Module recon_ct_provider 

Bounded, transport-neutral core for Cert Spotter reconnaissance queries.

This module validates explicit operator policy, constructs the one permitted provider route, and reduces bounded provider pages to source-qualified DNS name hypotheses. It owns no network transport, target authority, retry policy, clock, or persistence. In particular, a successful query does not establish ownership, currentness, source authenticity, or scan authority.

Structs

CertSpotterAudit

Typed audit for one finalized bounded provider collection.

CertSpotterNameHypothesis

One unique, source-qualified provider DNS name hypothesis.

CertSpotterPolicy

Validated local policy for one bounded Cert Spotter query.

CertSpotterResponseAccumulator

Stateful, transactional parser for at most two provider response pages.

CertSpotterResult

Final bounded, source-qualified provider result.

Enums

CertSpotterClaimLimit

Fixed interpretation limits attached to every provider-derived name.

CertSpotterCompleteness

Conservative collection completeness.

CertSpotterPageOutcome

Outcome after accepting one complete provider response page.

CertSpotterPolicyError

Static, redaction-safe policy rejection.

CertSpotterRequestError

Static request-URL construction failure.

CertSpotterResponseError

Static, redaction-safe response parsing or finalization failure.

CertSpotterTerminal

Why a bounded collection stopped.

ReconCtProviderExecutionMode

Closed execution environment selected by local operator policy.

Constants

CERT_SPOTTER_PRODUCTION_ORIGIN

Fixed provider origin used by production execution.

MAX_CERT_SPOTTER_ELAPSED

Maximum wall-clock time transport integration may spend on collection.

MAX_CERT_SPOTTER_IN_FLIGHT_REQUESTS

Maximum simultaneous provider requests permitted by this contract.

MAX_CERT_SPOTTER_RESPONSE_PAGES

Maximum provider pages in one bounded collection.

MAX_CERT_SPOTTER_RESPONSE_PAGE_BYTES

Maximum accepted bytes in one provider response page.

MAX_CERT_SPOTTER_RETAINED_NAMES

Maximum unique in-scope DNS name hypotheses retained in one result.

MAX_CERT_SPOTTER_TOTAL_RESPONSE_BYTES

Maximum accepted provider response bytes over the whole collection.

MAX_RECON_CT_PROVIDER_POLICY_BYTES

Maximum exact local policy size.

RECON_CT_PROVIDER_POLICY_SCHEMA

The only accepted local policy schema.

Functions

build_cert_spotter_request_url

Builds the exact permitted provider URL from validated policy.

parse_recon_ct_provider_policy

Parses one exact, strict V1 policy document.

Type Aliases

CertSpotterExecutionMode

Concise provider-specific alias for the execution mode.

ReconCtProviderPolicy

Integration-facing policy name used by CLI and runtime code.

ReconCtProviderPolicyError

Integration-facing alias for strict policy failures.