mcl_om_identity (mcl_om v0.2.2)
View SourceIdentity, seed and realm resolution for the mesh pool mcl_om_sup supervises alongside this gen_server.
11.x model (the PQ port): the service identity is a macula_node_keys node key (purpose identity, pq_hybrid, puzzle-hardened at the fleet's difficulty) — the same thing a station or pool identity is. The 10.x Ed25519 keypair and the realm-signed service cert are gone with the 11.x wire: realm membership is what the D25 authorization records and the pool's realm_trust keys attest, not a TLS cert chain.
Seeds must carry the station node ids they expect: the 11.x peering layer refuses a client dial without an expected_node_id pin (D5). MACULA_STATION_SEEDS (comma-separated hosts, ports default 4433) pairs index-for-index with MACULA_STATION_NODE_IDS (comma-separated 64-hex node ids); a seed without a matching pin is refused at boot — a silent unpinned seed would be a dial that can never connect.
Connect-degradation: with no seeds configured, mcl_om_sup never starts a mesh pool child at all, and macula_client/0 returns {error, no_client} forever — consumers fall back to no-op behaviour. The service stays up either way.
The pool itself is not this gen_server's state: it is an ordinary supervised sibling (mcl_om_sup, restart => permanent), started strictly after this gen_server has loaded the key, so identity_key/0 is read back rather than re-loaded.
Summary
Functions
The service's stable signing node key, {error, no_identity_key} when running on an ephemeral identity, or {error, not_booted} when called before this gen_server has started.
The mesh pool handle, or {error, no_client} when no seeds are configured (so mcl_om_sup never started the pool child at all).
This service's org name (the <org> segment of its procedure URIs). Always a binary — <<"_">> both when unconfigured and when called before this gen_server has started.
The 32-byte realm tag, {error, no_realm} when unset, or {error, not_booted} when called before this gen_server has started.
Functions
-spec identity_key() -> {ok, macula_node_keys:node_key()} | {error, no_identity_key | not_booted}.
The service's stable signing node key, {error, no_identity_key} when running on an ephemeral identity, or {error, not_booted} when called before this gen_server has started.
-spec macula_client() -> {ok, pid()} | {error, no_client}.
The mesh pool handle, or {error, no_client} when no seeds are configured (so mcl_om_sup never started the pool child at all).
-spec node_key_from({ok, file:filename_all()} | undefined) -> macula_node_keys:node_key() | undefined | {error, {identity_key_unloadable, file:filename_all(), term()}}.
-spec org() -> binary().
This service's org name (the <org> segment of its procedure URIs). Always a binary — <<"_">> both when unconfigured and when called before this gen_server has started.
-spec realm() -> {ok, <<_:256>>} | {error, no_realm | not_booted}.
The 32-byte realm tag, {error, no_realm} when unset, or {error, not_booted} when called before this gen_server has started.