Module kernel 

Authentication kernel: the sealed principal, minting, and the dispatch guard.

This module is the trust boundary between transport-layer token extraction and route authorization. AuthenticatedPrincipal is a sealed type: it is nameable (so Exchange::get_extension::<AuthenticatedPrincipal> downcasts across crates) but not constructible outside this crate — all fields are private and there is no public constructor. A principal can therefore only come from kernel_authenticate, which mints it after a real token passes a registered provider’s authenticator.

Structs

AuthenticatedPrincipal

The typed, unforgeable authentication identity stored on an Exchange.

Constants

KERNEL_PRINCIPAL_KEY

Exchange extension key under which install_carrier stores the authenticated principal.

Functions

enforce_dispatch

Guard a dispatch against the route’s security plan.

install_carrier

Install the authenticated principal as the exchange’s typed carrier.

kernel_authenticate

Resolve the route’s provider and authenticate the extracted token.

read_carrier

Read the typed carrier back off the exchange, cloning it out.