Enum IdentityCustody 

pub enum IdentityCustody {
    Keyring,
    Passphrase(Passphrase),
    InMemory(UserKeypair),
    Custom(Arc<dyn DeviceIdentityCustody>),
}

How a store’s device-signing identity is protected. Selected on the builder, resolved once per store — the identity sibling of crate::custody::KeyCustody, same shape.

Variants

Keyring

The OS keyring — the default, byte-for-byte today’s behavior.

Passphrase(Passphrase)

Argon2id over a memorized passphrase wraps the keypair; the wrapped blob lives in a file in the store directory.

InMemory(UserKeypair)

Supplied for this session, never persisted by coven.

Custom(Arc<dyn DeviceIdentityCustody>)

A host-supplied custody implementation.

Implementations

impl IdentityCustody

pub fn resolve( self, store_keys: &StoreKeys, store_dir: &StoreDir, ) -> Arc<dyn DeviceIdentityCustody>

Resolve the selected policy into the trait object the identity- establishing call sites drive, injecting what each preset needs from the store’s retained owners: store_keys for IdentityCustody::Keyring and store_dir for IdentityCustody::Passphrase.

Public to match KeyCustody::resolve: a host can resolve either policy against the same retained store-key capability used by the store boundary.