WunderOS Customer Agent Identity struct

ca_identity.gleam

/// One Cognitive Agent's durable identity, as attested by the substrate.
/// Persisted core only — derived views (hieroglyph, name) and per-boot
/// state (SA incarnation, live attenuation) are computed on read.

pub type CaIdentity {
  CaIdentity(
    /// 16-byte ULID. The only canonical key; everything else resolves from it.
    /// System agents: timestamp=0 + 0x53 marker byte (ADR-064 / PEN-3240).
    ulid: BitArray,

    /// Human-facing word-triplet derived from `ulid`. Stored to pin the name
    /// at mint time; recompute on read if the dictionary changes is rejected.
    public_name: String,

    /// Customer-side reference. With `tenant_ulid`, forms the natural owner key.
    client_ref: Option(String),

    /// Owning tenant — pulled in from AgentBinding because no identity is
    /// meaningful tenant-less.
    tenant_ulid: String,

    /// Signing-key attestation (PEN-3378), replacing the ca_key_store sidecar.
    /// `Software` seed stays in the key store; only the public half lives here.
    public_key: BitArray,
    key_origin: KeyOrigin,          // Software | External(reference)

    /// Capability posture: which memory tiles this CA owns. `-1` = unassigned,
    /// matching today's assign_tiles protocol.
    episodic_tile: Int,
    semantic_tile: Int,

    /// Execution signature (governance/pdp): what model + prompt actually ran.
    /// Sealed per-request, None until the first governed invocation.
    execution_signature: Option(ExecutionSignature),  // model_id, prompt_version, inference_seed

    /// Withdrawn trust (PEN-3051). `Some(ms)` = revoked at that wall-clock;
    /// fold the revocation ledger in instead of a separate ETS consult.
    revoked_at_ms: Option(Int),

    /// Mint time and the boot epoch that minted it — for ordering and
    /// "which incarnation of the substrate birthed this agent."
    created_at_ms: Int,
    created_boot_epoch: Int,
  )
}