Module peer_class 

Peer-class matching engine.

This layer takes the PeerClass rules parsed from the governance XML and classifies a remote peer (represented by its PeerCapabilities) into the matching class. The GovernancePolicyEngine consults the result and emits the corresponding protection level.

Matching rule

• Iteration over domain_rule.peer_classes in XML order — first match wins.
• A peer class matches if all set match_criteria fields are satisfied (AND combination):
  • auth_plugin_class — exact string comparison. "" matches None in the peer (legacy peer without a plugin).
  • cert_cn_pattern — wildcard comparison via cn_pattern_match. A peer without a cert CN does not match.
  • suite — the peer must list the suite in its supported_suites (CSV string comparison).
  • require_ocsp — PeerCapabilities::has_valid_cert must be true.
• Empty match_criteria (all fields None/false) matches every peer — this is the default/fallback class, which typically is the last entry in the XML.

Spec reference

• docs/architecture/08_heterogeneous_security.md §5.
• Plan DoD §stage 8: “governance example with 4 peer classes (legacy/fast/secure/HA) is parsed correctly” — resolve_peer_class is the runtime verification of exactly this example.

Functions

interface_accepts_class

Allow-list check: may a peer of a given class communicate on the given interface?

peer_matches_class

Checks whether a PeerClass matches the peer capabilities.

peer_matches_class_with_delegation

Extended variant of peer_matches_class that additionally resolves delegation_profile references.

resolve_peer_class

Finds the first matching peer class for a peer. Returns None if no class matches — the caller then falls back to the domain default protection.

resolve_protection

Extracts the protection level of a matching peer class. None if no class matched.