pub fn auto_pin_decision(peer_card: &Value) -> Option<String>Expand description
Receiver decision (amendment §C, all 7 steps): should a received peer_card
be auto-pinned at ORG_VERIFIED because it proves it is on THIS machine,
owned by the SAME operator? Returns Some(peer_op_did) when every check
passes, None to fall through to standard pairing. Fully offline.
Because a wire op_did is a hash commitment to the operator key, “peer’s
op_did == my op_did” already forces “peer’s inline op_pubkey == my op_pubkey”
— i.e. genuinely the same operator, not a look-alike. The fingerprint match
then forces “same (machine, OS user)”, and the signature forces “this exact
session, not a replay”.