Trust Activation Exchange

An exchange shares visibility, and runtime trust stays with the receiver

Each reference in the exchange names the operator that published the artifact and its sha256 digest, so the receiver can fetch the artifact and confirm it is the one the source reviewed.

Local activation and manual review are acts the receiving operator performs on its own side. Until both happen, the listing is visible and prohibitAmbientRuntimeAdmission keeps any call from being admitted on the strength of visibility. After them, admission is still bounded by the trust scope: its namespace, the subject operator, and the actor kinds and admission classes it allows.

The validator refuses any exchange that relaxes a control

An exchange is valid only when all five import-control flags are true, both delegation-control flags are true, and maxHops is above zero. Every exchange that validates therefore carries the same floor, whichever operator wrote it:

1. Explicit local activation. The receiver activates the listing itself (explicitLocalActivationRequired).
2. Manual review. A person on the receiving side reviews it (manualReviewRequired).
3. Fresh inputs. The receiver rejects stale inputs (rejectStaleInputs).
4. Visibility without trust. The exchange may be seen before it is trusted (allowVisibilityWithoutRuntimeTrust), and visibility alone admits nothing (prohibitAmbientRuntimeAdmission).

Explicit local activation and manual review are requirement TRUSTMAX-01 in the qualification matrix on Federation Assurance.

The reference exchange validates, and three altered copies are refused

The federation guide project loads the published reference exchange, validates it, then hands the same validator copies that drop one control each or change the schema.

Validate a trust activation exchange

Load the reference exchange, validate it, and watch the same validator refuse an exchange that drops explicit local activation or manual review.

Complete the project setup, then run the program from federation-guide/. The download includes every constructor and input.

cargo run --locked --bin activation

reference exchange fex-1: valid; origin-operator to consumer-operator for listing listing-liability-provider-1
import control: local activation required, manual review required
exchange without explicit local activation: refused (invalid exchange: federation imports must require explicit local activation)
exchange without manual review: refused (invalid exchange: federation imports must require manual review)
unsupported schema: refused (unsupported schema: chio.federation-activation-exchange.v0)

The exchange is the published standards example with declared artifact references. Validation checks the contract, not the referenced artifacts; a receiver still resolves and reviews each reference before activating anything locally.

//! Validate a federation activation exchange and show that visibility never
//! becomes runtime trust without explicit local activation and manual review.
use chio_federation::activation::{
    validate_federation_activation_exchange, FederationActivationExchangeArtifact,
};
use chio_federation::error::FederationContractError;
use serde_json::Value;

fn receive(value: Value) -> Result<FederationActivationExchangeArtifact, FederationContractError> {
    let exchange: FederationActivationExchangeArtifact = serde_json::from_value(value)
        .map_err(|e| FederationContractError::InvalidExchange(e.to_string()))?;
    validate_federation_activation_exchange(&exchange)?;
    Ok(exchange)
}

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let reference: Value = serde_json::from_slice(&std::fs::read("activation-exchange.json")?)?;
    let exchange = receive(reference.clone())?;
    assert!(exchange.import_control.explicit_local_activation_required);
    assert!(exchange.import_control.manual_review_required);
    println!(
        "reference exchange {}: valid; {} to {} for listing {}",
        exchange.exchange_id,
        exchange.source_operator_id,
        exchange.target_operator_id,
        exchange.listing_id
    );
    println!("import control: local activation required, manual review required");
    let mut ambient = reference.clone();
    ambient["importControl"]["explicitLocalActivationRequired"] = false.into();
    let err = receive(ambient).unwrap_err();
    assert!(matches!(err, FederationContractError::InvalidExchange(_)));
    println!("exchange without explicit local activation: refused ({err})");
    let mut unreviewed = reference.clone();
    unreviewed["importControl"]["manualReviewRequired"] = false.into();
    let err = receive(unreviewed).unwrap_err();
    assert!(matches!(err, FederationContractError::InvalidExchange(_)));
    println!("exchange without manual review: refused ({err})");
    let mut wrong_schema = reference;
    wrong_schema["schema"] = "chio.federation-activation-exchange.v0".into();
    let err = receive(wrong_schema).unwrap_err();
    assert!(matches!(err, FederationContractError::UnsupportedSchema(_)));
    println!("unsupported schema: refused ({err})");
    Ok(())
}

Open the source file. Each program asserts its expected refusals; keys, timestamps, and digests change between runs.

You should see the reference exchange accepted with both import requirements named, then three refusals, each stating the control or schema that failed.

A receiving operator runs the same validator from the command line on an exchange it was sent, before anyone starts the review:

chio federation activation verify --exchange activation-exchange.json

exchange    fex-1, origin-operator to consumer-operator
listing     listing-liability-provider-1
import      local activation required, manual review required, stale inputs rejected
runtime     visibility only; no call is admitted until you activate locally
delegation  2 hops, attenuation required
valid       chio.federation-activation-exchange.v1

The delegation control bounds how far an exchange travels

The delegation control names the delegating and delegate operators and how many further hops the delegate may make. Each hop must narrow what it passes on (attenuationRequired), and the delegate sees the listing without trusting it until it activates locally (visibilityOnlyUntilLocalActivation). The reference exchange allows two hops from origin-operator to consumer-operator.

Read more in Cross-operator delegation.

Next: decide what an activated listing may enter