Module endpoint 

Endpoint-level protection abstraction.

Bridge between the wire type EndpointSecurityInfo and the policy level ProtectionLevel. Holds the match logic for a writer/reader pair: per endpoint the wire carries a 2x u32 bitmask block, from which the policy engine decides whether a match occurs and with which resulting protection level.

DoD matching matrix (plan §stage 3)

Writer	Reader	Result
Encrypt	no caps	match rejected
Sign	Encrypt	match, end level = Encrypt
None	None	match, end level = None
Encrypt	Encrypt	match, end level = Encrypt

“Strongest value wins”: max(writer, reader). If one of the endpoints supplies no EndpointSecurityInfo (legacy peer), the pair is only accepted if both effectively run None.

Structs

EndpointProtection

Policy view of an endpoint: which protection level this writer/reader requires/offers.

Enums

EndpointMatch

Result of a writer/reader match check.

MatchRejectReason

Why the matching is a reject.

Functions

match_endpoints

Match writer ↔ reader. From the two EndpointProtection values it is determined: