Federated identity and nodes
One agent may inhabit more than one device. That does not make every device a copy with equal, indistinguishable authority.
The model being built
Section titled “The model being built”The agent root public key names the being. Each device gets its own local node
key and immutable random node_id; its private key stays on that device. A
commission binds the agent root, node key, node ID, hardware fingerprint, human
label, and revocation policy.
| Concern | Authority |
|---|---|
| Being | Agent root public key |
| Device | Local node key and immutable node ID |
| Hardware | Device public-key fingerprint |
| Display | Renameable human label such as phone or workstation |
| Memory | One Git ref per node, reconciled later |
Adding a device is therefore a commissioning ceremony, not a directory copy: invite, local key and request, commission, join, then operate with node-signed events. Git moves memory; the event stream says that a branch changed.
Implementation state — PARTIAL
Section titled “Implementation state — PARTIAL”Machine and agent Ed25519 keys exist, and configured peers can exchange signed events. Memory sync can push a per-instance branch and resolve its remote; automatic fetch and merge policy remain open. The node ceremony is still DESIGN: commission format, per-node key store, revocation and commission validation do not exist.
Copying an agent private key is an explicit same-instance migration shortcut. It is deliberately noisy and is not a way to enrol an independent phone, workstation, or future body.
The boundary
Section titled “The boundary”The commissioning implementation starts with versioned node IDs, requests and commissions; then invite/join; then trusted commission validation; then per-node memory refs and reconciliation. The protocol is designed around that sequence so new bodies join with accountable authority instead of inheriting a copied secret.