confium 0.2.0 → 0.3.1

data/ext/confium_native/src/audit.rs

@@ -0,0 +1,169 @@
+//! Confium::Audit — Ruby surface for audit logging.
+//!
+//! Stores the sink callback as a module-level instance variable on
+//! Confium::Audit. The sink is a Ruby Proc that receives an audit
+//! record Hash.
+//!
+//! In addition to the user-facing `record` function, this module
+//! exposes `fire_event` for the rest of the native extension to
+//! emit audit records from signing / verification entry points.
+//! `fire_event` is best-effort: if no sink is configured, or the
+//! sink raises, the calling operation still succeeds. Audit
+//! failures must never break a signing ceremony.
+
+use magnus::{exception, function, prelude::*, Error, Module, Ruby, Value};
+use sha2::{Digest, Sha256};
+
+const SINK_IVAR: &str = "@sink";
+
+/// Best-effort audit event emitter. Called from signing / verification
+/// entry points after the operation completes (whether successful or
+/// not). Structured fields:
+///
+/// - `operation` — short slug like `"composite_sign"` or `"tc_cmp20_sign"`.
+/// - `result` — `"success"` or `"failure"`.
+/// - `algorithm` — optional algorithm identifier.
+/// - `payload_hash` — hex SHA-256 of the signed/verified bytes (when
+///   applicable; pass `None` if no payload is involved).
+/// - `error` — optional error message on failure.
+///
+/// This function is intentionally silent on errors. If the sink
+/// itself raises, the exception is logged to stderr but does not
+/// propagate — the caller's crypto op has already succeeded.
+pub(crate) fn fire_event(
+    operation: &str,
+    result: &str,
+    algorithm: Option<&str>,
+    payload: Option<&[u8]>,
+    error: Option<&str>,
+) {
+    let ruby = match Ruby::get() {
+        Ok(r) => r,
+        Err(_) => return,
+    };
+    let audit_mod: magnus::RModule = match ruby
+        .class_object()
+        .const_get::<_, magnus::RModule>("Confium")
+        .and_then(|m: magnus::RModule| m.const_get::<_, magnus::RModule>("Audit"))
+    {
+        Ok(m) => m,
+        Err(_) => return,
+    };
+    let sink: Value = match audit_mod.ivar_get(SINK_IVAR) {
+        Ok(v) => v,
+        Err(_) => return,
+    };
+    if sink.is_nil() {
+        return;
+    }
+
+    let payload_hex = payload
+        .map(|bytes| {
+            let mut h = Sha256::new();
+            h.update(bytes);
+            hex::encode(h.finalize())
+        })
+        .unwrap_or_default();
+
+    let h = ruby.hash_new();
+    let _ = h.aset("timestamp", chrono::Utc::now().to_rfc3339());
+    let _ = h.aset("operation", operation);
+    let _ = h.aset("result", result);
+    let _ = h.aset("payload_hash", payload_hex);
+    if let Some(a) = algorithm {
+        let _ = h.aset("algorithm", a);
+    }
+    if let Some(e) = error {
+        let _ = h.aset("error", e);
+    }
+
+    // The sink may be a Proc or any object responding to #call
+    // (e.g. Confium::Audit::MemorySink). If it raises, log to stderr
+    // but don't propagate — audit must not break signing.
+    if let Err(e) = sink.funcall::<_, _, Value>("call", (h,)) {
+        eprintln!("confium: audit sink raised (audit event dropped): {e:?}");
+    }
+}
+
+/// Record an audit entry. Called from Ruby via Confium::Audit.record.
+fn record(
+    operation: String,
+    payload_hash: String,
+    result: String,
+    actor: Option<String>,
+    algorithm: Option<String>,
+    error: Option<String>,
+) -> Result<(), Error> {
+    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    let audit_mod: magnus::RModule = ruby
+        .class_object()
+        .const_get("Confium")
+        .and_then(|m: magnus::RModule| m.const_get("Audit"))
+        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+
+    let sink: Value = audit_mod.ivar_get(SINK_IVAR)?;
+    if sink.is_nil() {
+        return Ok(());
+    }
+
+    let h = ruby.hash_new();
+    let _ = h.aset("timestamp", chrono::Utc::now().to_rfc3339());
+    let _ = h.aset("operation", operation);
+    if let Some(a) = actor {
+        let _ = h.aset("actor", a);
+    }
+    if let Some(alg) = algorithm {
+        let _ = h.aset("algorithm", alg);
+    }
+    let _ = h.aset("payload_hash", payload_hash);
+    let _ = h.aset("result", result);
+    if let Some(e) = error {
+        let _ = h.aset("error", e);
+    }
+
+    let _: Value = sink
+        .funcall("call", (h,))
+        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    Ok(())
+}
+
+/// Set the global audit sink. `callback` is a Proc that receives a Hash
+/// or nil to disable auditing.
+fn set_sink(callback: Value) -> Result<(), Error> {
+    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    let audit_mod: magnus::RModule = ruby
+        .class_object()
+        .const_get("Confium")
+        .and_then(|m: magnus::RModule| m.const_get("Audit"))
+        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    audit_mod.ivar_set(SINK_IVAR, callback)?;
+    Ok(())
+}
+
+/// Get the current audit sink (or nil if not set).
+fn get_sink() -> Result<Value, Error> {
+    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    let audit_mod: magnus::RModule = ruby
+        .class_object()
+        .const_get("Confium")
+        .and_then(|m: magnus::RModule| m.const_get("Audit"))
+        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    audit_mod.ivar_get(SINK_IVAR)
+}
+
+/// Whether audit logging is enabled (a non-nil sink is set).
+fn audit_enabled() -> Result<bool, Error> {
+    let sink = get_sink()?;
+    Ok(!sink.is_nil())
+}
+
+pub fn init(ruby: &Ruby, parent: magnus::RModule) -> Result<(), Error> {
+    let audit = parent.define_module("Audit")?;
+    // Initialize the ivar to nil.
+    audit.ivar_set(SINK_IVAR, ruby.qnil())?;
+    audit.define_module_function("sink=", function!(set_sink, 1))?;
+    audit.define_module_function("sink", function!(get_sink, 0))?;
+    audit.define_module_function("enabled?", function!(audit_enabled, 0))?;
+    audit.define_module_function("record", function!(record, 6))?;
+    Ok(())
+}

data/ext/confium_native/src/composite.rs

@@ -0,0 +1,302 @@
+//! Confium::Composite — Ruby surface for `confium_composite`.
+//!
+//! Exposes PQ-migration composite signatures (Ed25519 + ML-DSA-65 etc.).
+//!
+//!   - `Confium::Composite::Signature` — a composite signature with multiple
+//!     algorithm components over the same message. Wraps
+//!     `confium_composite::CompositeSignature`.
+//!   - `Confium::Composite.sign_ed25519(private_key_bytes, message)` —
+//!     helper that builds a real Ed25519 component using
+//!     `ed25519_dalek::SigningKey`.
+//!   - `Confium::Composite::VerificationResult` — result of `#verify(message)`,
+//!     with `#all_verified?` and `#per_component` accessors.
+
+use confium_composite::{CompositeSignature, ComponentSignature, VerificationResult};
+use ed25519_dalek::SigningKey;
+use magnus::{
+    exception, function, method, prelude::*, scan_args,
+    typed_data::Obj, DataTypeFunctions, Error, IntoValue,
+    Module, Object, RHash, Ruby, TryConvert, TypedData, Value,
+};
+use crate::util::{bytes_from_value, bytes_to_rstring, confium_error, new_details};
+use rand_core::OsRng;
+
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::Composite::Signature", size)]
+pub struct CompositeSig {
+    inner: std::cell::RefCell<CompositeSignature>,
+}
+
+impl CompositeSig {
+    fn new(components: Value) -> Result<Self, Error> {
+        let comps = parse_components(components)?;
+        Ok(Self {
+            inner: std::cell::RefCell::new(CompositeSignature::new(comps)),
+        })
+    }
+
+    fn component_count(&self) -> usize {
+        self.inner.borrow().component_count()
+    }
+
+    fn algorithms(&self) -> Vec<String> {
+        self.inner
+            .borrow()
+            .algorithms()
+            .into_iter()
+            .map(String::from)
+            .collect()
+    }
+
+    /// Verify all components against `message`. Built-in verifiers cover
+    /// Ed25519 + ECDSA-P256. Caller-supplied verifiers (a Ruby Hash
+    /// `algorithm_string -> Proc(public_key, message, signature)`) plug
+    /// in for any other algorithm. Returns a typed VerificationResult.
+    fn verify(&self, args: &[Value]) -> Result<Obj<VerificationResultWrap>, Error> {
+        let scanned = scan_args::scan_args::<(Value,), (Option<Value>,), (), (), (), ()>(args)?;
+        let message = scanned.required.0;
+        let verifiers_value = scanned.optional.0;
+        let msg = bytes_from_value(message)?;
+        let caller_verifiers = match verifiers_value {
+            Some(v) => parse_caller_verifiers(v)?,
+            None => std::collections::HashMap::new(),
+        };        let result = self
+            .inner
+            .borrow()
+            .verify(&msg, |algorithm, public_key, m, signature| {
+                if algorithm == confium_composite::ED25519 {
+                    confium_composite::ed25519_verifier(algorithm, public_key, m, signature)
+                } else if algorithm == confium_composite::ECDSA_P256 || algorithm == "ECDSA" {
+                    confium_composite::p256_verifier(algorithm, public_key, m, signature)
+                } else if let Some(callback) = caller_verifiers.get(algorithm) {
+                    invoke_caller_verifier(callback, public_key, m, signature)
+                } else {
+                    Err(format!("unsupported algorithm: {algorithm}"))
+                }
+            })
+            .map_err(|e| {
+                let ruby = Ruby::get().expect("Ruby must be available");
+                let details = new_details(&ruby);
+                confium_error(e.to_string(), "VerificationError", details)
+            })?;
+        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        Ok(ruby.obj_wrap(VerificationResultWrap { inner: result }))
+    }
+}
+
+/// Caller-supplied verifier callbacks keyed by algorithm string.
+/// Each value is a Ruby Proc taking (public_key_bytes, message_bytes,
+/// signature_bytes) and returning true/false.
+type CallerVerifiers = std::collections::HashMap<String, magnus::Value>;
+
+fn parse_caller_verifiers(v: Value) -> Result<CallerVerifiers, Error> {
+    let hash: RHash = RHash::try_convert(v)?;
+    let mut out = CallerVerifiers::new();
+    hash.foreach(|k: Value, val: Value| {
+        let key: String = String::try_convert(k)?;
+        out.insert(key, val);
+        Ok(magnus::r_hash::ForEach::Continue)
+    })?;
+    Ok(out)
+}
+
+fn invoke_caller_verifier(
+    callback: &magnus::Value,
+    public_key: &[u8],
+    message: &[u8],
+    signature: &[u8],
+) -> Result<(), String> {
+    let ruby = Ruby::get().map_err(|e| e.to_string())?;
+    let pk = ruby.str_new(std::str::from_utf8(public_key).unwrap_or(""));
+    let _ = pk;
+    // Use Vec<u8> arguments — magnus converts them to Ruby Array<Integer>.
+    let result: magnus::Value = callback
+        .funcall("call", (public_key.to_vec(), message.to_vec(), signature.to_vec()))
+        .map_err(|e| format!("caller verifier raised: {e}"))?;
+    let ok: bool = bool::try_convert(result).map_err(|e| format!("caller verifier returned non-bool: {e}"))?;
+    if ok {
+        Ok(())
+    } else {
+        Err("caller verifier returned false".into())
+    }
+}
+
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::Composite::VerificationResult", size)]
+pub struct VerificationResultWrap {
+    inner: VerificationResult,
+}
+
+impl VerificationResultWrap {
+    fn all_verified(&self) -> bool {
+        self.inner.all_verified
+    }
+
+    fn per_component(&self) -> Result<Value, Error> {
+        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let result = ruby.hash_new();
+        for c in &self.inner.per_component {
+            let entry = ruby.hash_new();
+            entry.aset("algorithm", c.algorithm.clone())?;
+            entry.aset("verified", c.verified)?;
+            if let Some(err) = &c.error {
+                entry.aset("error", err.clone())?;
+            }
+            result.aset(c.index, entry)?;
+        }
+        Ok(result.into_value_with(&ruby))
+    }
+}
+
+/// Build a real Ed25519 component signature.
+///
+/// `Confium::Composite.sign_ed25519(private_key_bytes, message)` returns
+/// a Hash with `algorithm`, `public_key`, `signature` keys.
+fn sign_ed25519(ruby: &Ruby, private_key: Value, message: Value) -> Result<RHash, Error> {
+    let pk_bytes = bytes_from_value(private_key)?;
+    let msg = bytes_from_value(message)?;
+    if pk_bytes.len() != 32 {
+        return Err(Error::new(
+            exception::arg_error(),
+            format!("Ed25519 private key must be 32 bytes, got {}", pk_bytes.len()),
+        ));
+    }
+    let mut pk_arr = [0u8; 32];
+    pk_arr.copy_from_slice(&pk_bytes);
+    let signing = SigningKey::from_bytes(&pk_arr);
+    let component = match confium_composite::build_ed25519_component(&signing, &msg) {
+        Ok(c) => c,
+        Err(e) => {
+            crate::audit::fire_event(
+                "composite_sign_ed25519",
+                "failure",
+                Some("Ed25519"),
+                Some(&msg),
+                Some(&e.to_string()),
+            );
+            return Err(Error::new(exception::runtime_error(), e.to_string()));
+        }
+    };
+
+    crate::audit::fire_event(
+        "composite_sign_ed25519",
+        "success",
+        Some("Ed25519"),
+        Some(&msg),
+        None,
+    );
+
+    let result = ruby.hash_new();
+    result.aset("algorithm", component.algorithm)?;
+    result.aset("public_key", bytes_to_rstring(ruby, &component.public_key))?;
+    result.aset("signature", bytes_to_rstring(ruby, &component.signature))?;
+    Ok(result)
+}
+
+/// Generate a fresh Ed25519 keypair.
+///
+/// `Confium::Composite.generate_ed25519_keypair` returns `[private_key, public_key]`
+/// as binary strings (32 bytes each).
+/// Build a real ECDSA-P256 component signature. Useful when the caller
+/// holds a P-256 signing key and wants to participate in a composite
+/// signature alongside e.g. Ed25519 or ML-DSA-65.
+fn sign_p256(ruby: &Ruby, private_key: Value, message: Value) -> Result<RHash, Error> {
+    let pk_bytes = bytes_from_value(private_key)?;
+    let msg = bytes_from_value(message)?;
+    if pk_bytes.len() != 32 {
+        return Err(Error::new(
+            exception::arg_error(),
+            format!("P-256 private key must be 32 bytes, got {}", pk_bytes.len()),
+        ));
+    }
+    let mut arr = [0u8; 32];
+    arr.copy_from_slice(&pk_bytes);
+    use p256::ecdsa::{Signature, SigningKey, signature::Signer};
+    let signing = SigningKey::from_bytes(&arr.into())
+        .map_err(|e| Error::new(exception::arg_error(), format!("invalid P-256 private key: {e}")))?;
+    let sig: Signature = match signing.try_sign(msg.as_slice()) {
+        Ok(s) => s,
+        Err(e) => {
+            crate::audit::fire_event(
+                "composite_sign_p256",
+                "failure",
+                Some("ECDSA-P256"),
+                Some(&msg),
+                Some(&format!("sign error: {e}")),
+            );
+            return Err(Error::new(exception::runtime_error(), format!("sign error: {e}")));
+        }
+    };
+    let verifying = signing.verifying_key();
+    let verifying_bytes: Vec<u8> = verifying.to_sec1_bytes().to_vec();
+    let sig_bytes: Vec<u8> = sig.to_der().to_bytes().to_vec();
+
+    crate::audit::fire_event(
+        "composite_sign_p256",
+        "success",
+        Some("ECDSA-P256"),
+        Some(&msg),
+        None,
+    );
+
+    let result = ruby.hash_new();
+    result.aset("algorithm", "ECDSA-P256")?;
+    result.aset("public_key", bytes_to_rstring(ruby, &verifying_bytes))?;
+    result.aset("signature", bytes_to_rstring(ruby, &sig_bytes))?;
+    Ok(result)
+}
+
+fn generate_ed25519_keypair(ruby: &Ruby) -> Result<RHash, Error> {
+    let mut rng = OsRng;
+    let signing = SigningKey::generate(&mut rng);
+    let verifying = signing.verifying_key();
+    let result = ruby.hash_new();
+    result.aset("private_key", bytes_to_rstring(ruby, &signing.to_bytes()))?;
+    result.aset("public_key", bytes_to_rstring(ruby, &verifying.to_bytes()))?;
+    Ok(result)
+}
+
+fn parse_components(value: Value) -> Result<Vec<ComponentSignature>, Error> {
+    let arr = magnus::RArray::try_convert(value)?;
+    let mut out = Vec::with_capacity(arr.len());
+    for v in arr.each() {
+        let h: RHash = RHash::try_convert(v?)?;
+        let algorithm: String = h.fetch::<_, String>("algorithm")?;
+        let public_key: Value = h.fetch::<_, Value>("public_key")?;
+        let signature: Value = h.fetch::<_, Value>("signature")?;
+        out.push(ComponentSignature {
+            algorithm,
+            public_key: bytes_from_value(public_key)?,
+            signature: bytes_from_value(signature)?,
+        });
+    }
+    Ok(out)
+}
+
+pub fn init(ruby: &Ruby, parent: magnus::RModule) -> Result<(), Error> {
+    let composite = parent.define_module("Composite")?;
+    composite.define_module_function(
+        "sign_ed25519",
+        function!(sign_ed25519, 2),
+    )?;
+    composite.define_module_function(
+        "sign_p256",
+        function!(sign_p256, 2),
+    )?;
+    composite.define_module_function(
+        "generate_ed25519_keypair",
+        function!(generate_ed25519_keypair, 0),
+    )?;
+
+    let sig_class = composite.define_class("Signature", ruby.class_object())?;
+    sig_class.define_singleton_method("new", function!(CompositeSig::new, 1))?;
+    sig_class.define_method("component_count", method!(CompositeSig::component_count, 0))?;
+    sig_class.define_method("algorithms", method!(CompositeSig::algorithms, 0))?;
+    sig_class.define_method("verify", method!(CompositeSig::verify, -1))?;
+
+    let result_class = composite.define_class("VerificationResult", ruby.class_object())?;
+    result_class.define_method("all_verified?", method!(VerificationResultWrap::all_verified, 0))?;
+    result_class.define_method("per_component", method!(VerificationResultWrap::per_component, 0))?;
+
+    Ok(())
+}

data/ext/confium_native/src/deployment.rs

@@ -0,0 +1,176 @@
+//! Confium::Identity + Confium::Config — Ruby surface for the deployment
+//! crate's identity + manifest types.
+//!
+//! Phase 1C-2 scope:
+//!   - `Confium::Identity::Actor` — wraps `confium_deployment::identity::ActorIdentity`.
+//!   - `Confium::Identity::ACTOR_TYPES` — array of valid actor-type strings.
+//!   - `Confium::Config::Manifest` — parse + validate deployment manifest TOML.
+
+use confium_deployment::{
+    identity::{ActorIdentity, ActorType},
+    manifest::{parse_manifest, Manifest as RustManifest},
+    validate::validate_manifest,
+};
+use crate::util::enforce_size;
+use magnus::{exception, function, method, typed_data::Obj, DataTypeFunctions, Error, Module, Object, Ruby, TypedData};
+
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::Identity::Actor", size)]
+pub struct Actor {
+    pub inner: std::cell::RefCell<ActorIdentity>,
+}
+
+impl Actor {
+    fn from_json(json: String) -> Result<Obj<Self>, Error> {
+        enforce_size(json.len())?;
+        let actor: ActorIdentity = serde_json::from_str(&json)
+            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        Ok(ruby.obj_wrap(Self {
+            inner: std::cell::RefCell::new(actor),
+        }))
+    }
+
+    fn to_json(&self) -> Result<String, Error> {
+        serde_json::to_string(&*self.inner.borrow())
+            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))
+    }
+
+    fn actor_id(&self) -> String {
+        self.inner.borrow().actor_id.clone()
+    }
+
+    fn actor_type(&self) -> String {
+        actor_type_str(self.inner.borrow().actor_type).to_string()
+    }
+
+    fn quorum_id(&self) -> Option<String> {
+        self.inner.borrow().quorum_id.clone()
+    }
+
+    fn registered_at_iso8601(&self) -> String {
+        self.inner.borrow().registered_at.to_rfc3339()
+    }
+
+    fn expires_at_iso8601(&self) -> Option<String> {
+        self.inner.borrow().expires_at.map(|t| t.to_rfc3339())
+    }
+
+    fn certificate_count(&self) -> usize {
+        self.inner.borrow().certificate_chain_der.len()
+    }
+}
+
+fn actor_type_str(t: ActorType) -> &'static str {
+    match t {
+        ActorType::Manufacturer => "manufacturer",
+        ActorType::TestingLab => "testing_lab",
+        ActorType::IssuingAuthorityOfficer => "issuing_authority_officer",
+        ActorType::BimlDirector => "biml_director",
+        ActorType::QuorumCoordinator => "quorum_coordinator",
+        ActorType::Verifier => "verifier",
+    }
+}
+
+fn actor_types() -> Vec<&'static str> {
+    vec![
+        actor_type_str(ActorType::Manufacturer),
+        actor_type_str(ActorType::TestingLab),
+        actor_type_str(ActorType::IssuingAuthorityOfficer),
+        actor_type_str(ActorType::BimlDirector),
+        actor_type_str(ActorType::QuorumCoordinator),
+        actor_type_str(ActorType::Verifier),
+    ]
+}
+
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::Config::Manifest", size)]
+pub struct Manifest {
+    pub inner: std::cell::RefCell<RustManifest>,
+}
+
+impl Manifest {
+    fn from_toml(toml_str: String) -> Result<Obj<Self>, Error> {
+        enforce_size(toml_str.len())?;
+        let manifest = parse_manifest(&toml_str)
+            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        Ok(ruby.obj_wrap(Self {
+            inner: std::cell::RefCell::new(manifest),
+        }))
+    }
+
+    fn deployment_name(&self) -> String {
+        self.inner.borrow().deployment.name.clone()
+    }
+
+    fn operator(&self) -> String {
+        self.inner.borrow().deployment.operator.clone()
+    }
+
+    fn manifest_version(&self) -> u32 {
+        self.inner.borrow().deployment.manifest_version
+    }
+
+    fn tier_count(&self) -> usize {
+        self.inner.borrow().tiers.len()
+    }
+
+    fn tier_name_at(&self, index: usize) -> Result<String, Error> {
+        self.inner
+            .borrow()
+            .tiers
+            .get(index)
+            .map(|t| t.name.clone())
+            .ok_or_else(|| {
+                Error::new(
+                    exception::index_error(),
+                    format!("tier index {index} out of range"),
+                )
+            })
+    }
+
+    fn quorum_count(&self) -> usize {
+        self.inner.borrow().quorums.len()
+    }
+
+    fn validate(&self) -> Result<Vec<String>, Error> {
+        let m = self.inner.borrow();
+        let report = validate_manifest(&m);
+        Ok(report.errors)
+    }
+
+    fn is_valid(&self) -> Result<bool, Error> {
+        let m = self.inner.borrow();
+        let report = validate_manifest(&m);
+        Ok(report.errors.is_empty())
+    }
+}
+
+pub fn init(ruby: &Ruby, parent: magnus::RModule) -> Result<(), Error> {
+    let identity = parent.define_module("Identity")?;
+    identity.define_module_function("actor_types", function!(actor_types, 0))?;
+    let actor_class = identity.define_class("Actor", ruby.class_object())?;
+    actor_class.define_singleton_method("from_json", function!(Actor::from_json, 1))?;
+    actor_class.define_method("to_json", method!(Actor::to_json, 0))?;
+    actor_class.define_method("actor_id", method!(Actor::actor_id, 0))?;
+    actor_class.define_method("actor_type", method!(Actor::actor_type, 0))?;
+    actor_class.define_method("quorum_id", method!(Actor::quorum_id, 0))?;
+    actor_class.define_method("registered_at", method!(Actor::registered_at_iso8601, 0))?;
+    actor_class.define_method("expires_at", method!(Actor::expires_at_iso8601, 0))?;
+    actor_class.define_method("certificate_count", method!(Actor::certificate_count, 0))?;
+
+    let config = parent.define_module("Config")?;
+    let manifest_class = config.define_class("Manifest", ruby.class_object())?;
+    manifest_class.define_singleton_method("from_toml", function!(Manifest::from_toml, 1))?;
+    manifest_class.define_method("deployment_name", method!(Manifest::deployment_name, 0))?;
+    manifest_class.define_method("operator", method!(Manifest::operator, 0))?;
+    manifest_class.define_method("manifest_version", method!(Manifest::manifest_version, 0))?;
+    manifest_class.define_method("tier_count", method!(Manifest::tier_count, 0))?;
+    manifest_class.define_method("tier_name_at", method!(Manifest::tier_name_at, 1))?;
+    manifest_class.define_method("quorum_count", method!(Manifest::quorum_count, 0))?;
+    manifest_class.define_method("validate", method!(Manifest::validate, 0))?;
+    manifest_class.define_method("valid?", method!(Manifest::is_valid, 0))?;
+
+    Ok(())
+}