Module wan_identity 

The channel-wide WAN identity store, <channel dir>/wan-identity/wan.db (SPEC_WAN_JEKT_VERIFICATION_2026_09_24.md §2.2, step D1).

Everything WAN verification needs to survive an upgrade lives here rather than in objects.db, which is per version for installed builds (channels/<ch>/versions/<v>/data/): with the agent keys in objects.db, every upgrade re-minted every agent’s WAN key. This file holds:

• the instance keypair — the install’s long-lived identity. Its id (jekt_sign::wan_instance_id) is what agents sign as their AGENTMUX_HOST_LABEL, and its key certifies each agent key;
• the agent WAN keys, imported once from the version’s db_agent_wan_keys (or minted fresh) and kept here from then on;
• (D1b/D2) published fingerprints, the peer cache, replay and known-instance tables.

Concurrency. Two versions of one channel may run at once (data_paths.rs), so this file is shared between processes: WAL, a 5 s busy timeout, and every mint is INSERT OR IGNORE then re-read, so two processes minting at once converge on one row.

Schema is additive only. wan_meta.schema_version records the newest schema any binary has written; an older binary opening a newer file uses explicit column lists and ignores what it doesn’t know. A binary that cannot open the file gets no store at all — WAN signing and verification are then off for that process (every message None), and nothing is ever minted into a fallback location.

Lock order. The spawn path reads an agent’s old objects.db key before calling in here, and the agent-delete purge calls in here while holding the objects.db lock. So the order is always objects.db → wan.db; nothing here ever takes the objects.db lock.

Structs

KnownInstance

What this install knows about another instance (§2.6).

WanAgentKey

An agent’s WAN keypair, both halves standard base64 — the same encoding agent_wan_keys::AgentWanKeypair uses, so an import is a straight copy and AGENTMUX_WAN_KEY is unchanged for the MCP.

WanIdentityStore

WanInstance

This install’s instance identity. The private key never leaves this process except as a certificate signature.

Constants

BUSY_TIMEOUT 🔒

SCHEMA 🔒

SCHEMA_VERSION 🔒

Bumped only by additive changes (new tables, new nullable columns). v2 (D2): the receiver tables — peer-record cache, known instances, and seen signatures. v3: wan_agent_key_publications — publication recorded per directory.

Statics

GLOBAL 🔒

Functions

decode_32 🔒

global

install_global

Register the process’s wan.db for code that has no channel object store in hand — the cloud subscriber runs against id_store. Set once, at bootstrap, alongside Store::set_wan_identity.

is_busy 🔒

resolve_wan_identity_path

<channel dir>/wan-identity/wan.db, from the launcher-provided paths. None outside a launcher-started srv (tests, odd envs): WAN identity is then off, never redirected somewhere else.

restrict_permissions 🔒

retry_while_busy 🔒

Run op until it stops failing with SQLITE_BUSY, for at most BUSY_TIMEOUT. Any other error, or BUSY past the deadline, is returned.

sanitize_host_hint

A hostname as a host hint: lowercased, anything outside [a-z0-9.-] replaced by -, cut to 48 chars; unknown if nothing is left. The receiver validates the same alphabet (jekt_sign::is_valid_wan_host_hint) and renders anything else as ?.