NodeID
DVeProto NodeIdentity uses an Ed25519 keypair. A display NodeID is derived from the public key and DVeMesh formats it as dve_ followed by hexadecimal public-key bytes. Control maps this identity to an enrolled device, network, and overlay address.
Enrollment
Control enrollment uses a one-time network-bound token and a challenge proof of possession. The agent keeps the private identity key locally and submits public identity material. Device credentials are separate from the private key and support rotation/revocation.
Storage
DVeMesh stores identity and credentials under its persistent state directory, typically ~/.dvemesh/ for a user daemon or /var/lib/dvemesh for a system installation. The Installer separates persistent state from replaceable runtime files and must preserve identity during routine repair or upgrade.
Eryon registry
Eryon Core also has a local node registry for configured records and names. Its node IDs are opaque references and are not generated private-key identities, remote authentication, or network authorization. The daemon remains authoritative for Control-managed peers.
Recovery
Protect private identity files and credential backups with host access controls. A lost identity requires explicit re-enrollment or a Control-approved recovery; routine installer repair must not silently regenerate it.