Module graph 

The trust graph: delegation DAG and verification path-finding (SIGNATIF §7).

Nodes are trust authorities (root, delegated, or end-certificate) carrying an aggregate public key, optional quorum parameters, and a multi-dimensional scope. Edges are delegation credentials — the parent’s signature over the child’s binding (identifier, key, quorum, scope). The graph generalizes a linear chain to a directed acyclic graph: cross-recognition and federated memberships produce multiple parents.

TrustGraph::find_paths collects every path from an artifact signer to a root present in the trust anchor bundle, validating the delegation signature and the monotonic scope narrowing at each link. Multiple valid paths and multiple distinct roots feed the coverage report’s cross-domain diversity scoring.

Structs

AcceptAllVerifier

A no-op verifier that accepts everything — for graph topology tests only; never use in production code paths.

AuthorityNode

A node in the trust graph.

DelegationEdge

A delegation edge: the parent’s credential over the child node.

PathLink

One verified delegation link on a path.

Quorum

Threshold quorum parameters (T of N).

TrustGraph

The trust graph: authorities and delegation edges forming a DAG.

VerificationPath

A complete verification path from an artifact signer to a root.

Enums

AuthorityKind

The kind of a trust authority node.

Traits

SignatureVerifier

Verifies a delegation signature: signature over message under public_key. Implementations bind the concrete algorithm fleet (Ed25519, ECDSA-P256, ML-DSA, threshold aggregate verification).