Struct MigrationIdentityContext 

pub struct MigrationIdentityContext {
    pub unseal_snapshot: EnvelopeUnsealFn,
    pub peer_static_lookup: Arc<dyn Fn(u64) -> Option<[u8; 32]> + Send + Sync>,
}

Identity-transport context for automatic envelope seal/open in the migration dispatcher.

When populated, the handler:

• Source path: after taking a snapshot, if the target’s X25519 static pub is known (via peer_static_lookup) AND the local daemon’s keypair is available, seal the envelope into the snapshot before chunking.
• Target path: on SnapshotReady with an attached envelope, call unseal_snapshot to recover the daemon’s keypair, and pass that into restore_snapshot instead of whatever the factory registry has pre-registered.

A None context means the dispatcher ignores envelopes — the pre-identity-envelope fallback path where both nodes pre-register matching keypairs.

Key hygiene

This struct used to carry the local Noise static private key as a pub [u8; 32] field. Any SDK caller with access to a MigrationIdentityContext could copy the node’s long-term secret out, which is unacceptable — the Noise static is what backs the node’s identity in the mesh, not just the envelope-open path.

The private key is now captured inside the unseal_snapshot closure (built by MeshNode::migration_identity_context) and never surfaced as a struct field. Callers can still hand the context to the dispatcher, but they cannot extract the key from it. This matches how peer_static_lookup already worked.

Fields

unseal_snapshot: EnvelopeUnsealFn

Open an identity envelope attached to snapshot, if present, using the local static X25519 private key captured at construction time. Returns Ok(None) when the snapshot has no envelope, Ok(Some(kp)) on a successful open, and an error string on seal-open / attestation failure.

Built by MeshNode::migration_identity_context; the closure owns a zeroize-on-drop StaticSecret so the key material is wiped when the context is dropped.

peer_static_lookup: Arc<dyn Fn(u64) -> Option<[u8; 32]> + Send + Sync>

Callback: given a peer node_id, return its X25519 static public key if we have an active session with it. Used by the source path to pick the seal recipient.

Trait Implementations

impl Clone for MigrationIdentityContext

fn clone(&self) -> MigrationIdentityContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MigrationIdentityContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.