Craton Shield

vs-runtime

Platform orchestrator for Craton Shield.

Ties together all subsystems (CAN monitor, Ethernet monitor, IDS engine, firewall, policy engine, event logger, key manager, OTA validator, diagnostic gateway (from auto/), integrity monitor, anomaly detector) into a single CratonShield struct with a deterministic tick() / submit_can_frame() / submit_eth_packet() interface.

Key Types

Type	Purpose
`CratonShield<C>`	Main platform struct, generic over `CryptoProvider`
`PlatformConfig`	Watchdog timeout/action, IDS correlation window
`PlatformHealth`	14-subsystem status snapshot

Lifecycle

CratonShield::init(config, crypto)
    -> tick(timestamp_us)          // periodic housekeeping
    -> submit_can_frame(&frame, t) // CAN traffic
    -> submit_eth_packet(&pkt, t)  // Ethernet traffic
    -> health_status()             // subsystem health
    -> shutdown()                  // clean teardown

Usage

use vs_runtime::{CratonShield, PlatformConfig};
use vs_crypto::SoftwareCryptoProvider;

let config = PlatformConfig::default();
let crypto = SoftwareCryptoProvider::default();
let mut vs = CratonShield::init(config, crypto).unwrap();

vs.tick(1_000_000).unwrap();
let health = vs.health_status();

Feature Flags

Flag	Default	Effect
`capacity-large`	off	Event-log ring buffer capacity 512 (default 256).
`capacity-xl`	off	Event-log ring buffer capacity 1024 (overrides `capacity-large`).
`pq`	off	Enable real ML-KEM-768 / ML-DSA-65 post-quantum cryptography (FIPS 203/204) via `vs-crypto/pq`. Without it, `StubPostQuantumProvider` is used and all `pq_*` methods return `NotInitialized`.

License

Apache-2.0. See LICENSE.