cadrumo.adapters.persistence.storage.custody.errors module

Typed refusals and integrity failures for profile custody.

class ProfileCustodyRefusal(*values)[source]

Bases: StrEnum

Stable refusal reasons exposed by the current custody contract.

LEGACY_CUSTODY_DETECTED
DEK_ROTATION_UNSUPPORTED
KDF_RESOURCE_LIMIT
KDF_SUPERVISION_UNAVAILABLE
class ProfileCustodyRecoveryGuidance(*values)[source]

Bases: StrEnum

Closed operator actions accompanying a custody refusal.

DESTRUCTIVE_RESET
REENROLL_PROFILE
exception ProfileCustodyError(message=None, *, context=None, translated_message=None)[source]

Bases: SecretStoreError

Base failure for profile-scoped password custody.

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

Return type:

None

code
exception ProfileCustodyRecordError(message=None, *, context=None, translated_message=None)[source]

Bases: ProfileCustodyError

Raised when a current-format custody record is malformed or altered.

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

Return type:

None

code
exception ProfileCustodyConcurrentCapsuleChangeError(message=None, *, context=None, translated_message=None)[source]

Bases: ProfileCustodyRecordError

Raised when a capsule changed generation between two anchored reads.

A committed capsule always carries its label beside the commit marker that proved it. So an anchored observation that parses the marker and then finds no label member did not observe a malformed capsule – it observed a capsule being published or deleted underneath it. Separating that from ProfileCustodyRecordError keeps a caller from reporting a transient race as on-disk corruption, which is the difference between “retry the listing” and “this store is damaged”.

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

Return type:

None

code
exception ProfileCustodyPasswordError(message=None, *, context=None, translated_message=None)[source]

Bases: ProfileCustodyError

Raised when profile-password representation or proof is refused.

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

Return type:

None

code
exception ProfileCustodyRecoverySecretError(message=None, *, context=None, translated_message=None)[source]

Bases: ProfileCustodyError

Raised when recovery-secret representation or proof is refused.

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

Return type:

None

code
exception ProfileCustodyRefusedError(refusal, *, context=None, recovery_guidance=(), translated_message=None)[source]

Bases: ProfileCustodyError

Raised for a deliberate, stable current-custody refusal.

Parameters:
Return type:

None

code
exception WipeTypeError(message=None, *, context=None, translated_message=None)[source]

Bases: StorageError

Raised when the wipe primitive receives a value it cannot overwrite.

Zeroisation needs a mutable buffer; handing it an immutable bytes is a programming error whose damage is silent, because the caller believes key material was wiped when nothing was touched. The typed storage surface propagates it through domain boundaries; callers should catch WipeTypeError rather than a builtin TypeError.

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

Return type:

None

code