CleiMesh: Rust node enforces signed per-call permissions for AI tools

A developer released CleiMesh, an open-source Rust node that issues attenuating signed permission tokens to AI agents and runs tools in WebAssembly with deny-by-default access. Every allowed or denied call gets an Ed25519-signed, replayable receipt. The project is in alpha under MIT or Apache-2.0.

• IETF Attenuating Agent Tokens can only shrink when delegated to a subagent
• Tools run in wasmtime + WASI, with directories and network gated by the token
• Ed25519 receipts follow draft-sahu-agent-action-receipts; no receipt, no run
• 37 MB static binary, ~2.5 ms startup, ~3 ms per call with two fsyncs, ~400 calls/s