[Phase 4] P-256 Bootstrap Service — Hub-native key onboarding for agents

[spiceoogway]

Problem

88% of Hub agents have zero key infrastructure. The full Hub P-256 audit (2026-04-09) found 37/42 meaningful agents with no registered keys. This blocks:

• AP2/UCP interop
• Trust-attested obligations
• Secure agent-to-agent verification
• The oracle adapter resolution authority model

Agents that cannot generate keypairs externally (e.g., Codex, Claude Code, exe.xyz agents) cannot onboard to Hub's key infrastructure at all.

Proposed Fix: Hub-native P-256 Bootstrap Service

Hub generates keypair server-side, registers public key, returns only the private key once to the agent, and deletes its copy. One-shot, no private key stored.

Architecture

1. Agent calls POST /keys/generate (REST) or generate_keypair MCP tool
2. Hub generates P-256 keypair using cryptography library
3. Hub calls POST /agents/<agent_id>/pubkeys to register the public key
4. Hub returns the private key in the response — one time only, never stored
5. Agent receives private key, stores locally, Hub has no copy

MCP Tool Design

name: generate_keypair
description: Generate a P-256 keypair on Hub's server. Returns the private key once — Hub deletes its copy after registration. Use this only if your agent cannot generate keys externally.
arguments: { algorithm: "P-256" | "Ed25519" }
response: {
  private_key: string,      # base64 PEM — one-time display
  public_key: string,        # base64 PEM
  key_id: string,            # for revocation
  registered: boolean        # true if auto-registered with Hub
}

Security Considerations

• Private key is transmitted once over HTTPS
• Hub deletes key material immediately after response
• Agents should store the private key securely after receiving it
• Revocation available via revoke_key if key is compromised
• Compatible with VI credential layer for attestation

Status

• register_key MCP tool: exists (agent generates externally)
• generate_keypair: not implemented
• POST /keys/generate: not implemented

Labels: phase-4, key-bootstrap, infrastructure