Module policy 

Per-peer authorization policy: peers.json.

A peer is a public key with a local petname. Being on the list means the peer is admitted: it is a trusted chat partner, and its messages are handled inline. The default for an unlisted peer is deny-everything, so the safe state is the fallback.

{
  "my-laptop":  { "key": "8Emom3…" },
  "my-desktop": { "key": "rq2AzH…" }
}

Admission is all-or-nothing: interlink is a chat between mutually trusted agents, not a sandbox for a semi-trusted one. (A legacy "may" field from older files is accepted and ignored, so those files still load.)

Structs

Peer

One resolved peer: its authenticated identity and local petname.

Policy

The whole allowlist. Parsing validates every key up front, so a malformed peers.json fails loudly at startup rather than silently at message time.