Enum IdentityCustody 

pub enum IdentityCustody {
    Keyring,
    Passphrase(Passphrase),
    InMemory(UserKeypair),
    Custom(Arc<dyn DeviceIdentityCustody>),
}

How a store’s device-signing identity is protected. Selected on the builder, resolved once per store — the identity sibling of crate::custody::KeyCustody, same shape.

Variants

Keyring

The OS keyring — the default, byte-for-byte today’s behavior.

Passphrase(Passphrase)

Argon2id over a memorized passphrase wraps the keypair; the wrapped blob lives in a file in the store directory.

InMemory(UserKeypair)

Supplied for this session, never persisted by coven.

Custom(Arc<dyn DeviceIdentityCustody>)

A host-supplied custody implementation.

Implementations

impl IdentityCustody

pub fn resolve( self, store_id: &str, store_dir: &StoreDir, ) -> Arc<dyn DeviceIdentityCustody>

Resolve the selected policy into the trait object the identity- establishing call sites drive, injecting what each preset needs from the store’s identity: store_id for IdentityCustody::Keyring (the keyring account name), store_dir for IdentityCustody::Passphrase (the wrapped-file path).

Public to match KeyCustody::resolve: the low-level restore_from_cloud takes the already-resolved Arc<dyn DeviceIdentityCustody>, so a host restoring by a directly-supplied key (no restore code) must be able to resolve a preset itself, the same way it already resolves its KeyCustody.