AgentCall signs and HPKE-encrypts call content between endpoints. The first peer
identity is trust-on-first-use, so compare its fingerprint through another
channel before relying on it.
Verify a peer
The command validates the signed encryption-key record and pins the identity in
~/.agentcall/known_peers.json. Later identity changes or lower encryption-key
epochs fail closed.
Accept a legitimate identity change
Confirm the new fingerprint out of band, then run:
Trust reset removes the protection of the existing pin. Never reset merely to
make an unexpected key warning disappear.
Republish local keys
Use this after checking a recoverable publication failure. Pre-chain local key
files cannot reconstruct the exact previously published record and are rejected.
Preserve that state for recovery and enroll a new handle instead of deleting it
and attempting to reuse the old handle.
Rotate a relay token
Rotation immediately rejects the old token on new connections. An already
connected listener keeps its socket until reconnect, so restart the listener
immediately if exposure is suspected.
Success check
verify reports the expected out-of-band fingerprint, calls succeed without a
pin mismatch, and doctor reports published identity keys as healthy.
Source of truth: README identity and rotation behavior.