Module msg 

The workload.ctl message set (ADR-099 section 7).

Every request is a CtlRequest signed by the requesting node’s Ed25519 key (SignedCtl). It names the requester (the node id derived from the signing key), the target workload-host, a random nonce and an expiry. Mutating methods also carry the id of the chained governance decision that authorised them. Responses are signed by the target and bound to the request nonce, so a response cannot be replayed onto another request.

Verification order on the target: size, signature, structure, key binding, addressee, time window, authorised controller key, nonce freshness. The nonce is recorded only after everything else passed, so a forged request cannot burn a legitimate nonce.

Modules

method

Methods of the message set. Anything else under workload. is denied.

Structs

CtlRequest

One control request.

CtlResponse

One control response.

NonceGuard

Replay guard: nonces seen, kept until their request expires.

Refusal

A refusal: code plus human-readable reason.

SignedCtl

Signed envelope for a request or response. payload is the exact JSON that was signed, so verification never re-serialises.

Enums

CtlOutcome

What the target did.

RefusalCode

Why a target refused a request. Stable names (chained).

Constants

ANY_TARGET

Target id a describe may use before the caller knows the node id.

CTL_VERSION

Wire version.

MAX_CTL_BYTES

Largest signed payload.

MAX_NONCES

Most nonces remembered at once (fail closed when full).

MAX_SKEW_MS

Tolerated clock skew for issued_at_ms.

MAX_TTL_MS

Longest request lifetime a target accepts.

REQUEST_DOMAIN

Domain tag signed before a request payload.

RESPONSE_DOMAIN

Domain tag signed before a response payload.

WORKLOAD_HOST_SERVICE

Service name the control plane addresses on every node.

Traits

ControllerPolicy

Who may control this node: a set of controller public keys.

Functions

fresh_nonce

A fresh random nonce (32 hex).

verify_request

Verify a request addressed to me at now_ms. See the module docs for the order of checks.

verify_response

Verify a response to request from the node whose key is expected (None accepts any key, then binds responder to it: describe to an unknown node). Returns the response and the responder’s key.