Module gate 

Gate backend abstraction for permission decisions.

GateBackend provides a unified interface for making access control decisions. The default implementation wraps CapabilityChecker (binary Permit/Deny). When the tilezero feature is enabled, TileZeroGate adds three-way decisions (Permit/Defer/Deny) with cryptographic receipts logged to the chain.

TileZero receipt format (WEFT-152)

When TileZeroGate decides, it serializes the cognitum_gate_tilezero::PermitToken to JSON bytes and attaches them as the opaque token (Permit) or receipt (Deny) field on GateDecision. Defer carries only a human-readable reason.

PermitToken fields

Field	Type	Description
decision	enum	Permit / Defer / Deny
action_id	string (UUID)	Unique action identifier
timestamp	u64 ns	Issue time (Unix epoch nanoseconds)
ttl_ns	u64	Validity window (default 60s)
witness_hash	[u8; 32] hex	BLAKE3 hash of the three-filter witness summary
sequence	u64	Monotonic gate sequence
signature	[u8; 64] hex	Ed25519 signature over signable content

Chain event kinds

Each decision appends one of EVENT_KIND_GATE_PERMIT, EVENT_KIND_GATE_DEFER, or EVENT_KIND_GATE_DENY with payload { agent_id, action, sequence, witness_hash }.

Structs

CapabilityGate

Gate backend wrapping the existing CapabilityChecker.

GovernanceGate

Gate backend wrapping the GovernanceEngine.

GovernanceSnapshot

A governance engine’s rules and settings at one instant.

TileZeroGate

Gate backend wrapping cognitum_gate_tilezero::TileZero.

Enums

GateDecision

Result of a gate decision.

Traits

GateBackend

Trait for gate backends that make access-control decisions.

Functions

parent_limits_of

The process and spawn caps a kernel runs under, as the limits a parent policy exports (ADR-103 A6). Boot-time values, like the caps themselves.