Module mesh_admit 

Mesh peer admission (P3-K1, ADR-103, plan section 1.5).

After the optional Noise handshake, a peer that wants a verified identity sends AdmitHello as its first frame. The hello signs the session’s Noise handshake hash, so a captured hello cannot be replayed on another session, and binds the node id to the Ed25519 key that the id is derived from (node_id_from_pubkey).

This module is policy-free plumbing: AdmitHello::verify is pure cryptography; the policy (genesis pin, revocation, verdict, mode) lives behind AdmissionGate. AllowAll is today’s behaviour; CryptoGate implements off | observe | enforce.

Trust of scopes

A peer’s dest_scope is a request; the kernel ignores it and the LocalDelivery implementor must treat it as untrusted. A peer’s src_scope is kept only when admission verified the peer (Grant::trust_scope); for every other peer mesh_serve strips it before delivery.

Re-exports

pub use crate::mesh_admit_gate::AdmissionRecord;

pub use crate::mesh_admit_gate::CryptoGate;

pub use crate::mesh_admit_gate::OpenVerdicts;

pub use crate::mesh_admit_gate::Verdict;

pub use crate::mesh_admit_gate::VerdictRequest;

pub use crate::mesh_admit_gate::VerdictSource;

pub use crate::mesh_admit_gate::VERDICT_TTL;

pub use crate::mesh_admit_gate::GateVerdictSource;

pub use crate::mesh_admit_gate::install_nested_peer_ceiling;

Structs

AdmitContext

Facts about the connection handed to the gate.

AdmitHello

Wire form of the first frame (JSON). Binary fields are lowercase hex.

AllowAll

Admit everyone: the pre-K1 behaviour. Verified hellos still bind source_node, but nothing is ever refused or limited.

ChannelBinding

What the channel itself proves: the session hash and the remote static.

DialIdentity

What this node needs to introduce itself on an outbound connection.

Grant

Terms of an admission.

Refusal

A refusal reason (also used for would-be refusals under observe).

VerifiedHello

A hello whose node id, key, session binding and timestamp checked out.

Enums

Admission

Gate decision.

ChannelKind

Transport protection of the connection.

HelloFailure

Why a hello did not verify, or that none was sent.

PeerClass

How the peer presented itself.

PeerLimits

What a connection may do after admission.

Constants

CAP_LEAF

Capability string marking a leaf-class peer.

HELLO_DOMAIN

Domain-separation prefix of the signed bytes.

HELLO_KIND

Discriminator that tells a hello apart from a MeshIpcEnvelope.

MAX_SKEW_SECS

Allowed clock skew between hello ts and local time.

Traits

AdmissionGate

Admission policy for the mesh listener.

Functions

hex_decode

Decode hex (empty string decodes to empty).

hex_encode

Lowercase hex encode.

signed_bytes

The exact bytes a hello signs.