL target: the shape applies to a focus node only when a verified VC about that node carries the required claim from an accepted issuer.

DegradationOutcome

The result of degrade_violations.

IdentifierBinding

One identifier in an enumerated identity: a handle, the crypto scheme attesting it, whether an attestation is actually present, and the confidence (strictly in (0,1)) that this identifier picks out the natural person.

ShapeRoute

A binding of a SHACL shape to a storage locus (a personal data store / peer) where its target nodes live. Validation is dispatched to the locus; data is never aggregated centrally.

ShapeViolation

A SHACL shape violation against a focus node, with its severity.

Enums

CryptoScheme

The cryptographic scheme that attests an identifier binding.

IdentityValidation

The verdict of validate_enumerated_identity.

OperationMode

Whether the engine is online (strict) or off-grid (partial-utilization tolerant).

ShaclSeverity

SHACL result severity, ordered so Critical is the maximum (never degrades).

Constants

MAX_IDENTITY_BINDINGS

Bounded number of identifier bindings an enumerated identity may carry.

MAX_SHAPE_ROUTES

Bounded number of shape→locus routes the router holds.

Functions

credential_gates_target

Decide whether a credential-gated SHACL target applies to focus_node, given an already cryptographically-verified credential (call crate::verifiable_credential::verify / verify_grounded first — this gates on a verified VC, it does not re-check the signature).

degrade_violations

Apply real-time severity degradation. Online blocks on every Violation/ Critical (nothing degrades). OffGrid degrades non-Critical violations to non-blocking so a partial subgraph stays usable; Critical never degrades.

enumerated_identity_opcodes

Emit the SHACL opcodes for the enumerated-identity shape into out (zero-heap); returns the count written. The richer semantic enforcement (collapse rejection, noisy-OR confidence) lives in validate_enumerated_identity.

get_identity_shacl_ttl

SHACL shapes for human-centric identity & data rights.

loci_for_shape

Enumerate the distinct loci a shape must be routed to (fan-out without pulling the data together). Writes locus ids into out; returns the count. Zero-heap.

route_is_local

Whether shape is validated locally at self_locus (local-first dispatch).

shapes_for_locus

Enumerate the distinct shapes that apply at locus (what a local store validates). Writes shape ids into out; returns the count. Zero-heap.

validate_enumerated_identity

Validate an identity as an enumerated state over crypto-attested identifiers.