Module agent_lan_keys 

Per-agent Ed25519 keypair for LAN-tier jekt sender verification. See db_agent_lan_keys in migrations.rs (OBJECT_SCHEMA_VERSION v19) and docs/specs/SPEC_JEKT_LAN_TIER_SIGNING_2026_08_15.md §2.1.

Mirrors agent_jekt_keys.rs exactly, asymmetric instead of symmetric: one row per locally-registered agent_id, minted once (first call to agent_lan_key_ensure) and never leaves this srv instance except by the PRIVATE half being injected into that ONE agent’s own MCP server process env (AGENTMUX_LAN_KEY) — never into any other agent’s env, and never returned over any RPC. The public half is not secret — it’s what gets handed to LAN peers on request (see LanDiscovery::find_agent_lan_pubkey) so they can verify this agent’s outgoing signatures.

Structs

AgentLanKeypair

An agent’s LAN signing keypair, both halves base64-encoded for storage/transport.

Functions

random_seed_bytes 🔒

32 bytes of randomness via two v4 UUIDs, for every key table in this module (LAN, WAN, jekt, WAN identity) and the agent tokens. Avoids adding a rand/getrandom dependency: uuid’s v4 generation is already CSPRNG-backed, and ed25519_dalek::SigningKey::from_bytes accepts any 32 bytes of randomness as a valid seed (deterministic derivation from the seed, not a call into an RNG itself).