Module runtime_frame 

Encrypted, authenticated local-runtime frames; admission/replay are host-owned. Owners provision a fresh scoped 32-byte key and a fresh random 24-byte nonce for EVERY frame. Never reuse a nonce with the same key, including on retries.

Enums

RuntimeFrameDirection

Authenticated associated data separates request and response domains.

RuntimeFrameError

Constants

MAX_RUNTIME_FRAME_PAYLOAD_BYTES

Maximum plaintext bytes, excluding header, nonce and authentication tag.

RUNTIME_FRAME_HEADER_BYTES

Magic/version and big-endian plaintext length, read before any allocation.

RUNTIME_FRAME_NONCE_BYTES

Extended nonce; generated with a cryptographic random source by the sender.

RUNTIME_FRAME_TAG_BYTES

Full Poly1305 tag, appended to the ciphertext. Truncation is not accepted.

Functions

decode_runtime_frame

Authenticate and decrypt before JSON decoding or dispatch. A wrong peer or active relay sees ciphertext, not the projection. This does not admit a capability or prevent replay; those require trusted policy and session state.

decode_runtime_frame_in

decode_runtime_frame under a locally admitted profile.

encode_runtime_frame

Encode version/length, random nonce, ciphertext and its complete tag. Nonce MUST be fresh cryptographic randomness for every call under this key.

encode_runtime_frame_in

encode_runtime_frame under a locally admitted profile. Magic, length field, associated data, cipher, nonce and tag are the same.

runtime_payload_length

Check the fixed header BEFORE allocating/reading the declared ciphertext.

runtime_payload_length_in

runtime_payload_length for a frame of direction under a locally admitted profile. The profile is the receiver’s own; the header only states a length, which is refused here when it exceeds that profile.