Module integrity 

Addon integrity pinning + local re-verify (P2 — the lockfile half).

installed.json is the lockfile: at install time we pin a content hash of the exact gateway wiring an addon installed (transport, command, args, env, url, headers, capabilities). verify_all re-computes that hash from the live [[gateway.servers]] config and reports any drift — so a swapped command, an added arg, or a widened capability after install is caught, complementing the super::revocation deny-list with a positive integrity check.

(Pulling a newer signed version — the “updater” — is registry-server work that reuses the ctxpkg remote rails; this module is the local lock + verify it builds on.)

Structs

IntegrityFinding

One addon’s re-verify result.

Enums

IntegrityStatus

The per-addon verdict of a re-verify.

Functions

verify

Re-verify every installed addon against the live gateway config. Pure over its two inputs so it is unit-testable without disk.

verify_all

Re-verify against the on-disk store + global config.

wiring_hash

Stable content hash of a gateway server’s wiring. Deterministic: the struct serialises in field order with sorted BTreeMaps, so the same wiring always hashes the same (provider prompt-cache friendly, #498).