Module wan_verify 

Verify a same-account agent’s WAN signature on a cloud-delivered jekt (SPEC_WAN_JEKT_VERIFICATION_2026_09_24.md §2.3–2.6, step D2).

Runs in cloud_subscriber::sync_agent_reactive, before transcript-request resolution, for each claimed injection. The checks run in the §2.3 order and every “couldn’t check” outcome is None — only an active failure (envelope moved, certificate chain broken, record for something else, signature bad, replay) is Some(false), the forced-sensitive red flag. A directory that is down or slow gives None and the message is delivered anyway: never /reactive/release, because nothing re-wakes a released row and it could expire undelivered (§1.2).

The HTTP entry point never reaches this: an HTTP caller’s self-declared delivery_tier: "wan" can’t set wan_verified (skip_deserializing).

Structs

CarriedRow 🔒

The carried fields of one pending row, as the cloud returned them.

Directory 🔒

Where the directory is and how to reach it. Tests point base_url at a stub and bring their own budget.

FetchBudget 🔒

A fixed-window request budget (FETCHES_PER_MINUTE).

InstanceStatusResp 🔒

WanVerdict 🔒

The §2.3 outcome, ready to copy onto the InjectionRequest.

Enums

Fetched 🔒

Constants

FETCHES_PER_MINUTE 🔒

Global fetch budget: at most this many directory requests per minute, so a flood of signed messages can’t turn this install into a directory hammer. An exhausted budget reads as “unavailable” → None.

FETCH_TIMEOUT 🔒

Directory fetch timeout (§2.3): verification runs per message on the sync path, so a slow directory must not hold delivery up for long.

REVOCATION_REFRESH_SECS 🔒

How stale an instance’s revocation status may be before it is re-checked on the next message from it (§2.3: hourly).

Statics

GLOBAL_BUDGET 🔒

The one budget every production verification shares.

Functions

fetch_record 🔒

fetch_revoked 🔒

get_json 🔒

One GET with the §2.3 retry rule: an unavailable directory gets one immediate retry; a 404 is an answer, not a failure.

instance_status 🔒

The instance’s status (§2.6). This install is approved implicitly. Any other instance is approved only through the host-gated window, which ships disabled, so it stays new. Revocation is checked on first sight and at most hourly after.

record_delivered 🔒

After a verified message was delivered locally: remember it, so the same (instance, agent, msgid) is a replay from now on (§2.5). Not before delivery — the relay’s own release-and-redeliver must not look like one.

verify 🔒

The §2.3 table, in order.