Module enroll 

Certificate enrollment endpoint - the bootstrap surface a certless client reaches for its FIRST client certificate.

This is deliberately NOT a fallback on the always-mTLS RPC plane (that plane stays mutually authenticated with no weakenable path). It is a separate, minimal, server-authenticated-TLS endpoint with its own auth model:

1. The client opens provisional server-auth TLS only to fetch the daemon CA.
2. The operator confirms that CA out of band via the pairing short-auth-string zeroclaw_tls::enrollment_sas, then the client reconnects pinned to that confirmed CA.
3. Only after that trust step does the client submit a pairing code + CSR. The CA reads ONLY the CSR public key (the private key never leaves the device) and signs a clientAuth-only leaf bound to a daemon-minted device id (zeroclaw_tls::sign_csr).
4. The daemon records the issuance in its ledger + audit trail and returns the signed cert + CA chain + the relay profile, so the client can immediately open the mutually authenticated RPC plane (directly or via the relay).

The daemon owns the CA, so this endpoint works with no gateway. The HTTP is hand-rolled (one fixed route) to keep the runtime free of any gateway-shaped web-framework dependency.

Structs

EnrollServer

GeneratedEnrollmentPaircode

RelayAttemptBucket

Class-wide attempt budget for relay-routed enrollment. Relay clients share one network identity (the bridge’s loopback), so per-client lockout cannot apply; this refilling bucket bounds their SUM of pairing attempts instead. Throttle, not lockout: a hostile client can slow relay enrollment, never freeze it for everyone. Brute-force exposure stays small because codes are one-time and short-lived, and the relay’s own per-node connect bucket caps attempt rate upstream. When pluggable inbound authentication lands at this enrollment boundary, authenticated enrollees get per-subject limits and this class bucket remains only for bare pairing-code enrollment.

RelayProfile

Routing target a freshly enrolled client should use to reach this daemon through a relay. Delivered in the enrollment response so the client is zero-config on its next run.

Enums

PeerClass

Which trust class the accepted peer belongs to (see BridgePortSet).

Functions

relay_profile

Assemble the relay coordinates handed to an enrolling or renewing client. Default (empty) when no relay is configured. The pin is the relay’s OUTER leaf fingerprint, sourced from the relay bridge’s pin store when it exists.

request_new_paircode

serve

Run the enrollment endpoint until cancel fires.

serve_on

Run the enrollment endpoint on a pre-bound listener (used by tests so they can bind 127.0.0.1:0 and learn the assigned port).

Type Aliases

BridgePortSet

Everything the enrollment endpoint needs to serve requests. Source ports the in-process relay bridge is dialing the enrollment endpoint from. The bridge registers each outbound port BEFORE connecting (bind, then register, then connect), so accept-side membership is race-free. A loopback peer in this set is relay-class; every other peer is direct-class.