Function load_for_delegate

atomic-canonical/src/delegation.rs:549–587

Every verified certificate in `store` naming `delegate` as its subject, newest first. Certificates that fail admission or verification are **skipped**, not returned as errors. This is the one place a corrupt or foreign file in the store could otherwise take down every agent operation, and a certificate that does not verify has no authority to convey in any case. A skip is not logged: this crate h

(
    store: &atomic_identity::IdentityStore,
    delegate: &Identity,
)

/// Verification is self-contained — it uses the delegator key the certificate
/// carries — so this works on a machine that holds only the agent's key.
pub fn load_for_delegate(
    store: &atomic_identity::IdentityStore,
    delegate: &Identity,
) -> Result<Vec<StoredDelegation>> {
    let delegate_did = delegate.id.to_did();
    let stored = store
        .list_delegations()
        .map_err(|e| CanonicalError::Proof(format!("failed to list delegations: {e}")))?;

    let mut out = Vec::new();
    for (id, raw) in stored {
        // Admission, not a plain parse: a stored certificate is a document this
        // machine received from somewhere else, and it is about to be verified.
        let Ok(value) = jcs::admit_document(raw.as_bytes()) else {
            continue;
        };
        // Cheap discriminator before the Ed25519 verify: most certificates in
        // a store belong to some other agent.
        match parse(&value) {
            Ok(parsed) if parsed.delegate == delegate_did => {}
            _ => continue,
        }
        let Ok(delegation) = verify_self_contained(&value) else {
            continue;
        };

        out.push(StoredDelegation {
            revoked_locally: store.is_revoked_locally(&id),
            id,
            delegation,
            document: value,
        });
    }

    // Newest first: when several certificates cover the same ground, the most
    // recently issued is the one the human meant.
    out.sort_by_key(|d| std::cmp::Reverse(d.delegation.issued));
    Ok(out)
}

/// The certificate currently in force for `delegate`, if any.
pub fn active_for_delegate(