Module wire 

The local wire: frames in, control values out.

Three layers, each refusing what the one above it cannot see:

• frame — the [u32 body_length][u8 kind][body] codec. Length bounds are checked against the ANNOUNCED length, before allocation, and the connection’s byte budget is charged for the whole frame.
• strict — the validating JSON decoder ADR 0001 requires: recursive duplicate keys, unknown fields, invalid UTF-8, trailing bytes.
• hello — the handshake. Major matches exactly, minor negotiates down, capabilities intersect, and the whole thing is on a deadline.
• listen — the socket itself: where it may live, who may connect, and what is removed when the daemon stops.

Authentication is listen’s, not the handshake’s. The UDS peer credential is the only identity this kernel has (ADR 0002) and it is checked before a single byte of the connection is read, so an unauthorized peer never reaches the decoder at all. Nothing in a hello can widen what a connection may do — client is a log label and the capability set is a feature list.

Modules

frame

The v1 frame codec: [u32 big-endian body_length][u8 frame_kind][body].

hello

The handshake: the first frame, on a deadline, and what it settles.

listen

The Unix-domain socket: where it may live, who may talk to it, and what is removed when the daemon stops.

serve

One connection, from hello to hangup — and the accept loop that owns them.

strict

Strict JSON decoding: what serde_json will not refuse on its own.

subscribe

Live subscriptions: the half of the protocol that arrives unasked.

Structs

WireError

A refusal on the wire, already carrying the code it will be sent as.