Interface ProviderVerificationResult

All Known Implementing Classes:
ProviderVerificationResult.Matched, ProviderVerificationResult.NotMatched, ProviderVerificationResult.ProviderError
public sealed interface ProviderVerificationResult permits ProviderVerificationResult.Matched, ProviderVerificationResult.NotMatched, ProviderVerificationResult.ProviderError
Provider-level outcome of running a KDF and comparing the derived material against the stored inner hash.

This type is sealed so the verification pipeline can pattern-match exhaustively. Provider implementations must not throw exceptions for the normal mismatch case; they return ProviderVerificationResult.NotMatched instead. They may return ProviderVerificationResult.ProviderError when the KDF cannot be executed at all (e.g. unavailable JCA service); in that case the pipeline collapses the response onto a generic public failure and records the supplied InternalAuditEventType internally.

The message of ProviderVerificationResult.ProviderError is intended for audit sinks; it must not contain secrets, salts, derived key material or encoded envelopes.