Module registry 

Clearance registry: maps daemon names to verified identities and security levels, with O(1) pubkey lookups via a reverse index.

Built by daemon-profile at startup from per-daemon keypairs. After Noise IK handshake, the server extracts the client’s X25519 static public key via TransportState::get_remote_static() and resolves it here.

Keys not in the registry receive SecurityLevel::SecretsOnly (ephemeral CLI clients).

Data Model

identities: HashMap<String, DaemonIdentity> is the source of truth, keyed by daemon name. One entry per daemon. find_by_name is O(1) and deterministic.

pubkey_index: HashMap<[u8; 32], String> is a derived reverse index for O(1) pubkey resolution during Noise handshake. Both current_pubkey and pending_pubkey (when present during key rotation) have entries in this index.

Consistency Invariant

For every (pubkey, name) in pubkey_index: identities[name].current_pubkey == pubkey || identities[name].pending_pubkey == Some(pubkey)

Enforced by all mutation methods. Validated by debug_assert_consistent() in debug builds.

Structs

ClearanceRegistry

Maps daemon names to identities with O(1) pubkey lookups via reverse index.

DaemonIdentity

A daemon’s verified identity, clearance, and key state.