Class X509AuthoritySnapshot

java.lang.Object
zeroecho.pki.impl.framework.x509.X509AuthoritySnapshot
public final class X509AuthoritySnapshot extends Object
One immutable internally consistent runtime authority snapshot.

The snapshot composes identities, X.509 components, binding rules, installed execution capabilities, aliases, immutable defaults, security floor, and configured policy once. It owns the effective resolver and a stable semantic fingerprint. It contains no key material and is not persisted in Phase A.

  • Constructor Details

  • Method Details

    • installed

      public static X509AuthoritySnapshot installed(X509AlgorithmResolver.Policy policy)
      Creates the installed runtime snapshot with an explicit policy.
      Parameters:
      policy - configured restrictive policy
      Returns:
      installed snapshot

    • compose

      public static X509AuthoritySnapshot compose(List<X509BindingRuleProvider> bindingProviders, List<AlgorithmExecutionCapabilityProvider> capabilityProviders, X509AlgorithmResolver.Policy policy)
      Composes one runtime graph from explicitly selected trusted providers.
      Parameters:
      bindingProviders - binding and identity contributors
      capabilityProviders - execution contributors used by this runtime
      policy - restrictive policy
      Returns:
      immutable authority snapshot

    • compose

      public static X509AuthoritySnapshot compose(List<X509BindingRuleProvider> bindingProviders, List<AlgorithmExecutionCapabilityProvider> capabilityProviders, List<X509AuthoritySnapshot.ExecutorBinding> executorBindings, X509AlgorithmResolver.Policy policy)
      Composes one runtime graph with exact process-local executor bindings.
      Parameters:
      bindingProviders - binding and identity contributors
      capabilityProviders - semantic execution contributors
      executorBindings - actual process-local executors
      policy - restrictive policy
      Returns:
      immutable authority snapshot

    • resolveIdentity

      public AlgorithmIdentity resolveIdentity(String value)
      Resolves a canonical identity or finite built-in compatibility alias.
      Parameters:
      value - canonical identity or approved legacy alias
      Returns:
      exact identity

    • resolveDefault

      public AlgorithmSuite resolveDefault(String identifier)
      Resolves an immutable built-in default without extension override.
      Parameters:
      identifier - versioned default identifier
      Returns:
      exact default suite

    • resolve

      public X509AlgorithmResolver.Selection resolve(AlgorithmIdentity signature, AlgorithmIdentity key, AlgorithmExecutionCapability.Direction direction, Optional<String> implementation, String provenance)
      Resolves one effective operation and binds it to this snapshot fingerprint.
      Parameters:
      signature - exact signature identity
      key - exact public-key identity
      direction - execution direction
      implementation - optional implementation selection
      provenance - explicit or default provenance
      Returns:
      effective immutable selection

    • resolve

      public X509AlgorithmResolver.Selection resolve(AlgorithmIdentity signature, AlgorithmIdentity key, AlgorithmExecutionCapability.Direction direction, Optional<String> implementation, String provenance, String bindingId)
      Resolves one operation through an explicitly selected role-specific binding.
      Parameters:
      signature - exact signature identity
      key - exact public-key identity
      direction - execution direction
      implementation - optional implementation selection
      provenance - explicit or default provenance
      bindingId - stable role-specific binding identifier
      Returns:
      effective immutable selection bound to this snapshot

    • plan

      public <E> X509ExecutionPlan<E> plan(AlgorithmIdentity signature, AlgorithmIdentity key, AlgorithmExecutionCapability.Direction direction, Optional<String> implementation, String provenance, Class<E> executorType)
      Resolves and authorizes one process-local execution plan.
      Type Parameters:
      E - executor type
      Parameters:
      signature - exact signature identity
      key - exact public-key identity
      direction - operation direction
      implementation - optional exact implementation identifier
      provenance - explicit or default provenance
      executorType - required runtime executor type
      Returns:
      unforgeable process-local plan

    • plan

      public <E> X509ExecutionPlan<E> plan(AlgorithmIdentity signature, AlgorithmIdentity key, AlgorithmExecutionCapability.Direction direction, Optional<String> implementation, String provenance, String bindingId, Class<E> executorType)
      Resolves and authorizes one plan through an explicit binding identity.
      Type Parameters:
      E - required executor type
      Parameters:
      signature - exact signature identity
      key - exact public-key identity
      direction - execution direction
      implementation - optional implementation selection
      provenance - explicit or default provenance
      bindingId - stable role-specific binding identifier
      executorType - required runtime executor type
      Returns:
      unforgeable process-local execution plan

    • planSigning

      public <E> X509ExecutionPlan<E> planSigning(String value, String implementation, Class<E> executorType)
      Resolves a signing plan for a legacy upper API that carries only the signature identity.
      Type Parameters:
      E - executor type
      Parameters:
      value - canonical identity or approved finite alias
      implementation - exact implementation identifier
      executorType - required executor type
      Returns:
      exact process-local signing plan

    • planSigning

      public <E> X509ExecutionPlan<E> planSigning(String value, Class<E> executorType)
      Resolves a signing plan when exactly one implementation is available.
      Type Parameters:
      E - executor type
      Parameters:
      value - canonical identity or approved finite alias
      executorType - required executor type
      Returns:
      exact process-local signing plan

    • planSigningWithBinding

      public <E> X509ExecutionPlan<E> planSigningWithBinding(String value, String bindingId, Class<E> executorType)
      Resolves a signing plan through one explicit binding.
      Type Parameters:
      E - required executor type
      Parameters:
      value - canonical signature identity or approved finite alias
      bindingId - stable signature-binding identifier
      executorType - required runtime executor type
      Returns:
      exact process-local signing plan

    • planSigningWithBinding

      public <E> X509ExecutionPlan<E> planSigningWithBinding(String value, String bindingId, String implementation, Class<E> executorType)
      Resolves a signing plan through one explicit binding and one explicit implementation. Required when several signing implementations are bound and the binding alone does not select one.
      Type Parameters:
      E - executor type
      Parameters:
      value - canonical identity or approved finite alias
      bindingId - exact signature binding identifier
      implementation - exact implementation identifier
      executorType - required executor type
      Returns:
      exact process-local signing plan

    • authorize

      public void authorize(X509ExecutionPlan<?> plan, Object expectedExecutor, AlgorithmExecutionCapability.Direction direction)
      Validates an execution plan immediately before invoking its executor.
      Parameters:
      plan - plan minted by this snapshot
      expectedExecutor - exact executor reference expected by the boundary
      direction - required operation direction
      Throws:
      IllegalArgumentException - if provenance, executor, implementation, or direction differs

    • completeStatusObject

      public X509SignedObjectCompletion completeStatusObject(StatusObject statusObject, X509ExecutionPlan<SigningProvider> signingPlan)
      Mints the live completion of an X.509 status-object SIGN operation.
      Parameters:
      statusObject - immutable generated status object
      signingPlan - exact live SIGN plan used to produce its content
      Returns:
      non-forgeable process-local completion
      Throws:
      IllegalArgumentException - if the plan is foreign or not an authorized SIGN plan

    • requireStatusCompletion

      public StatusObject requireStatusCompletion(X509SignedObjectCompletion completion)
      Validates and unwraps a status completion minted by this live authority.
      Parameters:
      completion - signed-object completion
      Returns:
      immutable completed status object
      Throws:
      IllegalArgumentException - if provenance or executor binding differs

    • requireStatusSigningPlan

      public X509ExecutionPlan<SigningProvider> requireStatusSigningPlan(X509SignedObjectCompletion completion)
      Returns the exact live SIGN plan after validating status completion provenance.
      Parameters:
      completion - status completion minted by this authority
      Returns:
      exact authorized SIGN plan
      Throws:
      IllegalArgumentException - if the completion belongs to another live runtime

    • requireExecutableSignature

      public AlgorithmIdentity requireExecutableSignature(String value, AlgorithmExecutionCapability.Direction direction)
      Validates a persisted signature identity against the complete runtime authority intersection.
      Parameters:
      value - canonical identity or approved compatibility alias
      direction - execution direction
      Returns:
      exact canonical signature identity

    • requireAuthority

      public void requireAuthority(X509AlgorithmResolver.Selection selection)
      Rejects a selection produced by a semantically different authority snapshot.
      Parameters:
      selection - effective selection

    • bindExecutor

      public static X509AuthoritySnapshot.ExecutorBinding bindExecutor(String implementationId, AlgorithmExecutionCapability.Direction direction, Object executor)
      Creates one exact process-local executor binding.
      Parameters:
      implementationId - semantic capability implementation identifier
      direction - supported execution direction
      executor - actual runtime executor
      Returns:
      immutable binding contribution

    • resolver

      public X509AlgorithmResolver resolver()
      Returns the owned effective resolver.
      Returns:
      immutable resolver

    • bindings

      public X509BindingCatalog bindings()
      Returns the binding catalog snapshot.
      Returns:
      immutable bindings

    • components

      public X509ComponentCatalog components()
      Returns the component catalog snapshot.
      Returns:
      immutable components

    • semanticFingerprint

      public String semanticFingerprint()
      Returns the stable snapshot fingerprint.
      Returns:
      SHA-256 hexadecimal semantic fingerprint