Integrate an admission gate

This is the integration reference for the admission gate: build, configure, deploy, routes, log and operations. What an admission gate is, and the choice between groundinglab's hosted gate, running your own and embedding the SDK verifier, is on Admission gate.

Why you'd use the SDK

The SDK measures a PCOC and returns a record. You apply your own policy, in this gate or inside your service. You do not write the measurement yourself.

Source: services/admission-gate in groundinglab/pcoc. GET /v1/health on a running gate names its version and commit. Assumes: the sign-in wire (Sign-in wire) and the split between verifier and policy (Verifier and policy).

1. This deployment. The Gate is groundinglab's admission service: it applies one relying party's policy to verifier measurements. Service admission-service, crate pcoc-admission, built on the Rust SDK; GET /v1/health gives the exact version, commit and specification. It applies Part B to the measurements of linked_measure (src/verifier.rs) and adds no Part A rule. It measures objects of kind v2.2-pcoc-object; any other kind is recorded as unknown kind and refused with reason unknown_kind (Rules A5 and B9).
2. Policy identity. This Gate's policy is gl-admit-v12; yours may differ. Its live settings: leg-rate floor 1/10 (0.1 legs/s testing, one leg every 10 s on average), at least 6 of the 16 waypoints W_1 … W_16 anchored (any 6), no tip-versus-last-beacon submission deadline, a held submission retried every 600 s (held_retry_seconds), a deep check that redoes 18 legs in 3 rounds of 6, no door-session verify cap, and no expiry on the fake-leg ignore. Each is a lever the specification defines with a unit and an allowed range (§15.4); the values are groundinglab's policy, one relying party's chosen settings, not part of the specification or the measurement. Why these values: How we set groundinglab's admission policy. GET /v1/policy shows the live values. A new number needs a new id, and startup checks {log_dir}/policy-bind.json. When the policy refuses an object, the refusal carries one reason_code and a class.
3. Build. cargo build --locked --release and cargo test --locked in services/admission-gate (standalone, own Cargo.lock). Pinned vectors are in tests/vectors with SHA256SUMS.
4. Configure. One TOML (--config or GATE_CONFIG); unknown keys are an error. Keys: bind 127.0.0.1:8787; index_url, default https://index.groundinglab.io, which is opt-in, so point it at your own pcoc-index; index_timeout_secs 5; log_dir gate-log-v2; max_object_bytes 2097152; job_retention_secs 3600; max_jobs 256; max_concurrent 2; bind_threads 6; rate_per_min 12; client_ip_header; allowed_origins (empty in code, so loopback only; the shipped gate.toml sets https://groundinglab.io and https://www.groundinglab.io); extra_origins; policy, the admission policy: the path of a policy file, relative to the config (groundinglab's is gl-admit-v12.toml, a TOML file whose [levers] keys are the exact lever names of SPEC §15.4) or an inline [policy] table, not both. The gate 0.4.x keys policy_id, min_leg_rate, min_waypoints and a named leg_rate_floor are no longer read; the floor is the integer p/q in the policy. groundinglab's argued settings are POLICY.md, a recommendation, not part of the specification. (source: services/admission-gate/deploy/gate.toml) allowed_origins and extra_origins are browser CORS settings for the caller's HTTP Origin. They are separate from the signed origin, which is the site's own origin. The reference Gate currently fixes the signed origin to https://groundinglab.io with no setting for it; see Sign-in wire. The signed origin is one constant (wire.rs ORIGIN); CORS does not change it.
5. Deploy. A system user pcoc, /etc/pcoc-admission/gate.toml, /var/lib/pcoc-admission, the unit pcoc-admission.service, behind your own reverse proxy (loopback by default). (source: services/admission-gate/deploy/DEPLOY.md)
6. Routes. As in Sign-in wire, beat 7; /v1/admit and the legacy routes return 404.
7. Log. GET /latest.json (404 until the log has a line), /log/{day}.jsonl (NDJSON) and /log/{day}/{seq} (one line), hash-chained. Each entry names the policy id it was decided under. Entries are one relying party's decisions, not conformance (STATUS.md).
8. Health and operations. GET /v1/health gives version, commit, spec, the object kind it measures (spec_kind) and config. It hides log_dir and config_path, and doesn't fetch the index. The Gate holds no key or secret. Durable state is log_dir only (chain.jsonl, objects/, latest.json, policy-bind.json); back it up and keep the same log_dir across upgrades. Sign-in result rows and verify jobs are in memory and don't survive a restart.

Checked against pcoc main at 7b40353 (services/admission-gate, policy/groundinglab-admission). Policy id checked against pcoc main at 797c1ac. Raw markdown.