Module wan_publish 

Publish each agent’s WAN key to the account’s cloud key directory, certified by this install’s instance key (SPEC_WAN_JEKT_VERIFICATION_2026_09_24.md §2.2, step D1b).

A receiver can verify a WAN jekt only against a key it can fetch, and it trusts that key only because this install’s instance key signed it — so the directory never has to be trusted, only reachable. The cloud checks the same chain on PUT (hygiene); the receiver checks it again.

When. The spawn path nudges the publisher after it provisions a key (nudge); a background loop also re-runs every RETRY_SECS so a key that failed to publish (logged out, cloud down) is retried, and every IDLE_RECHECK_SECS when idle, because a sign-in in another channel can change the directory without nudging this process. A cloud that answers 404 predates the directory (C1 not deployed): retried at most hourly, never hot.

Which token. The shared account token (load_valid_token), not a per-agent M2M token — a per-agent client may be unowned, and the directory is keyed by account.

Nothing here ever makes a jekt fail: until a key is confirmed published, the relay simply sends that agent’s jekts unsigned (reactive.rs’s carry gate, condition 4).

Structs

PassResult 🔒

Result of one pass over the unpublished keys.

Enums

PublishOutcome 🔒

Wait 🔒

Constants

IDLE_RECHECK_SECS 🔒

How often an idle publisher looks again. A sign-in in another channel (the MuxBus login is shared) changes the directory this one should publish to, but only nudges its own process (Codex P2 on #3994), so an idle publisher can’t wait on nudges alone.

NOT_SUPPORTED_RETRY_SECS 🔒

Retry interval after the cloud said it has no directory (HTTP 404).

PUBLISH_TIMEOUT_SECS 🔒

RETRY_SECS 🔒

Background retry interval while any key is unpublished.

Statics

NUDGE 🔒

Functions

certify 🔒

This agent key’s directory record, certified by the instance. Channel is the one the agent signs as (AGENTMUX_CHANNEL, local_channel_id), and issued_at is the key’s creation time, so the same key always yields the same record.

directory_id 🔒

Which directory a publication is for: the relay’s REST base plus the account (the token’s sub). The directory is keyed by account, and a relay move or a sign-in to another account is a directory that has never seen this install’s keys — so wan.db records publications per this id, and a key counts as published only to the directory it went to.

nudge 🔒

Ask the publisher to run a pass soon — called by the spawn path after it provisions an agent’s WAN key. Cheap and safe to call with no publisher running.

nudge_handle 🔒

publish_pending 🔒

Publish every key wan doesn’t yet have confirmed. Stops at the first 404 — the whole directory is missing, not one record.

publish_record 🔒

PUT /agents/:agent_id/wan-key. A pure HTTP operation, like relay::relay_inject, so tests can point it at a stub.

run_pass 🔒

spawn 🔒

Start the background publisher. No-op without a wan.db. Runs a pass on start, on every nudge, every RETRY_SECS while keys remain, and every IDLE_RECHECK_SECS when none do; after a 404 it waits NOT_SUPPORTED_RETRY_SECS (nudges included, so a burst of spawns can’t turn an old cloud into a hot loop).