Module seed_bind 

Fleet identity binding for Cognitum Seeds (card mesh-placement-22; ADR-100 section 5; docs/research/mesh-placement/fleet-compat.md section 2c).

A Seed has a device identity (GET /api/v1/identity: a device id and an Ed25519 public key) but no WeftOS node key. The operator binds the two with a signed record {device_id, device_pubkey, node_id, bound_at}; SeedBinder::bind verifies it against the pinned operator keys and against the Seed itself, then chains workload.node.bind. Anything else (an unpinned signer, a changed record, a key that is not the device’s, a record for another node, an expired or replayed record) is refused with a chained workload.refuse.

The node id of a Seed is the id derived from a per-Seed adapter key held by WeftOS (never by the Seed): the Seed cannot sign for itself, so the adapter signs the Seed’s facts (attest_seed_facts) and every capability carries provenance claimed, since the device’s own report is not something WeftOS measured.

Bearer tokens never reach a record, an error or a chain event: the only Seed data used is the (public) identity.

ADR-106 phase 1d adds the licence form: SeedBinder::bind_v2 verifies an operator-signed licence::BindingRecord v2 under the steward profile (the checks above, plus the grant key fingerprint, mesh_id and seq), and SeedBinder::unbind_v2 withdraws it. Both live in seed_bind/v2.rs.

Structs

BindRecord

What the operator signs.

Binding

A verified binding. Only SeedBinder::bind makes one.

SeedBinder

Verifies and remembers bindings.

SignedBind

A bind record with the operator’s signature over the exact bytes.

StewardBind

Everything one steward bind needs.

UnbindOutcome

What an unbind did.

Enums

BindError

Why a bind was refused. Self::code is the stable chain code.

Constants

BIND_CHAIN_SOURCE

Chain source of bind events.

BIND_CLOCK_SKEW_SECS

Tolerated clock skew for bound_at.

BIND_DOMAIN

Domain tag signed before a bind record.

BIND_STATE_FILE

File name of the persisted bind state, beside workload-placements.json. The daemon’s workload.node.bind uses dir.join(BIND_STATE_FILE) (the runtime dir).

DEFAULT_MAX_BIND_AGE_SECS

Default age after which a bind record is no longer accepted.

SEED_FACTS_TTL_SECS

Facts lifetime for an adapter-attested Seed.

Functions

attest_seed_facts

Facts for a bound Seed, signed by the adapter key. Every capability is forced to provenance claimed: the Seed’s own report, relayed by the adapter, is never probed or measured (a measured value only comes from WeftOS’s own conformance runs).

grant_fingerprint

The fingerprint of a grant key in hex form, for display and the CLI’s confirmation (ed25519: plus 16 hex).

seed_node_id

Node id of a Seed whose adapter key is adapter.

sign_bind

Sign record as the operator.