Struct TkaInit 

pub struct TkaInit {
    pub disablement_secret: Vec<u8>,
}

Initialize Tailnet Lock with this node as the sole initial trusted key, gated by disablement_secret (Go LocalClient.NetworkLockInit — the “lock yourself in” case).

Builds + signs a genesis Checkpoint AUM whose only trusted key is this node’s network-lock public key (votes 1) and whose single DisablementValue is disablement_value(secret), then drives the two-phase init: tka/init/begin (submit the genesis) → if control needs no further node signatures (NeedSignatures empty, the case when this node is the only key) → tka/init/finish carrying the raw disablement_secret as SupportDisablement. Mirrors tka_sign/tka_disable: cloned config + keys into a spawned task (delegated reply).

If control returns a non-empty NeedSignatures (other nodes must be re-signed under the new lock — a multi-node tailnet), this returns TkaSyncError::Unsupported: re-signing each listed node (incl. the Rotation-key case) is a larger flow deferred to a fuller tka_init(keys, secrets) — the single-node lock-init is the shipped subset.

Submit-only, like tka_sign/tka_disable: this creates the lock at control and does NOT seed the local Authority — the node picks up the new lock through the existing verified netmap-sync (control pushes a TKAInfo, maybe_sync_tka bootstraps the genesis through VerifiedAumChain::verify). Verify-and-log posture unchanged.

Fields

disablement_secret: Vec<u8>

Trait Implementations

impl Message<TkaInit> for ControlRunner

type Reply = DelegatedReply<Result<(), TkaSyncError>>

The reply sent back to the message caller.

async fn handle( &mut self, msg: TkaInit, ctx: &mut Context<Self, Self::Reply>, ) -> Self::Reply

Handler for this message.