Function load_for_delegate

atomic-canonical/src/delegation.rs:516–552

Every verified certificate in `store` naming `delegate` as its subject, newest first. Certificates that fail to parse or verify are **skipped**, not returned as errors. This is the one place a corrupt or foreign file in the store could otherwise take down every agent operation, and a certificate that does not verify has no authority to convey in any case. Each skip is logged at warn. Verificatio

(
    store: &atomic_identity::IdentityStore,
    delegate: &Identity,
)

/// Verification is self-contained — it uses the delegator key the certificate
/// carries — so this works on a machine that holds only the agent's key.
pub fn load_for_delegate(
    store: &atomic_identity::IdentityStore,
    delegate: &Identity,
) -> Result<Vec<StoredDelegation>> {
    let delegate_did = delegate.id.to_did();
    let stored = store
        .list_delegations()
        .map_err(|e| CanonicalError::Proof(format!("failed to list delegations: {e}")))?;

    let mut out = Vec::new();
    for (id, raw) in stored {
        let Ok(value) = serde_json::from_str::<Value>(&raw) else {
            continue;
        };
        // Cheap discriminator before the Ed25519 verify: most certificates in
        // a store belong to some other agent.
        match parse(&value) {
            Ok(parsed) if parsed.delegate == delegate_did => {}
            _ => continue,
        }
        let Ok(delegation) = verify_self_contained(&value) else {
            continue;
        };

        out.push(StoredDelegation {
            revoked_locally: store.is_revoked_locally(&id),
            id,
            delegation,
            document: value,
        });
    }

    // Newest first: when several certificates cover the same ground, the most
    // recently issued is the one the human meant.
    out.sort_by_key(|d| std::cmp::Reverse(d.delegation.issued));
    Ok(out)
}

/// The certificate currently in force for `delegate`, if any.
pub fn active_for_delegate(