cadrumo.adapters.persistence.storage.custody.digest_model module¶
The self-verifying custody record: one digest over its own payload.
Several custody records carry a self_digest field holding the canonical
digest of everything else in the record, so loading one re-derives the digest
and refuses a payload that has been altered underneath it. The shape is always
the same and differs only in a size budget and a subject string used in
refusals.
That shape was written out by hand in five classes across four modules. A base
factoring it already existed, but it lived in label_head_models, which
imports from capsule_records – so the two capsule records could not have
subclassed it without closing an import cycle. It lives here instead, in a
module that imports nothing from its siblings, which is what lets every custody
record reach it.
The chained-digest variant is deliberately NOT covered. A record that digests a content digest and then digests a payload INCLUDING that digest is a wider shape than one digest over one payload, and collapsing the two would mean this base silently accepting a record whose inner digest nobody checked.
- payload_without_self_digest(model)[source]¶
The digest payload: everything the record carries except the digest itself.
- class CustodyDigestModel(**data)[source]¶
Bases:
BaseModelShared canonical digest and JSON behavior for self-verifying custody records.
A subclass declares the three ClassVars and its own
self_digestfield. It keeps its own field validator for the digest’s SHAPE, because those genuinely differ: one record accepts a bare sha256, two accept thesha256:-prefixed form, and a third spells the check inline. Only the computation and the mismatch refusal are shared.- Parameters:
data (Any)
- self_digest: str¶
- property canonical_payload: dict[str, object]¶
Return the exact digest payload, excluding only
self_digest.