Module admin_bootstrap 

Auto-bootstrap a super-admin credential on first TEE boot.

Two paths:

1. admin_did configured — create the ACL entry for the operator’s known DID and close the first-boot carve-out. The operator keeps the corresponding private key off-enclave.
2. No admin_did configured — leave the first-boot carve-out OPEN. The operator completes the swap via the sealed-bootstrap flow (POST /bootstrap/request with attestation, Phase 3). The first successful swap closes the carve-out.

Legacy behavior pre-Phase-3 was to auto-generate a random admin credential on first boot and store it under tee:admin_credential for retrieval via GET /attestation/admin-credential. That endpoint is gone; startup migrates any stored row out of the store.

Constants

BOOTSTRAP_CARVEOUT_CLOSED_KEY

Sentinel indicating the TEE first-boot carve-out has been closed. Written either by maybe_bootstrap_admin (when an operator DID is configured) or by POST /bootstrap/request after a successful Mode B swap. When present, any subsequent Mode B attempt is rejected.

LEGACY_ADMIN_CREDENTIAL_KEY

Legacy store key for the pre-Phase-3 auto-generated admin credential. No longer written; cleaned up on first startup after the upgrade.

Functions

maybe_bootstrap_admin

Bootstrap a super-admin credential on first boot.