Module provision 

P2: provisioning of enrolled nodes on the server side.

The server reads the node list from C2 (operator API, bearer from an environment variable) and, whenever a node enrolls or its status changes, brings the server side in line:

• an m4a identity per node (ed25519 key pair generated in the vault, master key from the environment; the private seed never leaves the vault and no agent sees it);
• a mailbox address (stub: recorded in the ledger, the mail server consumes the ledger);
• rooms and capabilities by status (stub grants, see [policy]).

Reconciliation is idempotent: the same input changes nothing. A revoked node loses its identity (keys deleted from the vault) and every grant; revocation is final on C2 as well. The ledger holds public data only (key id, public key, grants) and is written 0600.

Structs

C2Source

Where the node list comes from: the C2 operator API (GET /v1/enroll/nodes, bearer).

Grants

LedgerEntry

One node as the server provisioned it. Public data only.

LedgerEntryView

Read-only shape of a ledger entry for consumers (the mail server, tests): status as text.

NodeInfo

What C2 tells us about a node.

Policy

ProvisionConfig

ProvisionSubservice

Runs the poll loop as a supervised subservice.

Provisioner

Enums

Change

What a reconcile pass did to one node.

NodeStatus

Status of an enrolled node. Every node starts Neutral.

Functions

read_ledger

Read the ledger a Provisioner wrote (consumers such as the messenger and task manager).