Verify with the Rust kernel

Guide / auths-proof

The auths-proof facade exposes two supported verification paths.

Portable boundary

let result = engine.verify_cbor(
    proof_cbor,
    canonical_action_cbor,
    trusted_context_cbor,
)?;

Use this boundary for language-neutral integration, conformance, receipts, and systems that exchange canonical protocol bytes. The result retains its exact canonical CBOR through as_cbor() and into_cbor().

Native sealed boundary

let outcome = engine.verify_typed(
    proof_cbor,
    &canonical_action,
    &verifier_context,
);

Use this path when a Rust application profile must decode a VerifiedAction. The outcome is Authorized(Box<VerifiedAction>), Denied(DenialReason), or Indeterminate(Requirement).

Explicit inputs

Neither path reads a clock, network, filesystem, database, environment variable, private key, replay store, or budget store. Supply all varying and trusted data through the action and verifier context.