Enum EnvelopeMode 

#[non_exhaustive]
pub enum EnvelopeMode {
    Required,
    Optional,
    Off,
}

How the layer treats one op’s traffic (ADR 0006 §2).

#[non_exhaustive] (API-review decision, 2026-09-26): a later mode (say, “signed requests only, unsigned responses”) must not be a breaking change for a policy that matches on this.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Required

Every request must be signed, GET, HEAD and DELETE included (they seal an empty payload; decision D3). An unsigned one is refused with the unsigned 401. Every response is sealed.

A signed HEAD still sends its COSE message as a request body, which RFC 9110 §9.3.2 gives no semantics: hyper’s server and reqwest pass it through over HTTP/1.1, but an intermediary may drop it (the request then fails verification, 401) or refuse the request. Prefer GET under Required.

Optional

A signed request is opened and its response is always sealed, as under Required (decision S3). An unsigned one runs as before; its response is sealed only when it carries a valid Cratestack-Nonce and the super::ResponseSealPolicy asks for it (D10). A signed request that fails verification is still the 401, never downgraded to unsigned.

Off

Plain traffic passes untouched. A request with a COSE body is still refused (415) rather than forwarded unverified.

Trait Implementations

impl Clone for EnvelopeMode

fn clone(&self) -> EnvelopeMode

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for EnvelopeMode

impl Debug for EnvelopeMode

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl EnvelopePolicy for EnvelopeMode

fn mode(&self, _request: &PolicyRequest<'_>) -> EnvelopeMode

The mode for this op.

fn unresolved_mode(&self) -> EnvelopeMode

The mode for traffic the layer cannot attribute to one op: a route the router matched but the resolver cannot bind (a wrong mount prefix, a hand-written route; decision S2), or a /rpc/batch body whose frames it cannot read (B1). Under Required the first fails closed with a 500 unless the route is allow-listed (super::EnvelopeLayerBuilder::allow_unresolved), and the second is refused. Under a non-Required answer, both pass through, and so does a method the schema does not generate on a generated path (otherwise the layer’s 405), unsigned.

impl Eq for EnvelopeMode

impl Hash for EnvelopeMode

fn hash<__H>(&self, state: &mut __H)

where __H: Hasher,

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for EnvelopeMode

fn eq(&self, other: &EnvelopeMode) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for EnvelopeMode