Repository navigation
RTOP-377: store the hardware ID at install and advertise it on /api/hardware-id - #232
Merged
thiagoralves merged 3 commits intoOct 27, 2026
Conversation
Runtime licences bind to the machine they were bought for and must be recoverable after a reinstall, so the ID is derived only from fixed hardware: device-tree serial, DMI UUID and board serial, factory MACs of fixed wired NICs, and stable CPU fields. Plain bash so installers can embed it verbatim. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRWeC5FUhe5ZwEEbLUGpZ6
… /api/hardware-id Both installers write the record once into the runtime data directory, and a runtime installed before it existed computes it on start where it can see the host hardware. vPLCs never compute one; they advertise the record the orchestrator places in the container. Editors read it the same way on every target through the authenticated endpoint. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRWeC5FUhe5ZwEEbLUGpZ6
On x86 the DMI UUID and board serial are readable by root only, so an unprivileged run derives no ID. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRWeC5FUhe5ZwEEbLUGpZ6
thiagoralves
changed the base branch from
development
to
feature/RTOP-374-dual-licensing
October 27, 2026 20:37
thiagoralves
marked this pull request as ready for review
October 27, 2026 20:47
thiagoralves
merged commit Oct 27, 2026
237018d
into
feature/RTOP-374-dual-licensing
3 of 5 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardware ID v2: a stable ID for the physical machine a runtime licence is bound to, so a licence can be recovered after a wipe or reinstall. Nothing is enforced on the device.
scripts/hardware-id.sh: the canonical bash reader (no new dependencies).hw2:+ SHA-256 over per-element hashes (device-tree serial, DMI UUID and board serial with placeholder rejection, factory wired NIC MACs, stable CPU fields). No software state; NICs ignored in VMs; WSL2 and Docker Desktop refused. Frozen at v2. Spec and test vectors indocs/HARDWARE_ID.md.install.sh --nativeandscripts/install-docker.shstore the record in the persistent data directory and never replace one./etc/openplc-runtime/hardware-id.GET /api/hardware-id(any authenticated user) advertises the ID, its source (deviceororchestrator) and the element hashes.The agent and autonomy-node embed this reader and compare against
main, so this release must ship first.Ticket
RTOP-377 — https://autonomylogic.atlassian.net/browse/RTOP-377
How it was tested
--storeunderset -euo pipefail), Docker installer block parity, endpoint (401, record, non-admin user, no ID, injected record wins,ensure_storedrules). shellcheck on the reader.hw2:68e4b276…a043c0; recomputed after deletion; not rewritten on restart; vPLC-style container computes nothing and advertises the injected record; endpoint 401 without a token.hw2:0a09e3a3…d544, matching an independent Python computation.orchestrator.Checklist
bash scripts/run-pytest.shpasses (ran the hardware ID and endpoint suites only)pre-commit runclean.claude/review-guidelines.md)Contributor License Agreement
🤖 Generated with Claude Code
https://claude.ai/code/session_01MRWeC5FUhe5ZwEEbLUGpZ6