Struct SigningHandoff 

pub struct SigningHandoff {
    pub agent: String,
    pub key_version: u32,
    pub secret: [u8; 32],
}

The signing capability a runtime hands to a child it sealed inside its own sandbox.

<mur_home>/keys is kernel-denied to every sandboxed process on purpose — a prompt-injected agent must not be able to exfiltrate its own signing key. The runtime escapes that only because it loads the key BEFORE the sandbox seals; a child spawned afterwards cannot, so every channel event such a child wrote was unsigned.

This travels on the child’s stdin pipe — never argv, never the environment. ps eww shows another same-uid process’s environment, so an env var here would hand the key straight back to the bash tool the sandbox exists to keep it away from. A pipe is readable only by the process holding the descriptor.

Design: docs/superpowers/specs/2026-09-09-in-sandbox-channel-signing-design.md.

Fields

agent: String

The agent this key signs as. The receiver uses it only when the event it is writing names this same writer.

key_version: u32

secret: [u8; 32]

Raw Ed25519 secret, as a JSON array of bytes — no encoding dependency stands between the two ends of the pipe.

Trait Implementations

impl<'de> Deserialize<'de> for SigningHandoff

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SigningHandoff

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.