Module break_glass 

Break-glass proposal records, replicated through the raft quorum with MetadataRecord::V1BreakGlassProposal and V1DeleteBreakGlassProposal.

A break-glass workflow needs two different people to agree before the broker does a privileged operation. An approved proposal is a standing authorization for a bounded window, and not a field on the request it authorizes, so no Kafka wire message changes. An operator gets the approval out of band, then runs the ordinary tool, and the broker reads the proposal out of the metadata image.

The records stay pure data. The approver set, the distinct-principal rule, and the signature checks live in krabka-broker. The one rule this crate enforces is in MetadataImage::validate: an incoming approval list must extend the stored one, so two concurrent approvals cannot overwrite each other.

Structs

BreakGlassApproval

One approval on a proposal.

BreakGlassProposalRecord

One break-glass proposal, keyed by Self::proposal_id.

Enums

BreakGlassAction

The privileged transitions that a break-glass proposal can authorize.