Module root_cert 

Self-host root certificates (1.7): LeanCTX vouches for the root of a self-hosted Hive.

vendor root (offline, compiled into engine and runtime)
  └─ RootCertV1        GET /v1/root-cert (404 on the hosted Hive)
       └─ self-host root → key set (GET /v1/keys) → lease

A certificate never vouches for another certificate. It is signed by a vendor root over "leanctx.hive.root-cert.v1\n" || canonical_json(cert without "signature"), verified over the JSON as received, and valid while not_before - 15 min <= now < not_after + 15 min (no grace after not_after, no revocation in v1: validity is at most 400 days). The engine checks the origin, the window and that the lease’s org is listed; the runtime also caps the lease’s plan and seats.

Structs

RootCertV1

GET /v1/root-cert.

Enums

RootCertPlanV1

What a self-hosted Hive may be certified for.

Constants

MAX_ROOT_CERT_DAYS

Longest validity of one certificate.

ROOT_CERT_SCHEMA

ROOT_CERT_SIGNATURE_DOMAIN