arsenal-core · fingerprint

Source: arsenal/crates/arsenal-core/src/fingerprint.rs. SHA-256: a300fa13494b16c90c849360b645f68426e398d2a2ad8dc28c3a03ef15000c60.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

fingerprint::FingerprintState

Stateful fingerprint for an agent's hash chain.

The fingerprint tracks a BLAKE3 hash chain that is advanced with each proxy request. The broker verifies the agent's presented fingerprint against the expected chain state.

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct FingerprintState {
/// Current hash chain state (BLAKE3 output)

pub current_state: [u8; 32],
/// Monotonically increasing sequence number

pub sequence_number: u64,
/// When the chain was last advanced

pub last_advanced_at: chrono::DateTime<chrono::Utc>,
/// Window size for out-of-order tolerance (Strategy A)

pub window_size: u8
}

Source line: 29.

fingerprint::FingerprintState::init

Initialize a new fingerprint chain.

The initial state is computed as: BLAKE3("arsenal.fingerprint.init" || agent_did || timestamp || nonce)

#[must_use]
pub fn init(
        agent_did: &str,
        timestamp: &chrono::DateTime<chrono::Utc>,
        nonce: &[u8; 32],
    ) -> Self;

Source line: 46.

fingerprint::FingerprintState::advance

Advance the hash chain by one step.

New state is computed as: BLAKE3("arsenal.fingerprint.advance" || current_state || request_id || timestamp)

pub fn advance(&mut self, request_id: &Uuid, timestamp: &chrono::DateTime<chrono::Utc>);

Source line: 70.

fingerprint::FingerprintState::compute_fingerprint

Compute the fingerprint to send as a header.

The fingerprint is BLAKE3(current_state) — the raw state is never transmitted, only its hash. This prevents state reconstruction if the fingerprint header is intercepted.

#[must_use]
pub fn compute_fingerprint(&self) -> [u8; 32];

Source line: 82.

fingerprint::FingerprintState::verify_fingerprint

Verify a received fingerprint against the expected chain state.

Uses Strategy A (sliding window): tries the current state and up to window_size future states to accommodate out-of-order delivery.

#[must_use]
pub fn verify_fingerprint(
        &self,
        received: &[u8; 32],
        request_id: &Uuid,
        timestamp: &chrono::DateTime<chrono::Utc>,
    ) -> FingerprintVerification;

Source line: 91.

fingerprint::FingerprintState::set_window_size

Set the window size (clamped to valid range).

pub fn set_window_size(&mut self, size: u8);

Source line: 125.

fingerprint::FingerprintState::sequence_number

Get the current sequence number.

#[must_use]
pub const fn sequence_number(&self) -> u64;

Source line: 131.

fingerprint::FingerprintState::window_size

Get the window size.

#[must_use]
pub const fn window_size(&self) -> u8;

Source line: 137.

fingerprint::FingerprintVerification

Result of fingerprint verification.

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
pub enum FingerprintVerification {
    /// Fingerprint matches the expected current state.
    Match {
        /// Sequence number to advance to
        advance_to: u64,
    },
    /// Fingerprint matches a state within the sliding window.
    WindowMatch {
        /// Sequence number to advance to
        advance_to: u64,
        /// Number of states skipped
        skipped: u64,
    },
    /// Fingerprint does not match any expected state — potential key theft.
    Mismatch,
}

Source line: 144.

fingerprint::FingerprintVerification::is_valid

Check if verification succeeded (Match or WindowMatch).

#[must_use]
pub const fn is_valid(&self) -> bool;

Source line: 164.

fingerprint::FingerprintVerification::is_mismatch

Check if verification failed.

#[must_use]
pub const fn is_mismatch(&self) -> bool;

Source line: 170.