spec: fleet trust — auto-pair anchored on a key the relay never holds

[karngyan]

Specs the design settled in discussion: one pairing ceremony ever, machines federate, and the trust anchor never touches Cloudflare.

• Fleet key (Ed25519) minted at setup, rides the existing join line, lands in relay.json. The Worker never holds it — the secret keeps gating routing, the fleet key gates trust.
• Certs: machine certs (id + name + daemon static key), device certs (minted at pairing, carried in Noise IK message A's payload — no handshake pattern change), explicit revocations that permanently outrank certs.
• Fleet directory: one DO per relay hosting signed public artifacts; every reader verifies, the relay can withhold but never mint. New machine = one join line, visible everywhere; new device = one ceremony anywhere, admitted everywhere; revoke anywhere = revoked everywhere.
• Self-certifying machine ids: slug-<8 hex HMAC tag> under the daemon secret, verified statelessly in the router — grammar-valid-but-fake ids get the same 404 malformed ids get today, and no DO wakes.
• Rate rule: one CF rate-limiting binding over the credential-less routes, since run_worker_first bills every request regardless.

Breaking by design (pre-adoption, operator redeploys): MAC-less ids refused, certs required for auto-admission, --fleet on join. Cert encodings and the id MAC get cross-language test vectors like the Noise and framing fixtures before them.

Implementation lands in stages after this merges: (1) MAC ids + rate rule, (2) fleet key + certs daemon-side, (3) directory + browser side.

🤖 Generated with Claude Code