Module manager 

The discovery manager: provider lifecycle, the one verification path, and the one registry. Providers hand raw bytes here; this thread parses, checks bounds and staleness, verifies the signature, evaluates trust, and only then touches the registry — in that order, for every transport alike. A provider cannot skip a step because no provider ever parses.

The runtime lives on the capability Context from process start, inactive, and a shared server activates it when the repository’s mesh declaration says so. Activation is idempotent, bounded, and never blocks startup: sockets open on their own threads, and a provider that cannot start is a Failed status, not a failed server.

Structs

MeshRuntime

The runtime: the registry (always there, so a surface can answer before activation) and the active machinery once a declaration switched it on.

MeshStatus

The whole mesh, as every surface reports it.

Refusals

Refused datagrams, by reason. The diagnosis of a hostile or misconfigured network: a mesh that hears garbage says so, with numbers, instead of being quietly empty.

Functions

closed_to

Why the mesh stays closed on a machine the declaration does not name, or None when it may open. Under deny_unknown and allowlist a machine joins only when its own public key is in trust.allow: an unlisted machine — a contributor’s clone of a public repository, a new machine nobody enrolled — would otherwise announce itself on its network and dial whatever endpoints the repository commits, trusted by nobody. It opens no socket instead, and says which key to list. tofu trusts whoever answers first, so it never closes on this ground.