Module local_identity 

Who sits at this device, as far as undo attribution and history authors are concerned.

This is the toolkit’s one identity seam. The toolkit reads the person’s public identity only through the process’s LocalIdentitySource. The native implementation reads the runtime identity the launcher bound (TILO_USER_IDENTITY), then $XDG_CONFIG_HOME/tilo/identity/primary.json (feature local-daemons). A browser page installs one derived from its certified device (the relay peer’s DeviceCert names the user root) with install_source once certification completes; the device key itself stays in the page’s custody and signs through the relay client’s DeviceSigner, never through the toolkit. Without either there is no local identity, and callers fall back to their account-name ladders.

Structs

FixedIdentity

A fixed identity, for hosts that learn it once (a certified browser device) and tests.

LocalIdentity

The public half of the local person’s identity.

NoLocalIdentity

A source with no identity.

RuntimeIdentity

The runtime identity bound by the launcher, else the shell’s primary.json for its own unsandboxed in-process apps.

Traits

LocalIdentitySource

Resolves the local person’s identity. Not memoised by callers: a process hosting more than one identity must not be frozen into the first one.

Functions

bound

The identity bound to this process: the installed source, else the runtime identity the launcher bound (feature local-daemons), else none. Unlike load, never the shell’s own primary.json: for callers that fall back to an identity of their own when the launcher bound none.

generation

Changes whenever the host replaces or revokes this process’s identity.

install_source

Make source the identity of this process, or restore the default (the native runtime identity with local-daemons, else none) with None. Readers see the change on their next load.

load

The local identity from the installed source, else the native runtime identity (feature local-daemons), else none.