Crate hatchery_enroll 

Enrollment wire and key handling shared by hatchery-c2 and hatchery-node.

The node generates an Ed25519 identity key and a WireGuard (X25519) key on its own host and keeps them in its own state directory (files mode 0600). Only the public halves leave the host. Agents run by the node never get the state dir.

• EnrollmentRequest is the signed request sent with a one-time code.
• EnrollmentResponse carries only public data (tunnel address, C2 public key).
• Signed call-home: after the usual call-home announce, C2 sends a CallHomeChallenge; the node answers with an ephemeral key and a signature (NodeIdentity::answer_challenge). Both sides derive the same per-connection session token from an X25519 exchange, so the existing mutual challenge-response of the node wire runs unchanged and no standing shared secret exists.

Re-exports

pub use isolation::IsolationProfile;

pub use isolation::KeyStore;

pub use isolation::KillSwitch;

pub use isolation::KillSwitchError;

pub use isolation::TunnelMode;

pub use policy::Grants;

pub use policy::Policy;

pub use policy::PolicyError;

Modules

call

Node -> C2 -> server calls: a node-signed request for one named operation. C2 verifies the signature and the status policy, then forwards to the server with a bearer only C2 holds. The server trusts the node id because only C2 can present that bearer.

isolation

Isolation defaults per node kind and the egress kill-switch ruleset.

policy

Status -> capability policy, shared by C2 (enforcement) and hatchery-server (grants).

Structs

CallHomeChallenge

C2 side of one call-home challenge.

EnrollmentRequest

What a node sends. signature covers every other field.

EnrollmentResponse

Public answer to a successful enrollment. No secret of any kind.

NodeIdentity

Keys the node holds. Persisted as two 0600 files in the node’s own state directory.

VerifiedMaterial

What C2 learns from a valid answer: the bytes the registry must verify and the token.

Enums

EnrollError

NodeKind

Where a node runs; decides which tunnels and isolation apply.

NodeStatus

Status of an enrolled node. Every node starts Neutral.

Constants

ANSWER_LEN

Answer frame: 32-byte node ephemeral public key + 64-byte signature.

CHALLENGE_LEN

Challenge frame: magic + 32-byte challenge + 32-byte C2 ephemeral public key.

CHALLENGE_MAGIC

Magic that starts the C2 challenge on a call-home socket (after the announce).

Functions

auth_signing_bytes

Bytes a node signs to authenticate to C2 over material.

decode_key32

verify_signature

Verify an Ed25519 signature (all values base64).

write_private

Write a file readable by the owner only.