kaas-protocol

Multi-listener TCP/TLS bring-up, the per-listener pre-auth dispatch gate, framing, and per-connection state.

The layer between the codec and the handlers: it owns sockets, connection lifecycle, and the decision of whether a request may be dispatched at all.

Module map: server.rs (multi-listener TCP/TLS accept loops — TCP_NODELAY on accept, TLS certificate hot-reload, mTLS principal-mapper wiring), frame.rs (Connection<S>: async stream + frame reader, request headers parsed via the codec registry, responses written with the right header version), dispatch.rs (the API-key router), connstate.rs (per-connection mutable state: listener name, SASL progress, principal).

The pre-auth gate is the crate's most consequential logic: on an authenticated listener, dispatch.rs refuses every API except SaslHandshake (17), ApiVersions (18), and SaslAuthenticate (36) until the connection's SASL exchange completes. Listener identity travels on ConnState as a free-form name matching the chart's listeners[] entries; the auth engine is selected per listener (architecture chapter).

Error contract: a request that fails dispatch-level checks gets a proper error-code response with the client's correlation ID — connections are not dropped for policy failures.

Where the boundary sits: kaas-protocol depends on kaas-codec and kaas-auth; it knows nothing about storage or Kubernetes. Handlers are registered into the dispatcher by bins/kaas — the crate defines the Handler seam, not the handlers.

Start reading at dispatch.rs, then server.rs for the listener bring-up.