Module capability_claim 

Cross-node signed capability advertisements (WEFT-147). Cross-node capability-claim verification (WEFT-147).

Peer nodes previously advertised free-form capability strings on crate::cluster::PeerNode with no authenticity check. This module provides:

1. An allow-list of known capability tokens.
2. A canonical claim payload + Ed25519 signed advertisement.
3. Verify helpers that reject unknown tokens and tampered signatures.

Wire format: JSON body + 64-byte Ed25519 signature over the canonical CBOR-ish UTF-8 payload bytes (stable field order via CapabilityClaim::signing_bytes).

Structs

CapabilityClaim

Unsigned capability claim body.

SignedCapabilityAdvertisement

Signed capability advertisement for mesh exchange.

Enums

CapabilityClaimError

Errors from capability-claim validation / crypto.

Constants

CAPABILITY_ALLOWLIST

Allow-listed capability tokens a node may advertise (WEFT-147).

Functions

apply_verified_capabilities

Apply a verified advertisement onto a crate::cluster::PeerNode.

sign_claim

Sign a claim with an Ed25519 signing key (mesh / exochain feature).

validate_capabilities

Validate every capability string in a free-form peer list.

validate_capability

Return Ok(()) if cap is on the allow-list.

verify_signed_advertisement

Verify signature + allow-list. Does not check expires_at clock skew (caller may enforce).