khive-gate — pluggable authorization gate for verb dispatch.

The runtime consults a Gate impl before dispatching each verb. The default AllowAllGate is permissive (suitable for personal/local deployments). For production policy enforcement, plug a Rego-backed or capability-witness-backed impl into RuntimeConfig.gate.

Quick start

use std::sync::Arc;
use khive_gate::{AllowAllGate, Gate, GateRef, GateRequest, ActorRef};
use khive_types::Namespace;
use serde_json::json;

let gate: GateRef = Arc::new(AllowAllGate);
let req = GateRequest::new(
    ActorRef::anonymous(),
    Namespace::default_ns(),
    "search",
    json!({"query": "LoRA"}),
);
assert!(gate.check(&req).unwrap().is_allow());