Cryptographic primitives for the agent-mesh.
This crate provides the identity layer the rest of the workspace builds on:
- [
UserKey] — root of trust, one ed25519 keypair per user. - [
AgentKey] — short-lived per-process sub-key, certified by aUserKeyvia a [CertChain]. - [
GitHubBinding] — cross-signature linking aUserKeyto the ed25519 SSH key GitHub already knows about. - [
SignedEnvelope] — the wire format every mesh message is wrapped in. - [
Fingerprint] — short BLAKE3 identifier for keys and content.
All wall-clock time in this crate is treated as a claim (e.g.
AgentMetadata::issued_at), never as a coordination primitive.
See the project CLAUDE.md for the rationale.