Module lockfile 

Capability lockfile and runtime attestation (spine §4.1).

pointlock lock runs system.hello + device.capabilities against a real daemon and freezes the result into a CapabilityLockfile (checked into the repository like a dependency lockfile). At openSession the provider replays the handshake and compares the live world against lockfileDigest; any mismatch is capability_drift — refuse to run, never silently degrade.

Structs

CapabilityAttestation

The runtime attestation result exposed on an open session (spine §4.2 CapabilityAttestation). openSession has already compared it against the expected lockfileDigest; it is surfaced for Evidence and reports.

CapabilityLockfile

The capability lockfile pointlock lock freezes after talking to a real daemon (spine §4.1 CapabilityLockfile). Its digest is embedded into FlowIR.lockfileDigest at compile time and re-checked by attestation at every openSession.

LockfileDevice

The frozen device.capabilities outcome (spine §4.1 CapabilityLockfile.device).

LockfileHello

The frozen system.hello outcome (spine §4.1 CapabilityLockfile.hello).

LockfileProvider

Identity of the provider package the lockfile was produced by (spine §4.1 CapabilityLockfile.provider).

PeerInfo

Daemon identity (DeviceRail PeerInfo, spine A.8).

ProtocolVersion

A negotiated protocol version ({ major, minor }).

Constants

LOCKFILE_DIGEST_DOMAIN_TAG

Domain tag of the lockfile digest, following the 02 §12.2 domain-hash construction (sha256(utf8(tag + "\n" + JCS(content)))).

Functions

lockfile_digest

Computes the canonical digest of a lockfile’s content — every field except digest itself and the volatile attestedAt timestamp — via pointlock_ir::domain_hash under LOCKFILE_DIGEST_DOMAIN_TAG.