Module peer 

Peer attestation for accepted connections.

Adapted from brightnexus-platform’s attestation.rs and the PeerInfo shape in brightnexus-core’s handler.rs. We derive the connecting peer’s (uid, gid, pid) from SO_PEERCRED (via Tokio’s UCred) and enrich it from /proc: the executable path, the process lineage, and any wrapping SSH session.

This broker only runs on NixOS, which has no dpkg package database, so the attestation is purely credential- and /proc-derived (no Debian package verification). It is informational for v1 (logged per connection); a future policy layer can gate SIGN on it.

Structs

PeerInfo

Identity and attestation facts about a connected peer.

Functions

detect_ssh_session

If any ancestor in lineage is an sshd, return the (user, remote_host, sshd_pid) session it established.

lineage_pids

Walk the parent-PID chain starting at pid (capped at [LINEAGE_CAP]).

read_proc_environ

Read a process’s environment from /proc/<pid>/environ.