Struct LeafIngress 

pub struct LeafIngress {
    pub lock: Mutex<()>,
    /* private fields */
}

Fields

lock: Mutex<()>

Serialize a leaf’s check, delivery and floor commit. Held across the runtime call; callers use Tokio’s async mutex guard.

Implementations

impl LeafIngress

pub fn open(root: &Path, machine_key: SigningKey) -> Result<Self, LeafError>

root/registry/<id>.json holds enrollment artifacts; root/floors is service-owned and must never be writable by a leaf process.

pub fn with_scope_authority( self, authority: Arc<dyn Fn(&str, &[u8; 32], Option<&ProjectCert>) -> bool + Send + Sync>, ) -> Self

Machine-service live binding check. The callback must prove the registered tenant currently holds the user key named by the chain.

pub fn still_enrolled(&self, cert: &LeafCertificate, now: u64) -> bool

Recheck an idle subscribed connection. Enrollment removal, exact certificate replacement and expiry all terminate its push route.

pub fn prepare( &self, frame: &SignedPublish, now: u64, ) -> Result<Prepare, LeafError>

Validate against the installed certificate and durable replay floor. Duplicate is safe to ACK but must never be delivered again.

pub fn commit(&self, frame: &SignedPublish) -> Result<(), LeafError>

Call only after delivery returned success. Sync file and directory before sending an ACK. A crash between delivery and commit can replay once; downstream operations must be idempotent by (leaf_id, seq).

pub fn ack(&self, frame: &SignedPublish) -> PublishAck

pub async fn serve_discovery( &self, mesh_addr: SocketAddr, leaf_addr: SocketAddr, ) -> Result<(), LeafError>

UDP discovery on the mesh listener’s address and port + 1. Requests carry WLD1 | leaf id (32 ASCII hex) | nonce (16). The response is a machine-signed CBOR advertisement bound to that nonce and enrollment.