Module mesh_leaf 

Parent-side ADR-103 leaf admission and replay floor.

The machine mesh service owns this state beside its journal. In a collapsed kernel the same component lives under its isolated runtime root. The enrolled public certificate is the explicit admission grant; removing it revokes future frames. No leaf seed is stored here.

Structs

LeafIngress

Enums

LeafError

Prepare

Constants

DISCOVERY_MAGIC

MAX_LEAF_FRAME

MAX_LEAF_PAYLOAD

Functions

verify_scope_chain

Prove the leaf issuer owns its requested tenant. A user issuer must be that user’s key. A project issuer needs the user’s signed project cert, with both key IDs recomputed by ProjectCert::verify.