Crate arkhe_forge_platform 

ArkheForge Runtime — L2 Services / Platform (arkhe-forge-platform)

L2 services surface — Manifest loader, L2 projection observer, Policy, Rate limit, Audit receipt issuance, Cascade scheduler, Idempotency dedup, GDPR erasure-cascade service, DR coordinator. Depends on L0 arkhe-kernel plus L1 arkhe-forge-core only — no upward edge into shell crates (layer-independence directive).

Feature flags

Flag	Pulls in	Role
(none — default)	—	Tier-0 dev: MockKmsBackend + in-memory crypto-erasure.
tier-1-kms	argon2, chacha20poly1305	Tier-1 KMS free-tier — XChaCha20-Poly1305 AEAD.
tier-2-multi-kms	tier-1-kms + aes-gcm + aes-gcm-siv	Tier-2 production AEAD surface (implies tier-1-kms).
tier-2-aws-kms	aws-sdk-kms, aws-config, tokio	Orthogonal AWS KMS backend opt-in — AwsKmsBackend impl of hf2_kms::KmsBackend.

The L0 kernel WAL chain signing inherits Hybrid Ed25519 + ML-DSA 65 transitively via arkhe-kernel. Forge L2 attestation surfaces emit Ed25519.

Cloud KMS backends are orthogonal to the AEAD tiering — a deployment can run tier-1-kms AEAD with tier-2-aws-kms key storage, or any other mix. GCP / Azure backends land as their own tier-2-<vendor>-kms flags in future releases.

Modules

crypto

Crypto-erasure coordinator — Tier-1+ AEAD envelope encryption.

crypto_erasure

Erasure cascade observer — E-user-3 cascade activation.

dedup

L2 idempotency-key dedup service.

dispatcher

L2 service layer — drives forge actions through the kernel’s authorize → dispatch → WAL append loop.

hf2_kms

Multi-KMS infrastructure — health + threshold HSM + KMS abstraction.

manifest

Shell Manifest TOML loader.

process_protection

Process protection trait — spec LF4.

projection

L2 Projection observer pipeline.

verifier

Audit-receipt attestation verifier — L2 erasure-receipt signature check.

wal_export

WAL streaming export — incremental record append for snapshot / backup.

Constants

PLATFORM_SEMVER

ArkheForge Runtime Platform semver — matches the repo release.