Module origin 

Host-origin minting: h-<12hex> (RFC 06 §1).

Byte-precise reference derivation — two independent implementations MUST mint the same id for the same machine:

input   = machine_id_hex ++ salt        (UTF-8, no separator)
machine_id_hex = the 32 lowercase-hex chars of /etc/machine-id, trimmed
origin  = "h-" ++ lowercase_hex(sha256(input))[0..12]

The salt is an application constant (RFC 06 §1), declared in the application’s crate::AppProfile — compiled in, not operator-configurable, identical across deployments. Changing it re-keys every fleet.

Structs

Fleet

The deliberate * — a fleet of hosts. Spellable only where the grammar allows fan-out: selector builders and fanout-allowed procedures. Not a ConcreteOrigin, by design (RFC 08 §1.1: a * origin is reachable only by asking for it by name).

HostId

A validated h-<12hex> host origin id.

LocalOrigin

This process’s own minted origin. Publish/serve builders take exactly this; obtain it from crate::AppProfile::local_origin.

RemoteOrigin

An origin this process read from the wire — a received key, a health document, a catalog entity. Call/address builders take &impl ConcreteOrigin; this is the consumer-side implementation (identity bridge, RFC 06 §6: display the payload name, key on the host id).

ServiceOrigin

A registered service origin (@catalog, @desired, …) — a verbatim chunk, single logical writer (RFC 06 §5, 07 §3).

Traits

ConcreteOrigin

A concrete (never wildcard) origin. Sealed: exactly LocalOrigin, RemoteOrigin, and ServiceOrigin implement it — a fleet selector does not, which is what makes a fan-out write a type error (G2/G5).

HostOrigin

A concrete host origin (h-…): LocalOrigin or RemoteOrigin, never a service. Host-shaped builders (producer keys, producer @rpc) take this — a service origin has no producer chunk, so passing one would be grammar-illegal; the trait split makes it unrepresentable.