Module identity 

Who is asking, as a thing the runtime decides rather than a thing the client asserts.

docs/42-security-assurance.md §42.6’s first bullet: “Claim any identity. actor arrives in the client’s own hello frame … Every ownership check in every corpus program is therefore enforced against a value the caller chooses.” docs/43 §43.4 records it as the gap that makes the difference between §3.5’s proven properties and a program’s own rules, and §42.5 names it as the most likely misquotation of this project’s security story: “a capability required outside the chokepoint has no holder” is true and proven; “only the owner may toggle their todo” was, until this module, enforced against a self-asserted string.

What this is, and what it is not

It is a seam, in the sense beck_core::clock is one: a trait with the current behaviour as one implementation and a verifying implementation as another, so that identity is a thing an operator chooses rather than a thing the runtime assumes. Two implementations, because a seam with one is an abstraction nobody has checked.

What it does is remove the thing that made the gap structural: an actor arrives through one function that can refuse, and nothing else in the runtime can mint one.

The third implementation is in crate::oidc

Both providers here are symmetric or nothing: DevIdentity verifies nothing, and SignedIdentity verifies a secret this process also holds, so neither can tell “the user authenticated” from “this process said so”. crate::oidc::RelyingParty is the asymmetric one — 10 D6’s OIDC relying party — and it is a third implementation of this trait rather than a change to it, which is what the seam existed for.

Structs

Actor

A verified identity. Nothing constructs one except an Identity implementation.

DevIdentity

Believe whatever the client says. The behaviour every phase before this had.

Proposer

Whoever a proposal is charged to, on the way into crate::App::propose.

SignedIdentity

A credential signed with a secret this process holds.

Enums

Rejected

Why an identity was refused. One reason per way a connection can be wrong about who it is.

Traits

Identity

How a claimed identity becomes a verified one.