Module commit 

Pure commit validation rules.

These functions read an OpenMLS group, a staged commit, and the group’s AppData dictionary. They do not read the client database or fetch identities. xmtp_mls runs them inside ValidatedCommit and adds the identity and installation checks that need stored state.

Structs

AppDataUpdateInCommit

One AppDataUpdate proposal in a commit, with its sender’s authority.

CommitParticipant

Inbox

MembershipValidationInfo

Membership authorization has no metadata or permission diff fields. Each component update is checked against its authenticated proposer.

MetadataChanges

Actual metadata changes, used only for transcripts and status updates. Component policies authorize these changes before this summary is built.

MetadataFieldChange

ProposalChanges

Enums

CommitRuleError

A commit breaks a validation rule, or its group state cannot be read.

Functions

build_inbox_with_proposer

extract_commit_participant

Extracts the CommitParticipant from the [LeafNodeIndex]

extract_committer_and_proposers

Takes a [StagedCommit] and extracts the committer and all unique proposers.

extract_group_membership

Get GroupMembership from the AppData dictionary.

extract_readded_installations

Superadmins are permitted to readd installations, e.g. for fork recovery We can take these readded installations out of the list of installations to validate

get_current_group_members

get_latest_group_membership

Extracts the latest GroupMembership from the staged commit.

get_proposal_changes

Extracts the installations added and removed via proposals in the commit. Also returns a list of credentials from existing members that need verification (caused by update proposals) Tracks which proposer created each proposal for permission validation.

inbox_id_from_credential

Extracts the inbox ID from a credential.

metadata_changes_between

read_committed_metadata

read_post_commit_mutable_metadata

Read committed metadata once through the active extension representation. Decode the post-commit metadata for messages, callbacks, and admin side effects.

validate_app_data_update_proposals_in_commit

Validate every AppDataUpdate proposal carried by staged_commit against the group’s component registry.

validate_app_data_update_sequence

Validate a commit’s AppDataUpdate proposals in order and return each touched component’s state after the last of them (None once removed).

validate_committed_proposals

Validate the complete proposal list of a commit before any proposal is interpreted.

validate_identity_sequence_order

Require each identity sequence N to precede group envelope sequence S. N >= S is invalid on every receiver, independent of cache or replica state.

validate_membership_diff

Validate that the new group membership is a valid state transition from the old group membership. Enforces Rule 1 from above

validate_one_app_data_update

Validate a single AppDataUpdate (component_id + operation) against registry on behalf of actor.