Policy (jurisdictional + FIPS)

Confium::Policy is the process-wide hook for two related concerns:

  1. Jurisdictional rules — built-in profiles (EU, US, CNML) map each algorithm to a minimum key size; active jurisdiction is enforced by check! and by signing/verification paths.
  2. FIPS 140 mode — only FIPS-approved algorithms pass (ECDSA P-256/P-384, RSA; Ed25519 is not FIPS-approved).

The policy is process-wide. Set it once at boot; every subsequent Confium call honors it.

Setting a jurisdiction

Confium::Policy.known_jurisdictions
# => [:eu, :us, :cnml]

Confium::Policy.jurisdiction = :eu

An unknown jurisdiction raises ArgumentError. With a jurisdiction active, algorithm + key-size checks are enforced:

Confium::Policy.check!('rsa', key_bits: 3072)   # => true
Confium::Policy.check!('rsa', key_bits: 1024)
# => Confium::PolicyViolationError:
#     rsa key size 1024 below 2048 for eu

FIPS mode

Confium::Policy.fips_mode = true

In FIPS mode only FIPS-approved algorithms pass; enabling FIPS mode without a jurisdiction implies the US (NIST SP 800-131A) profile:

Confium::Policy.check!('ed25519', key_bits: 256)
# => Confium::PolicyViolationError:
#     algorithm ed25519 is not FIPS-approved
Confium::Policy.check!('ecdsa_p256', key_bits: 256)  # => true

Legacy algorithms (SHA-1, RSA-1024) are rejected under every built-in jurisdiction.

Resetting

Tests and REPLs can restore defaults:

Confium::Policy.reset!   # jurisdiction=nil, fips_mode=false

Per-call override (anti-pattern)

Policy is intentionally global. There is no per-call override. If you need to perform an operation that the policy disallows, the right answer is to change the policy deliberately, not to bypass it.

Deployment manifest

The deployment manifest (Confium::Config::Manifest) is the declarative counterpart for quorum/tier topology. It parses TOML directly:

manifest = Confium::Config::Manifest.from_toml(File.read('config/deploy.toml'))
manifest.valid?        # => true
manifest.validate      # => [] (list of problems, empty when valid)