spectra connect and the TLS client: trust through the owner's delegation, pinned certificate, shims over the network issue #21 closed: completed andymccall opened this 1 day ago · 0 comments

Spec §8.6 "Connecting".

• The client transport in spectra-mcp::client: an endpoint is the Unix socket or https://HOST:PORT with a pinned SPKI (rustls with a verifier that accepts exactly the pinned key).
• spectra connect URL: read the presented certificate and /api/v1/instance; accept only when the binding is signed by the instance key and the owner's own identity (OXY_HOME) delegates to it now; until then save the instance's public identity and print the oxy identity delegate add line.
• Writes $XDG_CONFIG_HOME/spectra/client.toml (server, instance, tls_spki); SPECTRA_SERVER overrides; a changed certificate is refused until connect runs again.
• The shim (spectra mcp --agent NAME --home DIR) works against a configured server.

Done when: tests cover acceptance, an undelegated instance, a certificate swapped for one the instance did not sign, and a shim's MCP call over TLS.