Module wire_proxy 

wire_proxy — the transparent Brain wire-protocol proxy (deployment Option X, Shape B: opaque frame-splice).

A customer’s SDK speaks the binary wire protocol to the edge with its own Brain key. The proxy terminates that TCP connection, opens one upstream connection to Brain per customer connection, and splices frames between them unchanged — forwarding the customer’s own HELLO / AUTH so Brain authenticates the connection as that same credential and returns the real WELCOME / AUTH_OK. The proxy never synthesizes a handshake and never resolves a key to an identity, so it stays entirely out of the isolation TCB: isolation lives 100% in Brain (see tenancy_industry_scale.md §11).

What the edge adds on the path is metering and rate-limiting, both driven off the 32-byte frame header alone (opcode + stream_id). The single exception is the handshake AUTH frame, whose CBOR payload is parsed once to sniff the credential that keys the rate-limiter and the metering label — nothing else is ever decoded. Frames (and their stream_ids — client op streams must stay odd) are forwarded byte-for-byte, so the future agent → space / context → session wire rename is invisible here.

Failure modes surface as wire ERROR frames, not dropped sockets: a rate-limited op is answered with a RateLimited error on its own stream, and an unreachable Brain is answered with a ShardUnavailable error on the handshake stream — in both cases the customer’s SDK sees a clean structured error instead of a reset.

Structs

RateLimitConfig

Token-bucket parameters. Deploy-time knobs, uniform with the rest of the edge config (see crate::EdgeConfig).

RateLimiters

A registry of per-credential token buckets. Lookups take a short, non-async lock and never hold it across an .await, so a std::sync::Mutex is correct here.

WireProxyConfig

Deploy-time configuration for the wire proxy listener.

Functions

serve

Bind the wire-proxy listener and serve customer connections until the process exits. One task per accepted connection; a bad accept is logged and skipped rather than tearing the listener down.