Add confined host escalation transport

crates/lazaret-core/src/protocol/mod.rs

@@ -1,9 +1,11 @@
 //! Bounded cryptographic protocol records and generation-scoped validation.
 
+mod names;
 mod session;
 mod signing;
 mod window;
 
+pub use names::*;
 pub use session::*;
 pub use signing::*;
 pub use window::*;

crates/lazaret-core/src/protocol/names.rs

@@ -0,0 +1,67 @@
+use std::ffi::{OsStr, OsString};
+
+use crate::identity::{RequestId, SessionId};
+
+fn identifier_hex(bytes: &[u8]) -> String {
+    use std::fmt::Write as _;
+
+    bytes.iter().fold(String::new(), |mut encoded, byte| {
+        write!(encoded, "{byte:02x}").expect("writing to a String cannot fail");
+        encoded
+    })
+}
+
+#[must_use]
+pub fn mailbox_generation_name(generation: u64) -> OsString {
+    OsString::from(format!("generation-{generation:020}"))
+}
+
+#[must_use]
+pub fn mailbox_session_name(session_id: SessionId) -> OsString {
+    OsString::from(format!("session-{}", identifier_hex(session_id.as_bytes())))
+}
+
+#[must_use]
+pub fn request_file_name(request_id: RequestId) -> OsString {
+    OsString::from(format!(
+        "request-{}.ready",
+        identifier_hex(request_id.as_bytes())
+    ))
+}
+
+#[must_use]
+pub fn cancellation_file_name(request_id: RequestId) -> OsString {
+    OsString::from(format!(
+        "cancel-{}.ready",
+        identifier_hex(request_id.as_bytes())
+    ))
+}
+
+#[must_use]
+pub fn acknowledgment_file_name(request_id: RequestId, sequence: u64) -> OsString {
+    OsString::from(format!(
+        "ack-{}-{sequence:020}.ready",
+        identifier_hex(request_id.as_bytes())
+    ))
+}
+
+#[must_use]
+pub fn result_file_name(request_id: RequestId) -> OsString {
+    OsString::from(format!(
+        "result-{}.ready",
+        identifier_hex(request_id.as_bytes())
+    ))
+}
+
+#[must_use]
+pub fn result_chunk_file_name(request_id: RequestId, sequence: u64) -> OsString {
+    OsString::from(format!(
+        "result-chunk-{}-{sequence:020}.ready",
+        identifier_hex(request_id.as_bytes())
+    ))
+}
+
+#[must_use]
+pub fn is_ready_record(name: &OsStr) -> bool {
+    name.as_encoded_bytes().ends_with(b".ready")
+}

crates/lazaret-core/src/protocol/session.rs

@@ -395,6 +395,26 @@ pub struct VerifiedSession {
 }
 
 impl VerifiedSession {
+    #[must_use]
+    pub const fn session_binding(&self) -> &SessionBinding {
+        &self.session_binding
+    }
+
+    #[must_use]
+    pub const fn session_capability(&self) -> &SessionRequestCapability {
+        &self.capability
+    }
+
+    #[must_use]
+    pub const fn sandbox_credential_id(&self) -> ProtocolCredentialId {
+        self.sandbox_credential_id
+    }
+
+    #[must_use]
+    pub const fn coordinator_credential_id(&self) -> ProtocolCredentialId {
+        self.coordinator_credential_id
+    }
+
     /// Constructs an authority only after validating its manifest, credentials, and capability.
     ///
     /// # Errors

crates/lazaret-core/src/protocol/window.rs

@@ -108,6 +108,11 @@ impl ResultSenderWindow {
     pub fn outstanding(&self) -> usize {
         usize::try_from(self.sent_count - self.acknowledged_count).unwrap_or(usize::MAX)
     }
+
+    #[must_use]
+    pub const fn sent_count(&self) -> u64 {
+        self.sent_count
+    }
 }
 
 #[derive(Clone, Debug)]