confium 0.3.2-aarch64-linux

data/Cargo.toml

@@ -0,0 +1,9 @@
+[workspace]
+resolver = "2"
+members = ["ext/confium_native"]
+
+[profile.release]
+opt-level = 3
+lto = "off"
+codegen-units = 1
+debug = true

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2022 Ribose Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.adoc

@@ -0,0 +1,139 @@
+= Confium Ruby bindings
+:toc: macro
+:toclevels: 2
+
+Ruby bindings for the Confium open-source framework for multi-stakeholder threshold cryptography.
+
+Confium supports three deployment modes:
+
+* **Mode 1 — Peer-to-peer threshold cryptography**: nodes do TC directly (MPC, distributed custody, BFT)
+* **Mode 2 — TC PKI replacement**: drop-in for existing PKI consumers (PKCS#11 server, OpenSSL 3.0 provider, JCE)
+* **Mode 3 — TC Certificate PKI**: institutional deployments with custom certificate formats (OIML CNML, BIPM, pharma, accreditation)
+
+This gem wraps the high-value Confium subsystems via a Rust native extension (built at `gem install` time with `rb_sys` + `magnus`). No separate C ABI library to install; everything is statically linked into the extension.
+
+== Installation
+
+Add to your Gemfile:
+
+[source,ruby]
+----
+gem "confium", "~> 0.1"
+----
+
+Or install directly:
+
+[source,sh]
+----
+$ gem install confium
+----
+
+=== Prerequisites
+
+* Ruby ≥ 3.1
+* Rust stable toolchain (`rustup default stable`)
+* C toolchain (clang/gcc/Xcode CLT)
+
+The gem compiles a Rust cdylib at install time and links it into Ruby as a native extension. There is no separate `libconfium` to install.
+
+== Quick start
+
+[source,ruby]
+----
+require "confium"
+
+# Transparency log
+tree = Confium::Transparency::MerkleTree.new
+seq = tree.append(artifact_hash_bytes_32)
+root = tree.root  # binary String, 32 bytes
+proof = tree.inclusion_proof(seq)
+proof.verify(root)  # => true
+
+# Composite signature (PQ migration)
+kp = Confium::Composite.generate_ed25519_keypair
+component = Confium::Composite.sign_ed25519(kp["private_key"], "message")
+sig = Confium::Composite::Signature.new([component])
+result = sig.verify("message")
+result.all_verified?  # => true
+
+# Attribute-based threshold policy
+pred = Confium::Attributes.parse(%q{and(min_count("role:director", 3), min_distinct("region", 3))})
+alice = Confium::Attributes::Signer.new
+alice.add("role:director", "yes")
+alice.add("region", "europe")
+# ... bob, carol similarly
+pred.satisfied_by?([alice, bob, carol])  # => true
+
+# X.509 certificate
+cert = Confium::PKI::Certificate.from_pem(File.read("cert.pem"))
+puts cert.fingerprint_sha256
+puts cert.valid_at?(Time.now.utc.iso8601)  # => true
+
+# Real threshold cryptography: P-256 Shamir
+kp = Confium::TC::FrostP256.generate_keypair
+shares = Confium::TC::FrostP256.split_secret(kp["private_key"], 3, 5)
+recovered = Confium::TC::FrostP256.recover_secret(shares.first(3).map { |s| { "x" => s.x, "y" => s.y_bytes } })
+recovered == kp["private_key"]  # => true
+----
+
+== API surface (v0.1.0)
+
+=== `Confium::Transparency`
+- `MerkleTree.new` / `#append(artifact_hash)` / `#root` / `#length` / `#empty?` / `#inclusion_proof(seq)`
+- `InclusionProof#sequence` / `#steps` / `#verify(root)`
+
+=== `Confium::Composite` — PQ migration
+- `.generate_ed25519_keypair` → `{ private_key:, public_key: }`
+- `.sign_ed25519(private_key, message)` → component Hash
+- `Signature.new(components)` / `#verify(message)` / `#component_count` / `#algorithms`
+- `VerificationResult#all_verified?` / `#per_component`
+
+=== `Confium::Attributes` — threshold policy DSL
+- `.parse(dsl_expr)` → `Predicate`
+- `Predicate#satisfied_by?(signers)`
+- `Signer.new` / `#add(key, value)` / `#has?(key)` / `#values(key)`
+- DSL: `min_count("attr", n)`, `min_distinct("attr", n)`, `any("attr")`, `all("attr")`, `none("attr")`, `and(...)`, `or(...)`, `not(p)`
+
+=== `Confium::PKI`
+- `Certificate.from_der(bytes)` / `.from_pem(str)` / `#to_der` / `#to_pem` / `#fingerprint_sha256` / `#serial_hex` / `#not_before` / `#not_after` / `#valid_at?(iso8601)` / `#public_key_bytes`
+- `CSR.from_der` / `.from_pem` / `#to_der` / `#to_pem`
+- `CMS::SignedData.from_json` / `#to_json` / `#signer_count` / `#content_type` / `#content` / `#certificate_count` / `#certificate_at(i)`
+- `CMS::Content#bytes` / `#length`
+- `XMLDSig.canonicalize(xml)` / `.canonicalize_exclusive(xml)` (Canonical XML RFC 3076 + Exclusive C14N)
+
+=== `Confium::Identity` — actor roles
+- `.actor_types` → `["manufacturer", "testing_lab", "issuing_authority_officer", "biml_director", "quorum_coordinator", "verifier"]`
+- `Actor.from_json(json)` / `#to_json` / `#actor_id` / `#actor_type` / `#quorum_id` / `#registered_at` / `#expires_at` / `#certificate_count`
+
+=== `Confium::Config` — deployment manifest
+- `Manifest.from_toml(toml_str)` / `#deployment_name` / `#operator` / `#manifest_version` / `#tier_count` / `#tier_name_at(i)` / `#quorum_count` / `#validate` / `#valid?`
+
+=== `Confium::TC::FrostP256` — real P-256 Shamir + ECDSA
+- `.generate_keypair` → `{ private_key: (32 bytes), public_key: (65 bytes SEC1) }`
+- `.split_secret(secret, t, n)` → array of `Share` with `#x`, `#y_bytes`
+- `.recover_secret([{x:, y:}, ...])` → secret bytes
+- `.sign(private_key, message)` → `{ der:, fixed: }`
+
+=== `Confium::TC::ElGamalP256` — threshold ElGamal-P256 KEM
+- `.encapsulate(public_key_bytes)` → `{ ciphertext: { c1:, c2: }, shared_secret: }`
+- `.partial_decrypt(party_index, share_bytes, ciphertext)` → `{ party_index:, bytes: }`
+- `.aggregate_partials(partials, threshold, ciphertext)` → shared_secret bytes
+
+== Development
+
+After checking out the repo:
+
+[source,sh]
+----
+$ bundle install
+$ bundle exec rake compile       # build the Rust extension
+$ bundle exec rspec              # 75+ specs
+----
+
+== Architecture
+
+The native extension lives at `ext/confium_native/` as a Cargo workspace. It depends on the `confium-*` crates from crates.io (not on the local Rust workspace). The Ruby-side API is defined entirely in the extension via magnus — `lib/confium.rb` just requires the compiled `.bundle`.
+
+== License
+
+BSD-2-Clause, same as the rest of the Confium workspace.

data/Rakefile

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require 'rake/clean'
+require 'bundler/gem_tasks'
+
+require 'rb_sys/extensiontask'
+gemspec = Gem::Specification.load('confium.gemspec')
+RbSys::ExtensionTask.new('confium_native', gemspec) do |ext|
+  ext.lib_dir = 'lib/confium_native'
+end
+
+# Tooling tasks are dev-only and are not needed to build the
+# extension. Guard the requires so minimal environments (e.g. release
+# tooling containers) can still load this Rakefile.
+begin
+  require 'rspec/core/rake_task'
+  RSpec::Core::RakeTask.new(:spec)
+rescue LoadError
+  nil
+end
+
+begin
+  require 'rubocop/rake_task'
+  RuboCop::RakeTask.new
+rescue LoadError
+  nil
+end
+
+task compile: :clean
+task default: %i[compile spec rubocop]

data/confium.gemspec

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require_relative 'lib/confium/version'
+
+Gem::Specification.new do |spec|
+  spec.name = 'confium'
+  spec.version = Confium::VERSION
+  spec.platform = Gem::Platform::RUBY
+
+  spec.authors = ['Ribose Open']
+  spec.email = ['open.source@ribose.com']
+
+  spec.summary = 'Ruby bindings for the Confium multi-stakeholder threshold cryptography framework.'
+  spec.description = 'Confium provides threshold cryptography for Ruby: FROST / CMP20 / GG18 ' \
+                     'signing sessions, X.509 certificate issuance (CNML-ready), composite ' \
+                     'PQ-migration signatures, and transparency-log anchoring. Powered by a ' \
+                     'Rust native extension (magnus + rb_sys) — no separate C ABI to install.'
+  spec.homepage = 'https://www.confium.org'
+  spec.license = 'BSD-2-Clause'
+
+  spec.metadata = {
+    'bug_tracker_uri' => 'https://github.com/confium/confium-ruby/issues',
+    'changelog_uri' => 'https://github.com/confium/confium-ruby/blob/main/CHANGELOG.md',
+    'homepage_uri' => spec.homepage,
+    'source_code_uri' => 'https://github.com/confium/confium-ruby',
+    'rubygems_mfa_required' => 'true'
+  }
+
+  # Rust extension — compiled at gem install via rb_sys.
+  spec.extensions = ['ext/confium_native/extconf.rb']
+
+  spec.files = Dir.glob('{lib,ext}/**/*') + %w[
+    CHANGELOG.md
+    LICENSE.txt
+    Rakefile
+    README.adoc
+    confium.gemspec
+    Cargo.toml
+    Cargo.lock
+  ]
+  spec.files.reject! { |f| File.directory?(f) }
+  spec.files.reject! { |f| f =~ /\.(dll|so|dylib|lib|bundle)\Z/ }
+  spec.require_paths = ['lib']
+
+  spec.required_ruby_version = '>= 3.1.0'
+
+  # Required for the Rust extension.
+  spec.add_dependency 'rb_sys', '~> 0.9.39'
+
+  spec.add_development_dependency 'rake', '~> 13.0'
+  spec.add_development_dependency 'rake-compiler', '~> 1.3.0'
+  spec.add_development_dependency 'rake-compiler-dock', '~> 1.3'
+  spec.add_development_dependency 'rspec', '~> 3.0'
+  spec.add_development_dependency 'rubocop', '~> 1.0'
+  spec.add_development_dependency 'steep', '~> 1.5'
+end

data/lib/confium/audit.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+
+# Audit log sink hierarchy.
+#
+# Sinks receive an audit record Hash for every signed event. The Rust
+# extension fires events on every signing / verification / encryption
+# op; the Ruby side routes them to the configured sink via
+# {Confium::Audit.sink=}.
+#
+# Three reference sinks are shipped: {FileSink} (append-only file),
+# {MemorySink} (in-memory, for testing), {StderrSink} (one-line JSON
+# per record). Custom sinks can subclass {Sink} for HTTP / syslog /
+# Kafka backends.
+
+require 'json'
+require 'time'
+
+module Confium
+  module Audit
+    # Base class for audit sinks. Subclasses override {#write} and
+    # optionally {#close}. The contract:
+    #
+    # - #write(record) — synchronously emit the record. Raise on
+    #   failure; the exception propagates back through the caller.
+    # - #close — flush and release resources. Safe to call multiple
+    #   times.
+    class Sink
+      # Persist an audit record Hash. The Hash has these keys
+      # (all Strings):
+      #
+      # - `"timestamp"`      — ISO8601 UTC, e.g. `"2026-07-30T22:00:00Z"`
+      # - `"operation"`      — short slug like `"composite_sign"`
+      # - `"actor"`          — optional String
+      # - `"algorithm"`      — optional String
+      # - `"payload_hash"`   — hex SHA-256 of the signed bytes
+      # - `"result"`         — `"success"` or `"failure"`
+      # - `"error"`          — optional String
+      def write(_record)
+        raise NotImplementedError, "#{self.class} must implement #write"
+      end
+
+      # Treat the Sink as a callable — delegates to {#write}. The Rust
+      # extension's audit module fires events by calling `.call(record)`
+      # on whatever is in `Confium::Audit.sink`, so this lets both
+      # Proc-based and Object-based sinks work through the same
+      # dispatch point.
+      def call(record)
+        write(record)
+      end
+
+      def close
+        # default no-op
+      end
+    end
+
+    # In-memory sink. Records are collected in `#records` and inspected
+    # in specs. Implements `#clear` for resetting between tests.
+    #
+    # Includes Enumerable so callers can iterate, filter, and reduce
+    # over recorded events directly:
+    #
+    #     sink.select { |r| r["operation"] == "composite_sign" }
+    #     sink.count { |r| r["result"] == "failure" }
+    #     sink.find { |r| r["actor"] == "director-1" }
+    class MemorySink < Sink
+      include Enumerable
+
+      attr_reader :records
+
+      def initialize
+        @records = []
+      end
+
+      def write(record)
+        @records << record
+        self
+      end
+
+      def clear
+        @records.clear
+      end
+
+      # Enumerable contract: yield each record in insertion order.
+      def each(&)
+        @records.each(&)
+      end
+    end
+
+    # Stderr sink — emits each record as a one-line JSON object.
+    # Suitable for development and CI; for production prefer
+    # {FileSink} or a structured-logging sink.
+    class StderrSink < Sink
+      def initialize(io: $stderr)
+        @io = io
+      end
+
+      def write(record)
+        @io.puts(JSON.generate(record))
+      end
+    end
+
+    # Append-only file sink. The path is opened in append mode; each
+    # record is written as a single line followed by a newline.
+    # Concurrent writes from multiple processes are NOT supported —
+    # serialize audit traffic through this sink to a single writer for
+    # multi-process deployments.
+    class FileSink < Sink
+      attr_reader :path
+
+      def initialize(path)
+        @path = path
+        @io = File.open(path, 'a')
+        @io.sync = true
+      end
+
+      def write(record)
+        @io.puts(JSON.generate(record))
+      end
+
+      def close
+        @io.close unless @io.closed?
+      end
+    end
+  end
+end

data/lib/confium/cfm.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require 'ffi'
+
+module Confium
+  class CFM
+    attr_reader :ptr
+
+    def initialize
+      pptr = ::FFI::MemoryPointer.new(:pointer)
+      Confium.call_ffi(:cfm_create, pptr)
+      @ptr = ::FFI::AutoPointer.new(pptr.read_pointer, self.class.method(:destroy))
+    end
+
+    def self.destroy(ptr)
+      Confium::Lib.cfm_destroy(ptr)
+    end
+
+    def load_plugin(name, path)
+      Confium.call_ffi(:cfm_plugin_load, @ptr, name, path, nil, nil)
+    end
+  end
+end

data/lib/confium/crypto.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+# {Confium::Crypto} is the registry namespace for Confium's cryptographic
+# interfaces.
+#
+# Mirroring the Rust plugin-interface registry (TODO #02), each Ruby
+# interface module (Digest, and future Cipher, AEAD, KDF, RNG, Signature,
+# KEM, ...) registers itself here on load rather than being enumerated in
+# a central case statement. This keeps the registry open for extension
+# (OCP) and makes the set of available interfaces a single source of
+# truth.
+#
+# Example:
+#
+#   module Confium
+#     module Digest
+#       Confium::Crypto.register(:hash, self)
+#     end
+#   end
+#
+#   Confium::Crypto.lookup(:hash)  # => Confium::Digest
+module Confium
+  module Crypto
+    @interfaces = {}
+
+    class << self
+      # Register an interface +klass+ under the symbolic +name+. Adding a
+      # new interface is a one-line registration; no central switch needs
+      # editing.
+      def register(name, klass)
+        @interfaces[name] = klass
+        klass
+      end
+
+      # Resolve a registered interface by +name+. Raises ArgumentError if
+      # nothing has been registered under that name.
+      def lookup(name)
+        @interfaces.fetch(name) do
+          raise ArgumentError, "unknown interface #{name.inspect}"
+        end
+      end
+
+      # Enumerate the names of every registered interface. Primarily for
+      # introspection and tooling.
+      def interfaces
+        @interfaces.keys.dup
+      end
+    end
+  end
+end

data/lib/confium/digest.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require 'ffi'
+require 'digest'
+
+module Confium
+  class Digest < ::Digest::Class
+    attr_reader :name, :ptr
+
+    def initialize(cfm, name)
+      @name = name
+      pptr = ::FFI::MemoryPointer.new(:pointer)
+      Confium.call_ffi(:cfm_hash_create, cfm.ptr, pptr, name, nil, nil, nil)
+      ptr = pptr.read_pointer
+      raise if ptr.null?
+
+      @ptr = ::FFI::AutoPointer.new(ptr, self.class.method(:destroy))
+    end
+
+    def initialize_copy(source)
+      @name = source.name
+      pptr = ::FFI::MemoryPointer.new(:pointer)
+      Confium.call_ffi(:cfm_hash_clone, source.ptr, pptr)
+      ptr = pptr.read_pointer
+      @ptr = ::FFI::AutoPointer.new(ptr, self.class.method(:destroy))
+    end
+
+    def self.destroy(ptr)
+      Confium::Lib.cfm_hash_destroy(ptr)
+    end
+
+    def block_length
+      plength = ::FFI::MemoryPointer.new(:uint32)
+      Confium.call_ffi(:cfm_hash_block_size, @ptr, plength)
+      plength.read(:uint32)
+    end
+
+    def digest_length
+      plength = ::FFI::MemoryPointer.new(:uint32)
+      Confium.call_ffi(:cfm_hash_output_size, @ptr, plength)
+      plength.read(:uint32)
+    end
+
+    def update(data)
+      Confium.call_ffi(:cfm_hash_update, @ptr, data, data.bytesize)
+      self
+    end
+
+    def reset
+      Confium.call_ffi(:cfm_hash_reset, @ptr)
+      self
+    end
+
+    def finish
+      buf = ::FFI::MemoryPointer.new(:uint8, digest_length)
+      Confium.call_ffi(:cfm_hash_finalize, @ptr, buf, buf.size)
+      buf.read_bytes(buf.size)
+    end
+
+    alias << update
+  end
+end

data/lib/confium/errors/coerce.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+# Shared coercion helper for the typed-error hierarchy.
+#
+# Every `Confium::*Error` subclass accepts the same three calling
+# conventions (keyword form, positional-Hash form from the native
+# extension, hash-only form). Before this module existed, each class
+# duplicated the same 8-line coercion preamble. Centralizing it here
+# keeps the per-class initializer focused on its own field extraction.
+#
+# Usage in a subclass:
+#
+#     def initialize(message = nil, details_hash = nil, **kwargs)
+#       message, kwargs = Coerce.args(message, details_hash, kwargs)
+#       @have_count = kwargs.delete(:have_count)
+#       @need_count = kwargs.delete(:need_count)
+#       super(message, details: { have_count: @have_count, need_count: @need_count, **kwargs })
+#     end
+module Confium
+  module Errors
+    module Coerce
+      module_function
+
+      # Normalize the (message, details_hash, kwargs) triple that every
+      # typed-error initializer receives. Returns `[message, kwargs]`
+      # where:
+      #
+      # - `message` is `nil` or a String (never a Hash)
+      # - `kwargs` is a Hash with symbol keys, containing every key
+      #   from the original `details_hash` and `**kwargs`, plus
+      #   anything that was tucked inside `message` (when the caller
+      #   passed a Hash as the first arg).
+      #
+      # The subclass initializer then `kwargs.delete(:specific_field)`
+      # to pull its own fields out, and the leftover `**kwargs` flows
+      # to `super` as `details:`.
+      def args(message, details_hash, kwargs)
+        if message.is_a?(Hash)
+          kwargs = message.transform_keys(&:to_sym).merge(kwargs)
+          message = kwargs.delete(:message)
+        end
+        kwargs = details_hash.transform_keys(&:to_sym).merge(kwargs) if details_hash.is_a?(Hash)
+        [message, kwargs]
+      end
+    end
+  end
+end

data/lib/confium/errors/crypto_error.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+# Raised when a primitive-level crypto operation fails (invalid scalar,
+# bad key derivation).
+module Confium
+  class CryptoError < Confium::Error
+    attr_reader :primitive
+
+    def initialize(message = nil, details_hash = nil, **kwargs)
+      message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
+      @primitive = kwargs.delete(:primitive)
+      super(message, details: { primitive: @primitive, **kwargs })
+    end
+  end
+end

data/lib/confium/errors/index_error.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+# Raised when an out-of-range index is supplied.
+module Confium
+  class IndexError < Confium::Error
+    attr_reader :index, :valid_range
+
+    def initialize(message = nil, details_hash = nil, **kwargs)
+      message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
+      @index = kwargs.delete(:index)
+      @valid_range = kwargs.delete(:valid_range)
+      super(message, details: { index: @index, valid_range: @valid_range, **kwargs })
+    end
+  end
+end

data/lib/confium/errors/not_found_error.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+# Raised when a referenced slot/cert/share is not present.
+module Confium
+  class NotFoundError < Confium::Error
+    attr_reader :kind, :identifier
+
+    def initialize(message = nil, details_hash = nil, **kwargs)
+      message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
+      @kind = kwargs.delete(:kind)
+      @identifier = kwargs.delete(:identifier)
+      super(message, details: { kind: @kind, identifier: @identifier, **kwargs })
+    end
+  end
+end

data/lib/confium/errors/parse_error.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+# Raised when input cannot be parsed (bad JSON, malformed PEM, etc.).
+module Confium
+  class ParseError < Confium::Error
+    attr_reader :format, :offset
+
+    def initialize(message = nil, details_hash = nil, **kwargs)
+      message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
+      @format = kwargs.delete(:format)
+      @offset = kwargs.delete(:offset)
+      super(message, details: { format: @format, offset: @offset, **kwargs })
+    end
+  end
+end

data/lib/confium/errors/policy_violation_error.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+# Raised when a FIPS / jurisdictional policy is violated.
+module Confium
+  class PolicyViolationError < Confium::Error
+    attr_reader :policy, :violation
+
+    def initialize(message = nil, details_hash = nil, **kwargs)
+      message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
+      @policy = kwargs.delete(:policy)
+      @violation = kwargs.delete(:violation)
+      super(message, details: { policy: @policy, violation: @violation, **kwargs })
+    end
+  end
+end

data/lib/confium/errors/threshold_error.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+# Raised when a Shamir/threshold operation fails (insufficient shares,
+# duplicate coordinates, etc.).
+module Confium
+  class ThresholdError < Confium::Error
+    attr_reader :have_count, :need_count
+
+    def initialize(message = nil, details_hash = nil, **kwargs)
+      message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
+      @have_count = kwargs.delete(:have_count)
+      @need_count = kwargs.delete(:need_count)
+      super(message, details: { have_count: @have_count, need_count: @need_count, **kwargs })
+    end
+  end
+end

data/lib/confium/errors/unresolved_signer_error.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# Raised when a CMS signer_info cannot be resolved to a certificate.
+module Confium
+  class UnresolvedSignerError < Confium::Error
+    attr_reader :signer_index
+
+    def initialize(message = nil, details_hash = nil, **kwargs)
+      message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
+      @signer_index = kwargs.delete(:signer_index)
+      super(message, details: { signer_index: @signer_index, **kwargs })
+    end
+  end
+end