Server over TLS: a certificate signed by the instance key, /api/v1/instance, no uid over TCP issue #20 closed: completed andymccall opened this 1 day ago · 0 comments

Spec §8.6 "The server", §21.1, §22.1.

• [server] bind beyond loopback with tls = "auto": a P-256 key and self-signed certificate in <data>/keys/tls.{key,crt}, made on first start, naming [server] names (default: host name and FQDN); or tls = { cert, key }.
• The instance key signs "spectra1 tls " || SHA-256(SPKI) (challenge signing); recorded as instance.tls; spectra admin verify checks it.
• GET /api/v1/instance without authentication: name, instance identity, owner key, SPKI hash, binding signature.
• Over TCP there is no peer uid: an agent bound to a uid is refused there and recorded as guard.impersonation.
• spectra serve refuses non-loopback plain HTTP without --insecure (unchanged).

Done when: an end-to-end test serves TLS on 127.0.0.1:0 with tls = "auto", a client reads the certificate, checks the binding against the instance key, and makes a signed MCP call.