Module agent_uid_keys 

Identity M4d-2: each agent’s LAN and WAN signing keypairs filed under its UID (db_agents.id), beside the name-keyed tables they are copied from (SPEC_AGENT_IDENTITY_CARRIED_NOT_DERIVED_2026_09_23.md §6.5.10).

A name-keyed key is copied to a UID only on evidence that the agent owns it: the name is the row’s slug, no other row holds that slug (folded), the key is no older than the row, and the name is not a deleted agent’s (db_agent_key_tombstones). Otherwise the UID gets a fresh keypair. The v1 signatures keep using the name-keyed keys until M5; a UID key signs only the v2 signatures (M4d-6), so neither outcome changes what peers verify today.

Structs

AgentUidKeys

An agent’s UID-keyed LAN and WAN keypairs.

Row 🔒

The UID’s row, as the evidence test needs it.

UidKeypair

One UID-keyed keypair, both halves base64.

Enums

FreshReason

Tier 🔒

The two key tiers, each with its legacy name-keyed table and its UID table.

UidKeyOrigin

How a UID key came to be, for the m4d.key_* counters.

Functions

copyable_name_key 🔒

The name-keyed key the UID may take, and its name, or why not.

ensure_tier 🔒

One tier: the existing UID key, else a copy of the name-keyed key when the evidence holds, else a fresh one. Runs under the caller’s lock.

load_uid_key 🔒

slug_holders_folded 🔒

How many rows hold folded as their slug, trimmed and folded with Rust’s Unicode-aware to_lowercase (the key tables’ folding).