At this level
com.fedproxy · 2- com.fedproxy.rbac record RBAC policy record granting a requester the ability to register SSH public keys under a specific fedproxy service tunnel. Roles define OIDC token claims that authorize the holder; policies define JSON Schema constraints on com.atproto.repo.createRecord for com.fedproxy.sshPublicKey records.
- com.fedproxy.sshPublicKey record SSH public key registration record for fedproxy tunnel authentication. Associates an SSH public key with a fedproxy service name so the tunnel can verify connecting clients.
- com.fedproxy.temp.xrpc.getRegistrationNonce procedure Request a one-time registration nonce from the relay before subscribing. The caller presents its did:key and badge.blue attestations (network.attested.signature) over its own key material; the relay replies with a crypto-secure random nonce and its own attestations over that nonce. The subscriber then signs the returned nonce and presents the resulting com.fedproxy.temp.xrpc.registration record as the parameter to com.fedproxy.temp.xrpc.subscribe, proving liveness and key custody and binding the
- com.fedproxy.temp.xrpc.registration record A subscriber's signed registration. Proves custody of the did:key by carrying badge.blue attestations (network.attested.signature) over the nonce returned from com.fedproxy.temp.xrpc.getRegistrationNonce. Presented as the parameter to com.fedproxy.temp.xrpc.subscribe to open a relay channel bound to this key.
- com.fedproxy.temp.xrpc.subscribe subscription Open a relay channel. The subscriber presents a com.fedproxy.temp.xrpc.registration: a record signed (network.attested.signature) over the nonce previously issued by com.fedproxy.temp.xrpc.getRegistrationNonce. The relay verifies the registration's signatures against the issued nonce and the did:key, then binds the WebSocket to that key. On connect the relay sends a #registered frame with the assigned serviceId/proxyRef; subsequent #request frames carry inbound XRPC calls the subscriber answers