Module conditions 

Executable scope conditions (SIGNATIF §11 scope-conditions).

A scope may carry scope conditions — executable predicates evaluated at verification time against the content and context of the artifact. An artifact signed by a key whose scope conditions are not met fails verification, regardless of cryptographic signature validity — this is one of the pipeline’s hard checks.

The expression language is a deterministic subset of JSON Logic (the Annex E reference choice): var paths over the evaluation context, numeric/string comparisons, and boolean combinators. Determinism (§11 condition-determinism): the evaluation context is fully determined by the artifact and its chain — payload, artifact id, signer reference, dimension, and the signer’s attestation timestamp. No wall-clock, no external state.

Structs

ConditionContext

The evaluation context for scope conditions: everything the artifact and its chain determine, and nothing else.

Functions

evaluate_all

Evaluate every condition; all must hold.

evaluate_condition

Evaluate one condition expression against a context.