Rust 首次准入和历史信任

Rust AdmissionService 将首次准入和历史信任置于六阶段 Signed Document 验证器 (MWP-ADM-005) 之上。与语言无关的流程是本地首次准入和历史信任运行时页面，确切的要求是本地准入条款。

公共适配器和结果

公开 API	责任
`AdmissionCurrentKeyResolver::resolve_current`	返回完整的 Organization 范围的 Registry 证据，表明部署断言对于此决策是最新的。
`TrustedAdmissionContext::issue`	下发记录ID，即时可信受理，权威不在场后才接受服务。
`AdmissionLog::lookup`	返回 `AdmissionLookup::Found` 或 `AdmissionLookup::AuthoritativeAbsence`。缓存未命中、超时或未经身份验证的缺失在 MWP-ADM-003 下关闭失败。
`AdmissionLog::append_or_return_existing`	以原子方式追加候选字节或通过经过身份验证的服务身份返回并发权威获胜者。
`AuthenticatedAdmissionRecord`	将返回的记录字节绑定到由日志适配器验证的服务身份 MWP-ADM-009。
`AdmissionService::prepare_first_admission`	从 SDK 生成的 `VerifiedSignedDocument` 创建并验证候选证据；它不附加或暗示承认。
`AdmissionService::admit_first`	验证当前证据、查找、缺席后准备、追加或返回现有证据，并验证 MWP-ADM-006 下返回的记录。
`AdmissionService::verify_historical_admission`	使用历史 Registry 证据重新运行验证，并需要现有记录，而不发布上下文或在 MWP-ADM-008 下附加。
`PreparedFirstAdmission`、`AdmittedSignedDocument`	保留不可变的验证和记录证据； `FirstAdmissionRecord::bytes` 返回已验证的字节。

调用者提供的信任布尔值不是准入查找结果，并且绝不能选择成功路径。

首次准入调用顺序

admit_first 在日志访问之前完成所有六个验证阶段。找到的记录经过验证并返回，无需发出可信上下文或附加。权威缺席后，服务发布上下文，准备规范候选字节，调用 append_or_return_existing，并验证实际返回的记录。仅当架构、身份验证、文档绑定和可信时间满足 MWP-ADM-009 和 MWP-ADM-010 时，并发获胜者才会成功。

历史回放和错误

verify_historical_admission 使用 KeyResolver，重新运行所有六个阶段，需要 AdmissionLookup::Found，并且从不调用 TrustedAdmissionContext::issue 或 AdmissionLog::append_or_return_existing。匹配的记录 ID 恢复相同的权威记录，但不能证明 Command 的新鲜度、签名者授权、状态机接受或 MWP-ADM-013 和 MWP-ADM-014 下的便携式日志证明验证。

AdmissionOperationError 保留原始六阶段验证失败或 AdmissionError。准入失败会公开线路代码 AUTH_INVALID_SIGNATURE、受保护阶段 admission 和类型化 AdmissionReason，如 MWP-ADM-012 所要求的那样。适配器返回AdmissionAdapterError；一般性的成功或可用性并不是经过验证的证据。

可运行的精确固定示例

该示例从 SDK 的经过验证的嵌入式 ProtocolBundle 读取签名的 Command 和 Registry，然后提供类型化的内存中授权适配器。它不读取存储库文件。它为首次准入和历史重放断言相同的记录 ID、签名哈希值和记录字节，并且只有一个附加。

use std::cell::{Cell, RefCell};

use missionweaveprotocol::{
    AdapterError, AdmissionAdapterError, AdmissionContextValue, AdmissionCurrentKeyResolver,
    AdmissionLog, AdmissionLookup, AdmissionService, AuthenticatedAdmissionRecord,
    KeyRegistrySnapshot, KeyResolutionRequest, KeyResolver, ProtocolBundle, SignedDocumentKind,
    TrustedAdmissionContext,
};

const SERVICE_ID: &str = "urn:missionweaveprotocol:service:admission";

struct CurrentRegistry(Vec<u8>);

impl CurrentRegistry {
    fn snapshot(&self) -> KeyRegistrySnapshot {
        KeyRegistrySnapshot::organization_wide(self.0.clone())
    }
}

impl AdmissionCurrentKeyResolver for CurrentRegistry {
    fn resolve_current(
        &self,
        _request: &KeyResolutionRequest,
    ) -> Result<KeyRegistrySnapshot, AdapterError> {
        Ok(self.snapshot())
    }
}

impl KeyResolver for CurrentRegistry {
    fn resolve(
        &self,
        _request: &KeyResolutionRequest,
    ) -> Result<KeyRegistrySnapshot, AdapterError> {
        Ok(self.snapshot())
    }
}

struct FixedTrustedContext;

impl TrustedAdmissionContext for FixedTrustedContext {
    fn issue(
        &self,
        _organization_id: &str,
        _signing_hash: &str,
    ) -> Result<AdmissionContextValue, AdmissionAdapterError> {
        Ok(AdmissionContextValue::new(
            "urn:missionweaveprotocol:admission-record:website-example",
            "2026-07-15T00:05:00Z",
            SERVICE_ID,
        ))
    }
}

struct InMemoryAdmissionLog {
    record: RefCell<Option<AuthenticatedAdmissionRecord>>,
    append_count: Cell<usize>,
}

impl InMemoryAdmissionLog {
    fn new() -> Self {
        Self {
            record: RefCell::new(None),
            append_count: Cell::new(0),
        }
    }

    fn append_count(&self) -> usize {
        self.append_count.get()
    }
}

impl AdmissionLog for InMemoryAdmissionLog {
    fn lookup(
        &self,
        _organization_id: &str,
        _signing_hash: &str,
    ) -> Result<AdmissionLookup, AdmissionAdapterError> {
        Ok(match self.record.borrow().as_ref() {
            Some(record) => AdmissionLookup::Found(record.clone()),
            None => AdmissionLookup::AuthoritativeAbsence,
        })
    }

    fn append_or_return_existing(
        &self,
        _organization_id: &str,
        _signing_hash: &str,
        candidate_bytes: &[u8],
    ) -> Result<AuthenticatedAdmissionRecord, AdmissionAdapterError> {
        if let Some(record) = self.record.borrow().as_ref() {
            return Ok(record.clone());
        }

        let committed = AuthenticatedAdmissionRecord::new(candidate_bytes.to_vec(), SERVICE_ID);
        *self.record.borrow_mut() = Some(committed.clone());
        self.append_count.set(self.append_count.get() + 1);
        Ok(committed)
    }
}

fn main() -> Result<(), Box<dyn std::error::Error>> {
    ProtocolBundle::verify()?;
    ProtocolBundle::verify_cryptography()?;
    ProtocolBundle::verify_admission()?;

    let document = ProtocolBundle::cryptography("vectors/signed-documents/valid/command.json")
        .ok_or("packaged Command is missing")?;
    let registry = ProtocolBundle::cryptography("keys/registry-valid.json")
        .ok_or("packaged Registry is missing")?;

    let current_registry = CurrentRegistry(registry.to_vec());
    let admission_log = InMemoryAdmissionLog::new();
    let service = AdmissionService::new()?;

    let first = service.admit_first(
        SignedDocumentKind::Command,
        document,
        &current_registry,
        &admission_log,
        &FixedTrustedContext,
    )?;
    let historical = service.verify_historical_admission(
        SignedDocumentKind::Command,
        document,
        &current_registry,
        &admission_log,
    )?;

    assert!(first.record().admission_record_id() == historical.record().admission_record_id());
    assert!(first.verified().signing_hash() == historical.verified().signing_hash());
    assert!(first.record().bytes() == historical.record().bytes());
    assert!(admission_log.append_count() == 1);

    println!("first admission: {}", first.record().admission_record_id());
    println!(
        "historical replay: {}",
        historical.record().admission_record_id()
    );
    Ok(())
}

将其复制到精确的结账中并运行：

cp /absolute/path/to/examples/sdk/rust/admission.rs examples/website_admission.rs
cargo test --locked --all-features
cargo run --locked --example website_admission

预期输出包含 first admission 和 historical replay 的相同记录 ID。