Module agent 

The per-agent channel server and its decision logic.

Inbound flow, for each message drained from the bus: verify signature → sender on the allowlist? → addressed to me? → fresh? → not a replay? → dispatch.

An admitted peer is handled inline: the message is pushed straight into the session as a <channel> event. A non-peer may only knock to pair; anything else from a non-peer is dropped at the gate.

Structs

Dedupe

A bounded set of recently-seen msg_ids. Bounded because we only need to reject replays inside the freshness window; anything older is already rejected by check_freshness, so unbounded memory would be pointless.

PairTable

A bounded key→value table (drop-oldest), for pending pairing state: inbound knocks (sender key → claimed name) and outbound requests (target key → the grant we’ll assign them on accept). Bounded so a knock flood can’t grow it.

Enums

Dispatch

What to do with a verified, authorized message.

Reject

Why a message was dropped. All of these are logged, none reach the model.

Constants

MAX_SKEW_MS

How far a message’s timestamp may be from local time. Bounds the replay window that the dedupe set must remember.

Functions

decide

The full inbound gate. me is this agent’s own id; the bus routes by key, but we re-check so a misrouted or spoofed to can’t slip through.

Type Aliases

Verdict