pub(super) fn verify_reagent_signature(req: &mut InjectionRequest, now: i64)Expand description
WAN-tier reagent-signature verification for the HTTP
/agentmux/reactive/inject path — mirrors
cloud_subscriber::sync_agent_reactive’s in-process verification of the
same four fields for the desktop app’s WS delivery path, but for callers
that deliver over HTTP instead (@agentmuxai/muxbus-client’s
pollAndDeliverInjections, and any future standalone poller). Before
this, InjectionRequest declared reagent_sig/reagent_key_id as
deserializable input fields but nothing on the HTTP path ever read them
— a reagent-signed notification delivered through this path arrived
unsigned in effect, reagent_verified always None, and could never
render SIG=verified (reagentx P1 on PR #41).
Only meaningful for delivery_tier == "wan" — same scoping as
reagent_verified’s doc comment (“meaningless off the WAN tier”). A
partial set of the four fields (e.g. a sig but no key_id) is treated the
same as “not signed” (reagent_verified stays None), not “signed but
broken” — matches cloud_subscriber.rs’s identical policy: a legitimate
sender always sends all four together, and this field never affects
TIER/TRUST escalation either way, so a stripped signature can’t buy
an attacker anything a fully-absent one couldn’t already.
Takes now explicitly (rather than calling now_unix_secs() itself),
same reasoning as cloud_subscriber::reagent_sig_is_fresh: the pinned
Ed25519 key’s matching private half isn’t in this repo (it lives only in
the cloud service), so tests can’t mint a fresh signature
on demand the way the host-tier HMAC tests below do — only a fixed
offline-signed fixture at a fixed ts_secs. Injecting now lets a test
hold that fixture inside the freshness window without mocking the clock.