Crate chio_tower 

Tower middleware for Chio capability validation and receipt signing.

Provides a tower::Layer that wraps any HTTP service with Chio evaluation: extracting caller identity, evaluating requests against the Chio kernel, and attaching signed receipts to responses.

Works with replayable Tower request body types, including Axum’s axum::body::Body and bytes-backed HTTP bodies used in generic Tower/HTTP2 tests. Real tonic::body::Body replay remains a follow-on concern and is not claimed as fully covered by the current middleware contract.

Example with Tower service

use chio_tower::ChioLayer;
use chio_core_types::crypto::Keypair;
use tower::Layer;

let keypair = Keypair::generate();
let layer = ChioLayer::new(keypair, "policy-hash-abc".to_string());

// Wrap any tower Service with Chio evaluation.
let inner = tower::service_fn(|_req: http::Request<http_body_util::Full<bytes::Bytes>>| async {
    Ok::<_, Box<dyn std::error::Error + Send + Sync>>(http::Response::new(()))
});
let _service = layer.layer(inner);

Structs

ChioEvaluator

Chio request evaluator. Holds the shared HTTP authority and tower-specific hooks.

ChioLayer

Tower Layer that wraps inner services with Chio evaluation.

ChioService

Tower Service that evaluates HTTP requests against the Chio kernel.

EvaluationResult

Result of evaluating an HTTP request.

KernelRequest

Request accepted by KernelService.

KernelService

Tower service that dispatches tool-call requests through a shared kernel.

KernelTraceLayer

Trace layer for kernel service calls.

KernelTraceService

Trace service emitted by KernelTraceLayer.

TenantConcurrencyLimitLayer

Per-tenant concurrency limiter for kernel requests.

TenantConcurrencyLimitService

Service emitted by TenantConcurrencyLimitLayer.

Enums

ChioTowerError

Error type for Chio tower middleware operations.

KernelServiceError

Errors returned by the kernel service stack.

Constants

DEFAULT_MAX_BODY_BYTES

Default upper bound on buffered request body size (8 MiB).

HOST_CALL_FETCH_BLOB

HOST_CALL_GET_CONFIG

HOST_CALL_GET_TIME_UNIX_SECS

HOST_CALL_LOG

HOST_CALL_METRIC_LABEL_VALUES

Functions

build_layered

Build the layered kernel service stack.

extract_identity

Extract caller identity from HTTP headers.

normalize_host_call_metric_label

Type Aliases

IdentityExtractor

Function that extracts caller identity from HTTP request headers.

KernelResponse

Response produced by KernelService.

TenantId

Tenant identifier carried for tower-side admission layers.