Struct Authorization 

pub struct Authorization {
    pub format_version: u16,
    pub basis: Basis,
    pub approvers: Vec<ContentHash>,
}

Why a OpKind::Submit was allowed to land (D43).

The gate that admits a landing runs at apply time inside the node’s submission policy, so without this the log records that a ref moved and never why. A later additive field cannot repair that: entries written before it stay blank, and that window is permanently unauditable. So it ships with the first Submit ever accepted.

The record is checked, not trusted. Everything here except the ACL’s own grants is derivable from the fold, and View::validate rederives it and refuses a mismatch — the OpKind::RecordRefSnapshot discipline, for the same reason: a claim every replayer verifies is worth more than one only the admitting node could have checked.

Fields

format_version: u16

Wire-format version; see FORMAT_VERSION.

basis: Basis

The rule that admitted the landing.

approvers: Vec<ContentHash>

Actor ids whose standing approvals the basis rested on, in the review’s verdict order.

Actor ids, never channel names. An id is hash(pubkey) and is the trust root (D9); a channel name is mutable, and an audit record that reads differently later than it read when written is not an audit record. Resolved through the log’s own OpKind::BindKey records by View::bound_actor_at, so the join is replayable — and an approval whose channel the log binds to no key, or to more than one, cannot land through this op at all.

What an id here proves, exactly. It is the key the log bound to the approving channel as of the verdict’s own position (VerdictState::at), not proof that this key cast the verdict: the fold is handed only the op, never the entry, so ReviewState::verdicts is keyed by channel and no review can record a signer. Resolving at the verdict’s position rather than the landing’s is what keeps the claim true across a key rotation (D44) — the replacement key never saw the review. That is also why freezing the id here is worth doing: KeyBinding::channel is the one field a later re-binding may change, so the answer is only stable once written down.

Empty is a distinct value from absent. A basis that requires no approvals records [], and a reader can tell that from a log predating the field, because such a log holds no Submit.

Implementations

impl Authorization

pub fn new(basis: Basis, approvers: Vec<ContentHash>) -> Self

Creates an authorization at the current wire-format version.

Trait Implementations

impl Clone for Authorization

fn clone(&self) -> Authorization

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Authorization

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Authorization

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for Authorization

fn eq(&self, other: &Authorization) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Authorization

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for Authorization

impl StructuralPartialEq for Authorization