§ NEW · 20-Node Identity Verification Guide

Identity fabric verification — all 20 nodes

A complete, test-by-test verification guide for the @dosfi.ai Secure Identity Fabric across all five systems and all 20 mesh nodes. Run every test before permitting production traffic. All tests must pass.

Identity verification progress

0 passed 0 failed 16 pending

V.1

Identity creation & propagation tests (F.2–F.3)

Verify that a single identity creation event propagates correctly to all five systems and that the resulting OIDC token contains the complete claim set.

V.2

Identity verification & cryptographic hardening tests (F.4)

Verify that every node presents valid cryptographic credentials and that the Coordinator verifies them on every connection.

V.3

Identity revocation & recovery tests (F.5–F.6)

Verify that revocation propagates within the 5-second SLO and cascades correctly to downstream systems.

Recovery test procedure (manual)

bash

# 1. Create a scratch identity for testing
meshinfer-dev create-test-identity --label recovery-test-001

# 2. Register one test node under this identity
meshinfer-node register --identity recovery-test-001 --platform linux

# 3. Trigger recovery flow at identity.dosfi.ai/recover
#    (use the scratch identity email)
#    Select: "Recover + revoke all devices"

# 4. Verify: test node is suspended within 1 min (safety window)
meshinfer-node status --node-id <test_node_id>
# Expected: { "status": "suspended", "reason": "post_recovery_safety_window" }

# 5. Verify: 1h later, node auto-resumes (no anomaly detected)
# 6. Clean up: decommission test node + delete test identity

V.4

Privacy tier enforcement tests (F.7)

Verify that privacy tiers are enforced at all three layers: SDK, Gateway, and node daemon. These tests must run against a real SDK integration — not mocked.

Privacy tier verification — all 20 nodes

bash

# Verify privacy_tier configured correctly on all 20 nodes:
meshinfer-fleet verify-privacy-tiers   --org org_mesh20_prod   --api-key msk_live_...

# Expected output per node:
# node-d01: privacy_tier=mesh_ok   ✓
# node-d02: privacy_tier=mesh_ok   ✓
# node-m01: privacy_tier=local_only ✓   (mobile nodes: local_only recommended)
# node-m02: privacy_tier=local_only ✓
# node-s01: privacy_tier=cloud_ok  ✓   (server tier: cloud relay opt-in)
# ...

# For any node with incorrect privacy_tier:
meshinfer-node config set privacy_tier=<correct_value>   --node-id <node_id>

Mobile node privacy default

Mobile nodes (node-m01–m04) must be configured with privacy_tier: local_only by default. This is a structural safety measure — mobile devices process personal data and must never serve inference tasks from other organizations unless explicitly opted in by the device owner with informed consent.

V.5

Identity-bound metering & DIU economics tests (F.8)

Verify that every metering event, DIU spend, DIU issuance, and settlement record carries the correct identity chain. These tests confirm the economic layer is cryptographically attributed to real identities.

V.6

Settlement identity log tests (F.9)

Verify that the MeshNativeExchange settlement record is complete for all 20 nodes and carries the full identity chain from the Coordinator metering events.

Settlement identity audit query

bash

# Retrieve last settlement record and verify identity completeness:
curl -s "https://coordinator.meshinfer.ai/v1/admin/settlements/latest"   -H "Authorization: Bearer msk_live_..."   | jq '.node_settlements[] | {
      node_id,
      owner_user_id: .owner_user_id,
      diu_wallet,
      tasks_served,
      diu_net,
      status
    }'

# All 20 records must have non-null owner_user_id.
# All 20 diu_wallet values must match the registered wallet for that NodeID.

V.7

Agent & enterprise identity tests (F.10–F.11)

Verify agent identity inheritance and enterprise org boundary enforcement.

Cross-org boundary enforcement test

bash

# Test that org boundary blocks cross-org task dispatch:
# 1. Register one node under org_a
# 2. Submit inference request from org_b with route forced to that node
# Expected: 403 privacy_policy_violation from Gateway

curl -s -X POST "https://coordinator.meshinfer.ai/v1/infer"   -H "Authorization: Bearer <org_b_token>"   -d '{
    "model": "llama-3.2-3b-q4",
    "prompt": "test",
    "routing_override": { "node_id": "<org_a_node_id>" }
  }'

# Expected response:
# { "error": "privacy_policy_violation",
#   "detail": "node belongs to a different org; cross-org dispatch blocked" }

V.8

Automated identity verification script

The fleet identity verification script runs all automated tests (V.1–V.7 where automatable) and emits a signed verification report for SOC 2 evidence.

bash

# Run full automated identity verification against 20-node mesh:
meshinfer-fleet verify-identity   --org org_mesh20_prod   --api-key msk_live_...   --node-count 20   --test-suite full   --output identity_verification_report_$(date +%Y%m%d).json

# Tests run automatically:
#  ✓ OIDC token claim completeness (all 20 nodes)
#  ✓ Heartbeat signature verification (all 20 nodes)
#  ✓ mTLS DeviceCert validity (all 20 nodes)
#  ✓ Privacy tier configuration (all 20 nodes)
#  ✓ Metering event identity chain completeness (100 test tasks)
#  ✓ DIU spend attribution accuracy (Σ spend vs wallet delta)
#  ✓ DIU issuance attribution accuracy (settlement record vs wallet credit)
#  ✓ Sybil prevention gate (attempt > 50 NodeIDs per UserID)

# Tests requiring manual execution:
#  → v7: Revocation propagation timing (requires scratch identity)
#  → v8: SDK local_only structural enforcement
#  → v9: Gateway mesh_ok cloud block
#  → v16: Agent tier inheritance

# Submit report to AuditLog:
meshinfer-fleet submit-verification-report   --report identity_verification_report_$(date +%Y%m%d).json   --operator "ops-lead@your-org.com"

V.9

Failure remediation quick reference

Failure symptom	Root cause	Remediation command / action
identity not found in downstream system	Identity propagation event dropped	Replay event: `meshinfer-admin replay-user-created --user-id <id>`
signature_verified: false on heartbeat	DeviceCert expired or keypair mismatch	`meshinfer-node auth --reissue-cert --node-id <id>`
mTLS handshake fails	DeviceCert expired (24h TTL)	`meshinfer-node auth --renew-cert`
privacy_policy_violation on local_only request	Expected behavior — not a bug	Verify local runtime is available. Check: `meshinfer-node probe --local-only`
privacy_policy_violation on mesh request not expected	SDK or Gateway enforcement triggered	Check privacy_policy claim in token: `meshinfer-node token decode`
null identity fields in metering event	Identity not bound before metering	Re-run task with fresh authenticated session. Verify token is not expired.
DIU wallet delta mismatch	Spend event attributed to wrong wallet	Query AuditLog: resource_type=inference_charge, time window → find misattributed event.
Revocation does not cascade within 5 s	Event bus connectivity issue	Check NATS connectivity between Identity Service and Coordinator. View: /v1/admin/events/health
> 50 NodeIDs accepted per UserID	Sybil prevention gate misconfigured	Escalate to platform security immediately. Do not operate further until fixed.
Cross-org task dispatch not blocked	Gateway org boundary enforcement bypassed	Escalate to platform security immediately. Pull affected nodes from routing pool.

← Identity Architecture Node Connection Guide Readiness Checklist Security & Cryptography