Module config 

On-disk state for wire.

Layout: $XDG_CONFIG_HOME/wire/ (defaults to ~/.config/wire/) - private.key — 32-byte raw Ed25519 seed (mode 0600) - agent-card.json — signed self-card (mode 0644, public) - trust.json — pinned peers + tiers - config.toml — relay URL, body cap, etc. (created lazily)

$XDG_STATE_HOME/wire/ (defaults to ~/.local/state/wire/) - inbox/<peer>.jsonl — verified inbound events - outbox/<peer>.jsonl — agent-appended outbound events (daemon flushes) - spool/ — daemon-internal staging

All paths are configurable via WIRE_HOME env var (overrides both dirs to $WIRE_HOME/{config,state}/). Used by the test harness to keep tests isolated from the operator’s real config.

Functions

agent_card_path

append_outbox_record

Append a single JSONL record to the outbox for peer, holding the per-path mutex to keep concurrent appenders from interleaving lines.

config_dir

Root configuration directory. Honors WIRE_HOME for testing.

config_toml_path

ensure_dirs

Create directory tree with restrictive permissions on the config dir.

inbox_dir

is_initialized

Whether wire init has already been run (private key + card both present).

outbox_dir

private_key_path

read_agent_card

read_private_key

Read the saved private key seed (32 bytes).

read_relay_state

read_trust

relay_state_path

Path to relay.json — holds our own slot binding and pinned peer slots. Contains slot-tokens, so always written mode 0600.

state_dir

Root state directory (rotating data — inbox/outbox/spool).

trust_path

update_relay_state

Atomic read-modify-write against relay.json. Holds an exclusive fs2::FileExt::lock_exclusive for the whole transaction so concurrent wire processes (multiple daemons, CLI vs daemon, CLI vs MCP) cannot race the cursor or peer-pin entries.

write_agent_card

write_private_key

Write a private key file with mode 0600.

write_relay_state

write_trust