Crate hns_namespace_resolution

Expand description

Shared full-host namespace decision contract for dual-root browsers.

Network adapters independently build one complete, validated origin plan for HNS and ICANN. This crate compares those plans, preserves authenticated absence separately from failures, applies explicit divergence precedence, and produces a query- and policy-bound decision fingerprint for connection and cache isolation. Plans retain distinct origin-alias, ServiceMode target, endpoint-CNAME, address, and TLS trust state and never mix roots.

The IANA root-zone list is intentionally absent. A suffix snapshot may order network work outside this crate, but it can never create a namespace decision.

Structs§

AliasStep: One canonical alias edge inside a single root lookup.
CanonicalHost: Canonical lower-case ASCII DNS hostname without a root dot.
CanonicalTlsa: Canonical TLSA RDATA retained for trust comparison.
DecisionCacheKey: Complete cache-key input for one dual-root decision.
DecisionFingerprint: Stable SHA-256 decision identity used to partition transport state.
DivergenceMask: Bit mask describing connection/trust differences between two valid plans.
Freshness: Absolute observation and expiry bounds for validated evidence.
NamespaceDecision: Query- and policy-bound authoritative namespace decision.
OriginPlanInput: Unvalidated complete origin plan normalized by ValidatedOriginPlan::new.
OriginQuery: Canonical origin input common to both root lookups.
ProtocolCapabilities: Protocols supported by the requesting browser transport.
RootFailure: Typed failure from one independent root lookup.
SelectionPolicy: Per-origin selection inputs supplied by a browser profile.
ServiceBinding: Normalized connection-affecting HTTPS/SVCB policy.
ServiceBindingInput: Unvalidated service-binding input normalized by ServiceBinding::new.
ServiceParameter: Canonical SVCB parameter retained for equivalence comparison.
ValidatedAbsence: Typed authenticated absence from one root.
ValidatedOriginPlan: One complete, internally coherent origin plan from exactly one root.

Enums§

AbsenceKind: Authenticated reason that one root has no usable origin plan.
AliasKind: Alias mechanism represented by one retained origin-plan step.
ApplicationProtocol: Application protocol selected for an origin connection.
ClassificationError: Fail-closed classification failure.
DefaultPrecedence: Behavior when both valid plans diverge and no pin/binding exists.
EvidenceProvenance: Evidence lineage retained for diagnostics and freshness, but ignored by semantic convergence.
HnsNetwork: Canonical Handshake network identity used for proof and cache isolation.
IcannChainState: DNSSEC state associated with authenticated ICANN DoH provenance.
Namespace: DNS namespace whose independently validated plan may be selected.
NamespaceOutcome: Authoritative five-way dual-root outcome.
OriginScheme: Browser origin scheme whose effective endpoint is classified.
OutcomeKind: Stable outcome discriminator for status and cache schemas.
RootFailureKind: Fail-closed reason that one root did not produce presence or authenticated absence.
RootLookup: Independent result from exactly one root.
RootResolutionDisposition: Bounded, copyable disposition of one root lookup.
RootResolutionState: Bounded diagnostic state retained when dual-root classification fails.
SelectionReason: Reason the selected namespace won precedence.
ServiceTransport: Effective service transport for TLSA and origin connection state.
TlsTrustPolicy: Browser trust action included in convergence comparison.
ValidationError: Input/plan validation failure.

Constants§

COMPARISON_SCHEMA_VERSION: Comparison schema included in cache and decision identities.
MAX_ALIAS_STEPS: Maximum aliases retained in each origin or endpoint path in one root plan.
MAX_ALPN_IDS: Maximum number of ALPN identifiers retained in one service binding.
MAX_ALPN_ID_BYTES: Maximum bytes in one ALPN identifier.
MAX_ENDPOINTS: Maximum number of usable endpoints retained in one root plan.
MAX_HOST_BYTES: Maximum canonical DNS presentation-name length without a root dot.
MAX_PARAMETER_BYTES: Maximum bytes retained in one SVCB parameter value or ECH configuration.
MAX_SERVICE_PARAMETERS: Maximum number of SVCB parameters retained in one service binding.
MAX_TLSA_RECORDS: Maximum number of canonical TLSA records retained in one root plan.

Functions§

decide_namespace: Applies the five-way classification and explicit divergence precedence.
decision_fingerprint: Computes the normalized query-, policy-, and outcome-bound decision identity.