LinkAdmission

Admission policy for mesh links: decides, per link, whether a handshaked connection may join the mesh.

Enforced inside Mesh.addLink (and, symmetrically, on construction-time connections) at the one point where both identity facts coexist on the same object before the link is live: after the MeshHello handshake (the first moment the joiner's self-asserted PeerId is known) and before the link is published (the moment it can contend in duplicate-link dedup or receive frames). A rejected link is closed without ever reaching the dedup tiebreak — a forged link can never displace a live one.

A supplied policy is authoritative for every link, including unattested ones: a connection with no verified principal reaches the policy with principal = null and the policy decides. The default is AcceptAll — byte-identical to a mesh with no admission policy.

kuilt deliberately does not hardcode a principal == peerId binding — the relationship between an auth subject and a mesh peer id is consumer-defined (one user may run several devices). The spoofing check (verified principal ↔ claimed peer id) is one line of consumer policy:

LinkAdmission { principal, remoteId -> principal?.value == remoteId.value }