# Object-capability mesh and forensic record-replay

> On main since rc2: Object-capability mesh and forensic record-replay.

Source: https://kern-lang.eu/releases/object-capability-mesh-and-record-replay

On main since rc2

## Release notes

A Kern service's identity on the network is now the SHA-256 of its own reproducible binary: `kern_attest_self_hash()` measures the running executable, so peers recognise a service by a hash they can rebuild themselves, with no certificate authority. Ed25519-signed challenges prove liveness, capability tokens carry what a caller may ask, the compiler injects a per-call guard on RPC serve, and the server attests back in an `X-Kern-Server-Attest` header. The mesh is bidirectional: the token proves who is calling and what they may ask, the attestation proves which build is answering.

Unset config means disabled, fully backward compatible. Forensic record-replay welds nondeterminism to the audit chain: `KERN_RECORD` captures every clock read and random draw to a SHA-256-chained trace, `KERN_REPLAY` re-executes the incident run with byte-identical inputs, and `kern_replay_verify()` detects a trace edited after the fact. Built for DORA/NIS2 incident reconstruction, and a debugging tool for the heisenbug class.