Rust 首次準入與歷史信任

Rust 首次準入與歷史信任

Rust AdmissionService 將首次準入和歷史信任置於六階段 Signed Document 驗證器 (MWP-ADM-005) 之上。與語言無關的流程是本地首次準入和歷史信任運行時頁面，確切的要求是本地準入條款。

公共適配器和結果

公開 API	責任
AdmissionCurrentKeyResolver::resolve_current	返回完整的 Organization 範圍的 Registry 證據，表明部署斷言對於此決策是最新的。
TrustedAdmissionContext::issue	下发记录ID，即时可信受理，权威不在场后才接受服务。
AdmissionLog::lookup	返回 AdmissionLookup::Found 或 AdmissionLookup::AuthoritativeAbsence。缓存未命中、超时或未经身份验证的缺失在 MWP-ADM-003 下关闭失败。
AdmissionLog::append_or_return_existing	以原子方式追加候选字节或通过经过身份验证的服务身份返回并发权威获胜者。
AuthenticatedAdmissionRecord	將傳回的記錄位元組綁定到由日誌適配器驗證的服務身分 MWP-ADM-009。
AdmissionService::prepare_first_admission	從 SDK 產生的 VerifiedSignedDocument 建立並驗證候選證據；它不附加或暗示承認。
AdmissionService::admit_first	驗證目前證據、尋找、缺席後準備、追加或回傳現有證據，並驗證 MWP-ADM-006 下回傳的記錄。
AdmissionService::verify_historical_admission	使用歷史 Registry 證據重新運行驗證，並需要現有記錄，而不發布上下文或在 MWP-ADM-008 下附加。
PreparedFirstAdmission、AdmittedSignedDocument	保留不可變的驗證和記錄證據； FirstAdmissionRecord::bytes 傳回已驗證的位元組。

呼叫者提供的信任布林值不是準入查找結果，絕不能選擇成功路徑。

首次準入呼叫順序

Informative example

let first = AdmissionService::new()?.admit_first(
    SignedDocumentKind::Command,
    document,
    &current_registry,
    &admission_log,
    &trusted_context,
)?;

admit_first 在日誌訪問之前完成所有六個驗證階段。找到的記錄經過驗證並返回，無需發出可信上下文或附加。權威缺席後，服務發佈上下文，準備規範的候選字節，調用 append_or_return_existing，並驗證實際傳回的記錄。只有當架構、驗證、文件綁定和可信任時間同時符合 MWP-ADM-009 和 MWP-ADM-010 時，並發勝出者才會成功。

歷史回放與錯誤

verify_historical_admission 用途 KeyResolver，重新運行所有六個階段，需要 AdmissionLookup::Found，並且從不打電話 TrustedAdmissionContext::issue 或者 AdmissionLog::append_or_return_existing。匹配的記錄ID恢復相同的權威記錄但不證明 Command MWP-ADM-013 下的新鮮度、簽署者授權、狀態機接受或便攜式日誌證明驗證 和MWP-ADM-014.

AdmissionOperationError 保留原來的六階段驗證失敗或 AdmissionError。準入失敗會暴露線路代碼 AUTH_INVALID_SIGNATURE, 保護階段 admission，以及一個型別化的 AdmissionReason，依照MWP-ADM-012的要求。適配器返回 AdmissionAdapterError;一般性的成功或可用性並不是經過驗證的證據。

可運行的精確固定範例

Informative example

此範例讀取簽名的 Command 和 Registry 從 SDK已驗證嵌入 ProtocolBundle，然後提供類型化的記憶體中權限適配器。它不會讀取存儲庫文件。它為首次準入和歷史重播斷言相同的記錄 ID、簽名雜湊值和記錄位元組，並且只有一個附加。

use std::cell::{Cell, RefCell};

use missionweaveprotocol::{
    AdapterError, AdmissionAdapterError, AdmissionContextValue, AdmissionCurrentKeyResolver,
    AdmissionLog, AdmissionLookup, AdmissionService, AuthenticatedAdmissionRecord,
    KeyRegistrySnapshot, KeyResolutionRequest, KeyResolver, ProtocolBundle, SignedDocumentKind,
    TrustedAdmissionContext,
};

const SERVICE_ID: &str = "urn:missionweaveprotocol:service:admission";

struct CurrentRegistry(Vec<u8>);

impl CurrentRegistry {
    fn snapshot(&self) -> KeyRegistrySnapshot {
        KeyRegistrySnapshot::organization_wide(self.0.clone())
    }
}

impl AdmissionCurrentKeyResolver for CurrentRegistry {
    fn resolve_current(
        &self,
        _request: &KeyResolutionRequest,
    ) -> Result<KeyRegistrySnapshot, AdapterError> {
        Ok(self.snapshot())
    }
}

impl KeyResolver for CurrentRegistry {
    fn resolve(
        &self,
        _request: &KeyResolutionRequest,
    ) -> Result<KeyRegistrySnapshot, AdapterError> {
        Ok(self.snapshot())
    }
}

struct FixedTrustedContext;

impl TrustedAdmissionContext for FixedTrustedContext {
    fn issue(
        &self,
        _organization_id: &str,
        _signing_hash: &str,
    ) -> Result<AdmissionContextValue, AdmissionAdapterError> {
        Ok(AdmissionContextValue::new(
            "urn:missionweaveprotocol:admission-record:website-example",
            "2026-07-15T00:05:00Z",
            SERVICE_ID,
        ))
    }
}

struct InMemoryAdmissionLog {
    record: RefCell<Option<AuthenticatedAdmissionRecord>>,
    append_count: Cell<usize>,
}

impl InMemoryAdmissionLog {
    fn new() -> Self {
        Self {
            record: RefCell::new(None),
            append_count: Cell::new(0),
        }
    }

    fn append_count(&self) -> usize {
        self.append_count.get()
    }
}

impl AdmissionLog for InMemoryAdmissionLog {
    fn lookup(
        &self,
        _organization_id: &str,
        _signing_hash: &str,
    ) -> Result<AdmissionLookup, AdmissionAdapterError> {
        Ok(match self.record.borrow().as_ref() {
            Some(record) => AdmissionLookup::Found(record.clone()),
            None => AdmissionLookup::AuthoritativeAbsence,
        })
    }

    fn append_or_return_existing(
        &self,
        _organization_id: &str,
        _signing_hash: &str,
        candidate_bytes: &[u8],
    ) -> Result<AuthenticatedAdmissionRecord, AdmissionAdapterError> {
        if let Some(record) = self.record.borrow().as_ref() {
            return Ok(record.clone());
        }

        let committed = AuthenticatedAdmissionRecord::new(candidate_bytes.to_vec(), SERVICE_ID);
        *self.record.borrow_mut() = Some(committed.clone());
        self.append_count.set(self.append_count.get() + 1);
        Ok(committed)
    }
}

fn main() -> Result<(), Box<dyn std::error::Error>> {
    ProtocolBundle::verify()?;
    ProtocolBundle::verify_cryptography()?;
    ProtocolBundle::verify_admission()?;

    let document = ProtocolBundle::cryptography("vectors/signed-documents/valid/command.json")
        .ok_or("packaged Command is missing")?;
    let registry = ProtocolBundle::cryptography("keys/registry-valid.json")
        .ok_or("packaged Registry is missing")?;

    let current_registry = CurrentRegistry(registry.to_vec());
    let admission_log = InMemoryAdmissionLog::new();
    let service = AdmissionService::new()?;

    let first = service.admit_first(
        SignedDocumentKind::Command,
        document,
        &current_registry,
        &admission_log,
        &FixedTrustedContext,
    )?;
    let historical = service.verify_historical_admission(
        SignedDocumentKind::Command,
        document,
        &current_registry,
        &admission_log,
    )?;

    assert!(first.record().admission_record_id() == historical.record().admission_record_id());
    assert!(first.verified().signing_hash() == historical.verified().signing_hash());
    assert!(first.record().bytes() == historical.record().bytes());
    assert!(admission_log.append_count() == 1);

    println!("first admission: {}", first.record().admission_record_id());
    println!(
        "historical replay: {}",
        historical.record().admission_record_id()
    );
    Ok(())
}

將其複製到精確的結帳並運行：

cp /absolute/path/to/examples/sdk/rust/admission.rs examples/website_admission.rs
cargo test --locked --all-features
cargo run --locked --example website_admission

預期輸出包含相同的記錄 ID first admission 和 historical replay.

Implementation note

代替 CurrentRegistry 具有經過驗證的當前和歷史 Registry 適配器， InMemoryAdmissionLog 具有經過身份驗證的持久性日誌，其追加或返回現有操作是原子的，並且 FixedTrustedContext 和 Organization-控制可信任時間和接受服務的發布。保留防禦性副本，並且永遠不要將這些權限邊界折疊為呼叫者提供的信任布林值。