HubArbiter

async def authorize_send(
    self,
    envelope: "Envelope",
    sender: "Passport",
    sender_rule: "Rule",
    recipients: list["Passport"],
) -> Decision:
    """Gate ``post_envelope`` before the WAL append.

    Checks rule-based outbound access (``access.outbound_to``)
    plus delegation depth (``limits.delegation_depth``). Inbox
    capacity is handled separately by :meth:`authorize_inbox`
    because it depends on per-recipient hub-internal counters.
    """

async def authorize_inbox(
    self,
    envelope: "Envelope",
    recipient: "Passport",
    recipient_rule: "Rule",
    current_pending: int,
) -> Decision:
    """Gate ``post_envelope`` per-recipient against inbox capacity.

    Hub iterates the resolved audience, calling this once per
    recipient with their current pending count. Returning
    ``Deny`` (with ``error=InboxFull`` by default) short-circuits
    the send.
    """

async def authorize_dispatch(
    self,
    envelope: "Envelope",
    sender: "Passport",
    recipient: "Passport",
    recipient_rule: "Rule",
) -> Decision:
    """Gate per-recipient dispatch (inbound access).

    Called for every notify frame the hub is about to send.
    Returning ``Deny`` causes the hub to silently skip this
    recipient (the rest of the audience still gets delivery).
    """

async def authorize_channel_open(
    self,
    manifest: "ChannelManifest",
    creator: "Passport",
    creator_rule: "Rule",
    invitees: list["Passport"],
    invitee_rules: list["Rule"],
    active_creator_channels: int,
) -> Decision:
    """Gate ``create_channel`` before any persistence.

    Default impl checks each invitee's ``access.inbound_from``
    against the creator's name, plus the creator's
    ``limits.max_concurrent_channels`` against the running count.
    """

async def authorize_register(
    self,
    passport: "Passport",
    resume: "Resume",
    rule: "Rule",
) -> Decision:
    """Gate ``Hub.register``. Default impl always allows."""

async def resolve_unknown_audience(
    self,
    envelope: "Envelope",
    unknown_ids: list[str],
) -> list[str] | None:
    """Federation hook for audience members the hub doesn't know.

    Default impl returns ``None`` (drop unknown ids, current
    single-hub behavior). A federated arbiter returns a
    (possibly empty) list of agent_ids the envelope should be
    re-delivered to instead — typically the local proxy id of a
    remote peer.
    """