Module wire 

The wire envelope: one frame of Active RPC traffic.

Every transport carries the same envelope, so a capability table, a method call and an Infinity payload look identical whether they travel in-process, through a shared-memory segment, over QUIC or through the Connect bridge.

Decoding is fail-closed: the magic, version, every length, every count and the total size are checked before a single value is materialised, and an envelope carrying a capability descriptor that violates the attenuation rules is refused with rpc/capability-table.

0  4  magic "ARP1"
4  1  version (1)
5  1  kind (1 request, 2 response, 3 error, 4 hello)
6  2  flags (bit 0 redact, bit 1 read-only)
8  8  request id
16 4  method length + bytes
..    argument count + arguments
..    payload length + bytes
..    capability count + capability descriptors

Structs

CapDescriptor

A capability descriptor travelling with an envelope.

Envelope

One Active RPC envelope.

WireLimits

Envelope size and count ceilings for untrusted input.

Enums

Kind

Envelope kind.

Constants

FLAG_KNOWN

All understood flags.

FLAG_READ_ONLY

Flag: the capability is read-only.

FLAG_REDACT

Flag: the caller asks for redacted output.

MAGIC

Envelope magic.

MAX_VALUE_DEPTH

Deepest value nesting an envelope may carry.

VERSION

Envelope version.

Functions

decode_capability_table

Decode a capability table on its own (side-channel use).

encode_capability_table

Encode a capability table on its own.