Module identity 

Ed25519 identity. The public key is the identity; names are local petnames.

Claiming the name “alice” gets you nothing without her key, so the sender gate in the channel server checks a signature rather than a string an agent typed. This is the property the channel docs demand: “gate on the sender’s identity.”

Signing covers a domain-separated, length-prefixed canonical encoding, so a signature can never be replayed into a different context and no pair of fields can be shifted across their boundary.

Structs

AgentId

An agent’s identity: its Ed25519 public key.

AgentKey

An agent’s secret key. Zeroized on drop by ed25519-dalek’s default features.

Announcement

A signed presence announcement, published to the bus roster. The name is a self-claim; identity is the key, so a peer verifys before ever trusting the name.

SessionInfo

A live session under a node identity: its session_id (normally the stable id Claude Code injects, CLAUDE_CODE_SESSION_ID; a random one off-Claude) plus the descriptor a human recognizes it by in discover. One identity hosts several at once; key#session_id is the routing address.

SignedMessage

What travels over the bus. The bus treats it as an opaque payload.

Enums

MessageKind

What a signed message is. A plain Message is the everyday case; the pairing kinds are the only thing a non-peer may deliver (a knock), gated specially.

TaskStatus

The lifecycle marker on a task message. Absent on a plain chat turn, the opening request, or an answer; present on the executor’s replies about a task.

Functions

check_freshness

Reject messages whose timestamp is implausible. The bound is asymmetric: the future side is tight (clock skew — a message dated well ahead of now is a forgery/replay signal), while the past side is generous, because the bus is a durable keep-until-ack store and a legitimately delayed message (an offline or slow peer, a server-restart gap) must still be deliverable when it finally lands.

mint_session_id

A fresh random session id (8 lowercase hex chars) — the fallback when Claude Code’s CLAUDE_CODE_SESSION_ID isn’t present. Random, not derived from metadata, so two sessions in the same directory never collide.