Module substrate_service 

Kernel-side substrate service.

Provides a minimal, daemon-hosted implementation of the four substrate RPCs (substrate.read, substrate.publish, substrate.subscribe, substrate.notify). Each path carries:

• a most-recent serde_json::Value (the state),
• a monotonic tick that advances on every write,
• a declared crate::topic::SubscriberSink set for fan-out,
• a declared Sensitivity (Public / Workspace / Private / Capture) consulted by the policy gate.

The service is intentionally in-memory. It replaces the ad-hoc markdown + file-backed adapter hacks described in weftos-0.7 by giving external clients a real pub/sub+read/write surface to the kernel’s substrate.

Egress gating

All reads/subscribes pass through SubstrateService::egress_check which enforces:

1. ADR-057 per-path ACLs — deny-by-default for sensor/** and actor private subtrees; public for cluster/health/meta/chain.
2. Sensitivity tier — Capture still requires an authenticated caller (bring-up residual until grants land).

ACL rejections surface as EgressDenied::acl_denied with a wire message starting with acl_denied: so clients can distinguish them from path-not-found. Authenticated denials are recorded for ExoChain emission (substrate.read.denied).

Structs

AclDenialEvent

Buffered substrate.read.denied event awaiting ExoChain append.

EgressDenied

Reason an egress check denied access.

SubstrateListEntry

One child entry returned by SubstrateService::list.

SubstrateListSnapshot

Snapshot returned by SubstrateService::list.

SubstrateReadSnapshot

Snapshot of a substrate read.

SubstrateService

Substrate RPC service.

Enums

GateDenied

Reason the node-identity write gate rejected a publish.

Sensitivity

Privacy sensitivity of a substrate path.