Struct Manifest 

pub struct Manifest {
    pub trust: Trust,
    pub state: State,
    pub filters: Vec<FilterEntry>,
    pub chain: Chain,
    pub upstreams: Vec<Upstream>,
    pub routes: Vec<Route>,
    pub tls: Vec<TlsCert>,
    pub resumption: Option<Resumption>,
    pub observability: Observability,
    pub listen: Listen,
}

A parsed manifest. Deserialised from TOML; no I/O happens here (key files and artifacts are resolved by Control). Serialize exists only to derive the semantic content hash (content_hash) — the canonical, representation-independent identity of the config.

Determinism invariant (f000004 #6): no map fields (HashMap). content_hash relies on serde_json emitting fields and Vec elements in a fixed order; a HashMap would serialise in nondeterministic order and silently break reload idempotency. If a manifest ever needs a map, use BTreeMap (ordered) and keep this invariant.

Fields

trust: Trust

state: State

[state]: the host state backend (ADR 000041). Rides the content hash like [trust], and like [trust] it is fixed at construction — a reload rejects a change.

filters: Vec<FilterEntry>

[[filter]] entries.

chain: Chain

The default [chain] — driven by the chain-only Control::on_request convenience and used by a route that names no filters of its own. The fast-path server uses [[route]].

upstreams: Vec<Upstream>

[[upstream]] entries: named backends the fast-path server forwards to (ADR 000013).

routes: Vec<Route>

[[route]] entries: host + path-prefix → an (inline) chain and an upstream (ADR 000013). Empty until the fast-path server is configured; matching is the server’s job, declared here.

tls: Vec<TlsCert>

[[tls]] entries: server certificates for TLS termination (ADR 000014). Empty = plain HTTP/1.1 (the fast path serves TLS only when at least one cert is declared).

resumption: Option<Resumption>

[resumption]: opt-in shared session-ticket keys across replicas (ADR 000062). None (the default) keeps the per-node, process-lifetime ticket key (ADR 000052). Rides the content hash like [[tls]] and is rebuilt on reload — the keys derive deterministically from (file, cert set), so a rebuild with unchanged inputs keeps outstanding tickets valid.

observability: Observability

[observability]: operational metrics / access-log / admin-endpoint config (ADR 000009), captured at construction. skip_serializing keeps it OUT of the semantic content_hash, so toggling observability never counts as a config-version change (it is not part of the filter/route identity, and the admin listener binds once at startup — like [trust]).

listen: Listen

[listen]: the data-plane bind address + h3 advertisement (moka-1 field report §3.2/§3.4). Mostly captured at construction like [observability] (the listener binds once at startup, so a reload does not re-bind — restart to move the listener), and those fields stay out of the semantic content_hash via field-level skip_serializing in Listen. The exception is listen.client_auth, which build_active consumes on every reload and therefore rides the hash (see Listen’s serialization note) — the section as a whole is only skipped when it hashes to nothing anyway (no client_auth), preserving existing config versions.

Implementations

impl Manifest

pub fn content_hash(&self) -> Result<String, ControlError>

The semantic content hash of this manifest — sha256:<hex> over a canonical serialisation, not over the raw TOML. Two manifests that mean the same thing (differing only in comments, whitespace, key order, or an explicit default written vs. omitted) hash identically; any meaningful change flips the hash.

This is the manifest’s config version: the unit the reload gate compares for idempotency (via [content_hash_at]), the value an operator audits, and the value a future opt-in consensus layer (ADR 000008 openraft) would agree on. Canonical form is serde_json over the derived Serialize — deterministic because the struct field order is fixed and the manifest holds no maps (only ordered Vecs).

Does not read referenced files. The load/reload path uses [content_hash_at] / [content_hash_with_ca] so an in-place client-auth CA renewal flips the version.

pub fn content_hash_at( &self, base_dir: Option<&Path>, ) -> Result<String, ControlError>

[content_hash] with referenced files resolved against base_dir (when Some): reads [listen.client_auth].ca_path and mixes its digest in. Same path + different bytes must flip the config version; otherwise SIGHUP reports Unchanged and the new trust roots never load (fail-closed: an unreadable CA is an error, not a silently CA-less hash).

pub fn read_client_auth_ca( &self, base_dir: &Path, ) -> Result<Option<Vec<u8>>, ControlError>

Read [listen.client_auth].ca_path, or None when no client auth is configured. The ONE read a build shares between the config version and the client verifier ([content_hash_with_ca] + tls::build_server_configs), so the recorded version always describes the trust roots the verifier was actually built from.

pub fn content_hash_with_ca( &self, client_auth_ca: Option<&[u8]>, ) -> Result<String, ControlError>

The semantic hash, with the client-auth CA bundle’s digest mixed in when supplied (callers obtain the bytes from [read_client_auth_ca]).

impl Manifest

pub fn from_toml(s: &str) -> Result<Self, ControlError>

Parse a manifest from a TOML string.

Trait Implementations

impl Clone for Manifest

fn clone(&self) -> Manifest

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Manifest

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Manifest

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for Manifest

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl Serialize for Manifest

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.