Record Class SigningExecutionEvidence

java.lang.Object
java.lang.Record
zeroecho.pki.application.SigningExecutionEvidence
Record Components:
namespace - signing namespace
fingerprint - immutable semantic acceptance commitment
ownerType - signing-owner principal type
ownerId - signing-owner principal identity
detailCode - safe terminal detail classification, when present
outcome - terminal outcome
public record SigningExecutionEvidence(String namespace, String fingerprint, String ownerType, String ownerId, Optional<String> detailCode, SigningExecutionEvidence.Outcome outcome) extends Record
Immutable, server-derived evidence for the terminal outcome of one signing operation (CA private-key usage).

Every issuance, status object, CA certificate, and CRL is produced by a signing operation, so this evidence provides the key-usage audit dimension: which signing namespace and accepted-request fingerprint produced a terminal outcome, under whose ownership, with which outcome classification. It is recorded when a signing record reaches a terminal state (SIGNED, FAILED, CANCELLED, EXPIRED) and is derivable entirely from that terminal record. Because signing records are retired after downstream publication, the evidence is appended in the append-ordered signing-evidence log so a bounded, crash-consistent audit projector can project retained key-use evidence independently of record retirement. Delivery is best-effort and opt-in: a missing append is recoverable only while the authoritative workflow remains retained. A composite proof uses its distinct provider step ID as the feed marker and shares the parent acceptance commitment; proof success is recorded even if later verification or certificate publication fails.

  • Field Details

    • NAMESPACE

      public static final AttributeId NAMESPACE
      Evidence attribute vocabulary.

    • FINGERPRINT

      public static final AttributeId FINGERPRINT
      Evidence attribute vocabulary.

    • OWNER_TYPE

      public static final AttributeId OWNER_TYPE
      Evidence attribute vocabulary.

    • OWNER_ID

      public static final AttributeId OWNER_ID
      Evidence attribute vocabulary.

    • DETAIL_CODE

      public static final AttributeId DETAIL_CODE
      Evidence attribute vocabulary.

    • OUTCOME

      public static final AttributeId OUTCOME
      Evidence attribute vocabulary.

  • Constructor Details

  • Method Details

    • terminal

      public static SigningExecutionEvidence terminal(String namespace, String fingerprint, String ownerType, String ownerId, Optional<String> detailCode, SigningExecutionEvidence.Outcome outcome)
      Creates authoritative terminal signing evidence.
      Parameters:
      namespace - signing namespace
      fingerprint - immutable semantic acceptance commitment
      ownerType - signing-owner principal type
      ownerId - signing-owner principal identifier
      detailCode - optional safe terminal detail classification
      outcome - terminal outcome
      Returns:
      validated terminal evidence

    • attributes

      public AttributeSet attributes()
      Returns an immutable set containing only the closed evidence vocabulary.
      Returns:
      canonical evidence attributes

    • decode

      public static Optional<SigningExecutionEvidence> decode(AttributeSet attributes)
      Strictly decodes the closed version-one evidence vocabulary.
      Parameters:
      attributes - attributes to inspect
      Returns:
      empty only when no version-one evidence attribute is present
      Throws:
      IllegalArgumentException - if evidence is unknown, partial, duplicated, or mistyped

    • decode

      public static Optional<SigningExecutionEvidence> decode(byte[] payload)
      Decodes a feed payload containing UTF-8 canonical unpadded base64url attributes. The encoded byte count is bounded before allocation; the existing attribute decoder enforces canonical framing and its decoded-byte and entry limits.
      Parameters:
      payload - exact evidence-feed bytes, borrowed for this call
      Returns:
      empty only when this evidence family's vocabulary is absent
      Throws:
      IllegalArgumentException - if framing or this family's vocabulary is invalid

    • toString

      public final String toString()
      Returns a string representation of this record class. The representation contains the name of the class, followed by the name and value of each of the record components.
      Specified by:
      toString in class Record
      Returns:
      a string representation of this object

    • hashCode

      public final int hashCode()
      Returns a hash code value for this object. The value is derived from the hash code of each of the record components.
      Specified by:
      hashCode in class Record
      Returns:
      a hash code value for this object

    • equals

      public final boolean equals(Object o)
      Indicates whether some other object is "equal to" this one. The objects are equal if the other object is of the same class and if all the record components are equal. All components in this record class are compared with Objects::equals(Object,Object).
      Specified by:
      equals in class Record
      Parameters:
      o - the object with which to compare
      Returns:
      true if this object is the same as the o argument; false otherwise.

    • namespace

      public String namespace()
      Returns the value of the namespace record component.
      Returns:
      the value of the namespace record component

    • fingerprint

      public String fingerprint()
      Returns the value of the fingerprint record component.
      Returns:
      the value of the fingerprint record component

    • ownerType

      public String ownerType()
      Returns the value of the ownerType record component.
      Returns:
      the value of the ownerType record component

    • ownerId

      public String ownerId()
      Returns the value of the ownerId record component.
      Returns:
      the value of the ownerId record component

    • detailCode

      public Optional<String> detailCode()
      Returns the value of the detailCode record component.
      Returns:
      the value of the detailCode record component

    • outcome

      public SigningExecutionEvidence.Outcome outcome()
      Returns the value of the outcome record component.
      Returns:
      the value of the outcome record component