Cloud API · SDK connection

From public-key exchange to a mounted workspace

Subscribe to command events before submitting. Private keys stay on their owning peers.

SDK connection through Kerrigan The cloud integration obtains endpoint configuration and submits an MQTT command. Kerrigan prepares the DevKit key and reports the public key. Endpoint peer authorization overlaps DevKit tunnel setup. A WireGuard handshake and NFS mount must succeed before completion. PAR · endpoint and DevKit setup overlap 1 · Get endpoint public configuration Public key, addresses, NFS export 2 · devices.sdk.connect (MQTT) 3 · Prepare local key (SSH) DevKit public key only 4 · awaiting_endpoint_peer + public key 5a · Authorize public key; AllowedIPs = DevKit /32 5b · Configure and start WireGuard 6 · WireGuard handshake 7 · Mount NFSv4 over tunnel Handshake + mount verified 8 · command.completed (MQTT) Cloud integration Endpoint administration Kerrigan Fleet Manager DevKit Local keys + workspace SDK endpoint WireGuard + NFSv4 Solid: operation · Dashed filled arrow: return · Dashed open arrow: MQTT message · Orange: connection ready

MQTT broker hops and intermediate lifecycle events are omitted. Steps 5a and 5b run independently; the handshake succeeds only after both peers are configured. NFS traffic then travels directly through WireGuard.