05.1 — Edge Onboarding (Zero-Touch)

The Invariant

One token, no shared secrets. Provisioning carries only a single-use bootstrap token; the Ed25519 keypair is generated on the device at first boot and the private key never travels the wire.

The Contract

The identity resolution runs inside the edge process itself — no separate installer: env vars first, persisted credentials second, bootstrap claim third. Re-running with existing credentials preserves identity; re-claiming with a fresh bt_* rotates the API key and the node keypair (the old key dies instantly).

The Flow

1. Token — ops issues a bt_* bootstrap token from the admin console (POST /admin/tenants/:id/bootstrap-tokens), TTL-bound and single-use.
2. First boot — the edge reads AXIOM_BOOTSTRAP_TOKEN + AXIOM_SYNC_URL, generates the Ed25519 pair on-device.
3. Claim — POST /api/v1/bootstrap/claim with token + node_pubkey (+ optional hw_meta audit fields) → { tenant_id, node_id, api_key, scope: "sync" }.
4. Persist — credentials land in edge-credentials.json (0600); the token is spent and cannot be reused.
5. Sync — the node starts draining the outbox, signed batches, heartbeat on every call.

Payload Example

// POST /api/v1/bootstrap/claim — sent once, at first boot
{ "token": "bt_<48 hex>",
  "node_pubkey": "<base64 SPKI DER>",          // generated on-device
  "hw_meta": { "hostname": "linea-3", "arch": "x86_64",
               "mac_hash": "sha256…", "cpu_model": "…" } }   // self-reported audit data
// → 200 { tenant_id, node_id, api_key, scope: "sync" }

Known Failures