Rust First Admission and Historical Trust

Rust First Admission and Historical Trust

The Rust AdmissionService layers First Admission and Historical Trust above the six-stage Signed Document verifier (MWP-ADM-005). The language-independent flow is the local First Admission and Historical Trust runtime page, and the exact requirements are the local Admission clauses.

Public adapters and results

Public API	Responsibility
AdmissionCurrentKeyResolver::resolve_current	Return complete Organization-wide Registry evidence that the deployment asserts is current for this decision.
TrustedAdmissionContext::issue	Issue the record ID, trusted acceptance instant, and accepting service only after authoritative absence.
AdmissionLog::lookup	Return AdmissionLookup::Found or AdmissionLookup::AuthoritativeAbsence. Cache miss, timeout, or unauthenticated absence fails closed under MWP-ADM-003.
AdmissionLog::append_or_return_existing	Atomically append candidate bytes or return the concurrent authoritative winner through an authenticated service identity.
AuthenticatedAdmissionRecord	Bind returned record bytes to the service identity authenticated by the log adapter for MWP-ADM-009.
AdmissionService::prepare_first_admission	Create and validate candidate evidence from an SDK-produced VerifiedSignedDocument; it does not append or imply admission.
AdmissionService::admit_first	Verify current evidence, lookup, prepare after absence, append-or-return-existing, and validate the returned record under MWP-ADM-006.
AdmissionService::verify_historical_admission	Rerun verification with historical Registry evidence and require an existing record without issuing context or appending under MWP-ADM-008.
PreparedFirstAdmission, AdmittedSignedDocument	Preserve immutable verification and record evidence; FirstAdmissionRecord::bytes returns the validated bytes.

A caller-provided trust boolean is not an Admission lookup outcome and must never select the success path.

First-admission call order

Informative example

let first = AdmissionService::new()?.admit_first(
    SignedDocumentKind::Command,
    document,
    &current_registry,
    &admission_log,
    &trusted_context,
)?;

admit_first completes all six verification stages before log access. A found record is validated and returned without issuing trusted context or appending. After authoritative absence, the service issues context, prepares canonical candidate bytes, calls append_or_return_existing, and validates the record actually returned. A concurrent winner succeeds only when Schema, authentication, document binding, and trusted time satisfy MWP-ADM-009 and MWP-ADM-010.

Historical replay and errors

verify_historical_admission uses KeyResolver, reruns all six stages, requires AdmissionLookup::Found, and never calls TrustedAdmissionContext::issue or AdmissionLog::append_or_return_existing. Matching record IDs recover the same authoritative record but do not prove Command freshness, signer authorization, state-machine acceptance, or portable log-proof verification under MWP-ADM-013 and MWP-ADM-014.

AdmissionOperationError preserves either the original six-stage verification failure or an AdmissionError. Admission failures expose wire code AUTH_INVALID_SIGNATURE, protected stage admission, and a typed AdmissionReason, as required by MWP-ADM-012. Adapters return AdmissionAdapterError; generic success or availability is not authenticated evidence.

Runnable exact-pinned example

Informative example

The example reads the signed Command and Registry from the SDK’s verified embedded ProtocolBundle, then supplies typed in-memory authority adapters. It does not read repository files. It asserts identical record IDs, signing hashes, and record bytes for First Admission and historical replay, with exactly one append.

use std::cell::{Cell, RefCell};

use missionweaveprotocol::{
    AdapterError, AdmissionAdapterError, AdmissionContextValue, AdmissionCurrentKeyResolver,
    AdmissionLog, AdmissionLookup, AdmissionService, AuthenticatedAdmissionRecord,
    KeyRegistrySnapshot, KeyResolutionRequest, KeyResolver, ProtocolBundle, SignedDocumentKind,
    TrustedAdmissionContext,
};

const SERVICE_ID: &str = "urn:missionweaveprotocol:service:admission";

struct CurrentRegistry(Vec<u8>);

impl CurrentRegistry {
    fn snapshot(&self) -> KeyRegistrySnapshot {
        KeyRegistrySnapshot::organization_wide(self.0.clone())
    }
}

impl AdmissionCurrentKeyResolver for CurrentRegistry {
    fn resolve_current(
        &self,
        _request: &KeyResolutionRequest,
    ) -> Result<KeyRegistrySnapshot, AdapterError> {
        Ok(self.snapshot())
    }
}

impl KeyResolver for CurrentRegistry {
    fn resolve(
        &self,
        _request: &KeyResolutionRequest,
    ) -> Result<KeyRegistrySnapshot, AdapterError> {
        Ok(self.snapshot())
    }
}

struct FixedTrustedContext;

impl TrustedAdmissionContext for FixedTrustedContext {
    fn issue(
        &self,
        _organization_id: &str,
        _signing_hash: &str,
    ) -> Result<AdmissionContextValue, AdmissionAdapterError> {
        Ok(AdmissionContextValue::new(
            "urn:missionweaveprotocol:admission-record:website-example",
            "2026-07-15T00:05:00Z",
            SERVICE_ID,
        ))
    }
}

struct InMemoryAdmissionLog {
    record: RefCell<Option<AuthenticatedAdmissionRecord>>,
    append_count: Cell<usize>,
}

impl InMemoryAdmissionLog {
    fn new() -> Self {
        Self {
            record: RefCell::new(None),
            append_count: Cell::new(0),
        }
    }

    fn append_count(&self) -> usize {
        self.append_count.get()
    }
}

impl AdmissionLog for InMemoryAdmissionLog {
    fn lookup(
        &self,
        _organization_id: &str,
        _signing_hash: &str,
    ) -> Result<AdmissionLookup, AdmissionAdapterError> {
        Ok(match self.record.borrow().as_ref() {
            Some(record) => AdmissionLookup::Found(record.clone()),
            None => AdmissionLookup::AuthoritativeAbsence,
        })
    }

    fn append_or_return_existing(
        &self,
        _organization_id: &str,
        _signing_hash: &str,
        candidate_bytes: &[u8],
    ) -> Result<AuthenticatedAdmissionRecord, AdmissionAdapterError> {
        if let Some(record) = self.record.borrow().as_ref() {
            return Ok(record.clone());
        }

        let committed = AuthenticatedAdmissionRecord::new(candidate_bytes.to_vec(), SERVICE_ID);
        *self.record.borrow_mut() = Some(committed.clone());
        self.append_count.set(self.append_count.get() + 1);
        Ok(committed)
    }
}

fn main() -> Result<(), Box<dyn std::error::Error>> {
    ProtocolBundle::verify()?;
    ProtocolBundle::verify_cryptography()?;
    ProtocolBundle::verify_admission()?;

    let document = ProtocolBundle::cryptography("vectors/signed-documents/valid/command.json")
        .ok_or("packaged Command is missing")?;
    let registry = ProtocolBundle::cryptography("keys/registry-valid.json")
        .ok_or("packaged Registry is missing")?;

    let current_registry = CurrentRegistry(registry.to_vec());
    let admission_log = InMemoryAdmissionLog::new();
    let service = AdmissionService::new()?;

    let first = service.admit_first(
        SignedDocumentKind::Command,
        document,
        &current_registry,
        &admission_log,
        &FixedTrustedContext,
    )?;
    let historical = service.verify_historical_admission(
        SignedDocumentKind::Command,
        document,
        &current_registry,
        &admission_log,
    )?;

    assert!(first.record().admission_record_id() == historical.record().admission_record_id());
    assert!(first.verified().signing_hash() == historical.verified().signing_hash());
    assert!(first.record().bytes() == historical.record().bytes());
    assert!(admission_log.append_count() == 1);

    println!("first admission: {}", first.record().admission_record_id());
    println!(
        "historical replay: {}",
        historical.record().admission_record_id()
    );
    Ok(())
}

Copy it into an exact checkout and run:

cp /absolute/path/to/examples/sdk/rust/admission.rs examples/website_admission.rs
cargo test --locked --all-features
cargo run --locked --example website_admission

Expected output contains the same record ID for first admission and historical replay.

Implementation note

Replace CurrentRegistry with authenticated current and historical Registry adapters, InMemoryAdmissionLog with an authenticated durable log whose append-or-return-existing operation is atomic, and FixedTrustedContext with Organization-controlled trusted time and accepting-service issuance. Preserve defensive copies and never collapse these authority boundaries into one caller-provided trust boolean.