Source: openagent-sdk/sdks/rust/src/verification.rs. SHA-256: 9244631fd8211d5e12d74a0e176f213441496c235ec2f2aee5d8900f20b58f7b.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

Module condition:

#[cfg(feature = "aegis")]

verification::Verifier

Wraps an AEGIS client.

The verifier owns its AegisClient (cheap-clone via Arc internally) and is meant to be shared across an entire process. Construction is async-free because AEGIS uses lazy in-memory stores by default.

#[cfg(feature = "aegis")]
#[derive(Clone)]
pub struct Verifier {

}

Source line: 29.

verification::Verifier::new

Build a verifier with the supplied plugin registry and AEGIS defaults.

#[cfg(feature = "aegis")]
pub fn new(registry: Arc<PluginRegistry>) -> Self;

Source line: 35.

verification::Verifier::from_client

Wrap an existing [AegisClient].

Use this when you've configured AEGIS with custom storage backends (e.g., PostgreSQL) or a non-default policy engine.

#[cfg(feature = "aegis")]
pub fn from_client(client: AegisClient) -> Self;

Source line: 45.

verification::Verifier::inner

Reference to the wrapped AEGIS client for advanced use.

#[cfg(feature = "aegis")]
pub fn inner(&self) -> &AegisClient;

Source line: 52.

verification::Verifier::verify

Verify a DID end-to-end and return a [VerifiedContext].

Runs the full AEGIS verification pipeline: DID resolution, signature check, lineage walk back to a human root, revocation check, and liveness probe (subject to the configured TTL cache).

Errors

Returns [OpenAgentError::Verification] if any pipeline stage fails.

#[cfg(feature = "aegis")]
pub async fn verify(&self, did: &str) -> Result<VerifiedContext>;

Source line: 65.

verification::Verifier::authenticate

Authenticate a credential and return the resulting AEGIS session ID.

identity_type is Human for OAuth/Passkey/etc. and Agent for machine-to-machine flows. The two get different session lifetimes.

Errors

Returns [OpenAgentError::Authentication] if no provider accepts the credential.

#[cfg(feature = "aegis")]
pub async fn authenticate(
        &self,
        credential: &AuthCredential,
        identity_type: IdentityType,
    ) -> Result<String>;

Source line: 83.

verification::Verifier::authorize

Evaluate an authorization request against the registered policy engine.

Errors

Returns [OpenAgentError::Authorization] if the policy engine errors (a deny decision is not an error — inspect [PolicyDecision]).

#[cfg(feature = "aegis")]
pub async fn authorize(&self, request: &PolicyRequest) -> Result<PolicyDecision>;

Source line: 98.

verification::LineageAuthorityContext

Sigil-backed lineage authority attached by an OAS verifier.

#[cfg(feature = "aegis")]
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct LineageAuthorityContext {
/// DID whose privileged authority was verified.

pub subject: String,
/// Backend/source identifier, normally `sigil_gal`.

pub source: String,
/// Finalized root DID for the verified path.

pub root: String,
/// Reconstructed finalized path, ordered root to caller.

pub path: Vec<String>,
/// Sigil block height at which this authority was finalized.

pub finalized_block: u64,
/// Authority path kind, e.g. `human_to_agent`.

pub path_kind: String,
/// Scopes proven by this lineage path.

pub scopes: Vec<String>,
/// Generation/depth from root to subject.

pub generation: u32,
/// Accepted root kind for this authority path.

pub root_kind: Option<String>,
/// Optional org lineage root commitment for org-scoped authority.

pub org_root_commitment: Option<String>,
/// Optional expiry timestamp for the authority edge/path.

pub expires_at: Option<String>
}

Source line: 105.

verification::authority_context_from_oas

Convert an OAS privileged-authority verification into OpenAgent runtime auth context.

This is the OpenAgent-side bridge for sensitive operations: callers provide an OAS document resolver and an authority source adapter, and OpenAgent receives a normalized context it can attach to ACT/request verification.

#[cfg(feature = "aegis")]
pub fn authority_context_from_oas(
    document: &OasDocument,
    provider: &dyn DocumentProvider,
    config: &VerifyConfig,
    authority_source: &dyn LineageAuthoritySource,
    path_kind: AuthorityPathKind,
    required_scopes: &[String],
    min_finalized_block: Option<u64>,
) -> Result<LineageAuthorityContext>;

Source line: 136.

verification::VerifiedContext

VerifiedContext is what callers get back from [crate::OpenAgent::authenticate]. It bundles the DID that was verified, the raw AEGIS [VerificationResult] for advanced use, and optional Sigil-backed lineage authority for privileged actions.

#[cfg(feature = "aegis")]
#[derive(Debug, Clone)]
pub struct VerifiedContext {
/// The DID that was verified.

pub did: String,
/// The raw AEGIS verification result (lineage chain, expiry, etc.).

pub result: VerificationResult,
/// OAS + Sigil authority proof required for privileged access.

pub lineage_authority: Option<LineageAuthorityContext>
}

Source line: 183.

verification::VerifiedContext::is_valid

True if the verification considered the DID valid.

Combines signature, lineage, revocation, and liveness into a single boolean. Use [Self::result] for the breakdown.

#[cfg(feature = "aegis")]
pub fn is_valid(&self) -> bool;

Source line: 197.

verification::VerifiedContext::require_privileged_authority

Return the attached Sigil-backed authority or fail closed.

#[cfg(feature = "aegis")]
pub fn require_privileged_authority(&self) -> Result<&LineageAuthorityContext>;

Source line: 209.