mirror_worker: implement the add-entries submission API

Cargo.toml

@@ -121,6 +121,7 @@ der = { version = "0.8", features = ["oid"] }
 # (crypto-common 0.2 / signature 3.0), so it remains pinned to a pre-release.
 # The rest of the batch is now stable.
 ed25519-dalek = { version = "3.0.0", features = ["pem"] }
+flate2 = { version = "1", default-features = false, features = ["rust_backend"] }
 futures-executor = "0.3.31"
 futures-util = "0.3.31"
 getrandom = { version = "0.4", features = ["wasm_js"] }
@@ -157,6 +158,7 @@ tlog_checkpoint = { path = "crates/tlog_checkpoint", version = "0.2.0" }
 tlog_core = { path = "crates/tlog_core", version = "0.2.0" }
 tlog_cosignature = { path = "crates/tlog_cosignature", version = "0.2.0" }
 tlog_entry = { path = "crates/tlog_entry", version = "0.2.0" }
+tlog_mirror = { path = "crates/tlog_mirror", version = "0.2.0" }
 tlog_tiles = { path = "crates/tlog_tiles", version = "0.2.0" }
 tlog_witness = { path = "crates/tlog_witness", version = "0.2.0" }
 tokio = { version = "1", features = ["sync"] }

crates/mirror_worker/.dev.vars

@@ -1 +1,2 @@
 MIRROR_SIGNING_KEY="-----BEGIN PRIVATE KEY-----\nMDQCAQAwCwYJYIZIAWUDBAMRBCKAIEJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJC\nQkJCQkJC\n-----END PRIVATE KEY-----\n"
+MIRROR_TICKET_KEY="Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc="

crates/mirror_worker/Cargo.toml

@@ -32,33 +32,40 @@ serde_json.workspace = true
 
 [dependencies]
 axum.workspace = true
+base64.workspace = true
 config = { path = "./config", package = "mirror_worker_config" }
 console_error_panic_hook.workspace = true
 console_log.workspace = true
+flate2.workspace = true
+futures-util.workspace = true
 generic_log_worker.workspace = true
 getrandom.workspace = true
 getrandom_03.workspace = true
 hex.workspace = true
+length_prefixed.workspace = true
 log.workspace = true
 ml-dsa.workspace = true
 pkcs8.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 serde_with.workspace = true
+sha2.workspace = true
 signed_note.workspace = true
 tlog_checkpoint.workspace = true
 tlog_core.workspace = true
 tlog_cosignature.workspace = true
+tlog_mirror.workspace = true
+tlog_tiles.workspace = true
 tlog_witness.workspace = true
+tokio.workspace = true
 tower-service.workspace = true
 worker = { workspace = true, features = ["http", "axum"] }
 
 [dev-dependencies]
-# base64 is used only by the dev-config pin tests; ed25519-dalek only to
-# check that a non-ML-DSA-44 MIRROR_SIGNING_KEY is rejected. The shipped
-# worker is ML-DSA-44 only.
-base64.workspace = true
+# Ed25519 is used only by unit tests, to check that a non-ML-DSA-44
+# MIRROR_SIGNING_KEY is rejected. The shipped worker is ML-DSA-44 only.
 ed25519-dalek.workspace = true
+tokio = { workspace = true, features = ["macros", "rt"] }
 
 [lints.rust]
 unexpected_cfgs = { level = "warn", check-cfg = [

crates/mirror_worker/config/src/lib.rs

@@ -141,6 +141,10 @@ impl AppConfig {
     ///    signed-note key name length cap, since each origin is itself
     ///    used as a checkpoint origin.
     ///
+    /// Simple single-field bounds (e.g. the log-number ranges) are
+    /// expressed in `config.schema.json` and enforced by the build
+    /// script, so they are not re-checked here.
+    ///
     /// `log_key_name` uniqueness across log entries is not checked here;
     /// it is enforced earlier, during deserialization (see
     /// [`deserialize_logs`]). A plain `serde_json` object silently keeps