muster

Every device here can prove it belongs.

Device enrollment and identity for one household. A device makes its own key, you authorize one enrollment, and it carries a short-lived certificate that renews itself. The certificate is the membership — nothing to toggle, nothing to drift.

quadseven/muster how it works

Keys never move

Devices generate their own and send only a signing request. muster holds none of them.

One human decision

Six digits read off two screens, or a provisioning QR nobody has to touch.

Expiry, not a flag

Lapsing is the default end state. Revoking is a decision, refused on the next request.

Fine with muster down

Enrollment may need the internet. Operation must not: enroll at home, work anywhere.

the roster cert expires

pixel-8 · ada issued 23d

unifi-udm-pro issued 19d

mbp-14 · workshop renewing 4h

hue-bridge · hall issued 27d

ipad-mini · guest lapsed —

old-nas · attic revoked —

the happy path

mint/ present/ vouch/ issue/ renew

Early. The enrollment exchange is implemented and tested; the Android agent comes first.