Module state 

Shared broker state: a hot-swappable policy generation + the backend manager, constructed once at startup and shared (Arc) across connections.

BrokerState is the single object the gRPC service adapters share. It bundles:

• the active Generation: the loaded catalog, resolved policy index, and export-resolved config tables that are the inputs to the Pdp (vault-1l8), plus a monotonic generation id, held behind an arc_swap::ArcSwap so a future reload (basil-y3e.2) can atomically swap in a fresh generation without restarting the broker, and
• the BackendManager (vault-jso) that routes an allowed op to its backend.

Generation pinning. The catalog/policy/config triple is no longer immutable for the broker’s lifetime: a SIGHUP reload may replace it atomically. To keep each operation coherent (never deciding with an old catalog but a new policy), every RPC snapshots the generation once at request entry via BrokerState::load_generation and uses that one Generation (its Generation::pdp, Generation::config, and Generation::id) for the whole op. Holding a single snapshot makes cross-generation coherence true by construction. The manager, limits, audit sink, and event source remain lifetime-immutable and live directly on BrokerState.

Today there is exactly one generation (id 1); this iteration lands only the pinning plumbing: there is no reload trigger yet (basil-y3e.2).

Structs

BrokerLimits

Broker-wide runtime limits + rotation policy, supplied by the binary at startup and shared (immutable) across connections.

BrokerState

The shared broker state: the loaded policy surface plus the backend manager.

CachedJwks

A cached JWKS document, keyed by the serving generation.

Generation

One coherent snapshot of the reloadable policy surface.

ReadinessOutcome

The non-secret outcome of one readiness probe.

Enums

ReadinessState

The coarse readiness category a probe resolved to: the proto-free core of the admin Readiness summary (the service layer maps it onto the wire enum).

Constants

DEFAULT_MAX_ENCRYPT_SIZE

The default max_encrypt_size: 1 MiB (wire-protocol-v2 §2.1).

DEFAULT_MAX_PAYLOAD_SIZE

The default max_payload_size: 1 MiB.

DEFAULT_ROTATION_GRACE_VERSIONS

The default rotation grace window, in key versions (vault-xhq).

DEFAULT_SVID_TTL_SECS

Default SPIFFE SVID lifetime in seconds.

INITIAL_GENERATION_ID

The generation id assigned to the broker’s first (startup) generation.

JWKS_CACHE_TTL

How long a computed JWKS document is reused before re-reading issuer public keys from the backend. A generation change invalidates the cache immediately.

READINESS_CACHE_TTL

How long a computed readiness probe is reused before re-fanning-out to the backend (basil-8nwy).