Compose the guard: ingress flood control, then the visibility gate, then the
focus-aware firewall, then kehto's bridge.
What is enforced where (D-001): kehto binds NAP traffic to a MessagePort
the bridge owns, so the only window-level message the pipeline can hold or
drop is napplet.hello. Port traffic reaches the pipeline through
ShellAdapter.onNappletMessage, which kehto calls synchronously before it
dispatches each envelope and whose answer kehto ignores. observe returns
a disposition instead, and createKernl refuses every defer or reject
for that one dispatch with refuseCurrentDispatch (D-012), so the applet
gets a firewall error and can retry. Control envelopes are never refused.
Quarantine revokes the window inside the callback; kehto then finds no
session for it, and the envelope that crossed the limit is dropped along
with everything after it. The runtime firewall configured by
applyRuntimeFirewallRules adds the profile's per-class rates.
Compose the guard: ingress flood control, then the visibility gate, then the focus-aware firewall, then kehto's bridge.
What is enforced where (D-001): kehto binds NAP traffic to a
MessagePortthe bridge owns, so the only window-level message the pipeline can hold or drop isnapplet.hello. Port traffic reaches the pipeline throughShellAdapter.onNappletMessage, which kehto calls synchronously before it dispatches each envelope and whose answer kehto ignores.observereturns a disposition instead, andcreateKernlrefuses everydeferorrejectfor that one dispatch withrefuseCurrentDispatch(D-012), so the applet gets a firewall error and can retry. Control envelopes are never refused. Quarantine revokes the window inside the callback; kehto then finds no session for it, and the envelope that crossed the limit is dropped along with everything after it. The runtime firewall configured byapplyRuntimeFirewallRulesadds the profile's per-class rates.