Module mesh_artifact_tunnel 

Artifact streams over machine-mesh deliveries (ADR-106 section 5.4).

The daemon holds the ArtifactExchange but not the mesh connections: the machine mesh service owns those and hands the daemon deliver frames and takes its sends. This module carries the piece protocol across that seam. A TunnelStream is a MeshStream whose bytes travel as mesh.artifact.tunnel messages addressed to a peer node:

• Dial ([TunnelDialer], the production PeerDialer): opens a session id and speaks the fetcher side.
• Serve (inbound): the first req frame of an unknown session starts ArtifactExchange::serve_as with a ServePeer built from the service-stamped origin. Only a verified node peer is served; the redistribution policy still decides what.

Replies are accepted only from the peer that was dialled and only while that peer is a verified node, so an unadmitted sender cannot inject frames into a fetch. Frames larger than CHUNK are split and reassembled (a mesh-local line is capped at 1 MiB).

Structs

ArtifactTunnel

Both ends of the artifact tunnel for one node.

TunnelCounters

Counters, all monotonic.

TunnelStream

One artifact session as a MeshStream.

Constants

CHUNK

Raw bytes per tunnel message.

MAX_DIAL_TOTAL

Most dialled sessions open at once.

MAX_SERVE_PER_PEER

Most serve sessions from one peer.

MAX_SERVE_TOTAL

Most serve sessions in all.

TOPIC_TUNNEL

Topic of tunnel frames.

Traits

PeerSender

Sends one kernel message to a peer node through the machine mesh. The daemon implements it with its service link; tests with an in-memory net.

Functions

licensed_peer

Whether from may be served licensed content or sent licence floods: admission verified it (the service-stamped AdmittedPeer) and its class is node. A verified leaf is not: leaves never get licensed bytes or grant floods. Every serve, checkout and flood decision goes through this.