Node identity
Each node mints its own key over USB, in your hand. Physical possession is the root authority:
a device that cannot prove physical presence is refused enrollment outright. A cloud pairing PIN
is a weaker ownership claim and is never treated as liveness.
Reading provenance
Every reading is attributable to a device id, profile id, hardware id and firmware version recorded
at install and verified by mutual HMAC-SHA256 proof over an LFW1 nonce exchange. A node whose proof
did not verify is marked untrusted, not merely offline.
Install attestation
Completing an installation is a high-risk action. It requires your explicit browser approval, an
approval snapshot that still matches, an idempotency key, and heartbeats less than three minutes old.
There is no silent commissioning.
How enrollment works →