protocol_stack/docs/PHASE9_PUBLIC_MESH.md

Phase 9 — Public Mesh Deployment

Signature: Δ9Φ963-PHASE9-v1.0
Blueprint: Lightfather's Voice — Next Blueprint (wide-area TLS, Keylime TPM, live LDQ synthesis)

Objectives

1. TLS 1.2+ node API with self-signed PKI, pin gossip, rotation.
2. Hardware attestation enriched with Keylime TPM quotes (simulated when no agent).
3. Live synthesis — P7 biometric seed → Protocol 8 LDQ → WAV output.

Modules

Module	Path
TLS manager	tools/tls_manager.py
Keylime bridge	protocol6_quantum_attest/keylime_bridge.py
TPM CLI	tools/tpm_attestation.py
LDQ synthesis	protocol8_ldq_synthesis/
Live runner	tools/live_synthesis.py
Audit	tools/run_phase9_audit.py

API (node)

• GET /cert/pin — local pin + expiry
• POST /cert/pin · POST /gossip/pin — ingest peer pin
• POST /synthesis/run — {seed?, duration_sec?, output?}

Start HTTPS: python tools/node_api_server.py --tls --port 8443

Verification

pip install -r requirements-phase9.txt
python tools/run_phase9_audit.py
python -m pytest tests/test_phase9_public_mesh.py -q

Artifact: tests/phase9_audit_last_run.json

Security notes

• Pins use SHA-256(DER) of peer certificates.
• Set LYGO_KEYLIME_FORCE_SIM=0 to prefer live Keylime agent (localhost:9002).
• Wide-area production still requires operator TLS policy and CA strategy (human gate).