Reserve generation suffix for child key derivation

[crossagent-production-app]

Fixes https://github.com/litentry/agentKeys/issues/8\n\nSummary:\n- Adds generation-aware HDKD helpers that derive logical agent keys at /, with initial pairing fixed at generation 0.\n- Updates broker pairing claim/poll so child omni derivation and J1_agent derivation_path use //label/0 while storing the base label as the logical agent identity.\n- Documents the reserved /0, /1, /2 convention for future rotation without base-path recycling.\n\nVerification:\n- cargo fmt --check\n- cargo test -p agentkeys-core actor_omni\n- cargo test -p agentkeys-broker-server --test agent_bootstrap_flow full_request_claim_poll_pending_flow\n- cargo test -p agentkeys-broker-server --test agent_bootstrap_flow\n\n\nChange:\n- Initial child pairing now derives at //label/0 via generation-aware helpers, reserving /1, /2, ... for future same-agent rotation.\n- Broker poll exposes derivation_path //label/0 in the J1_agent response/JWT.\n- Architecture docs describe generation suffix semantics and keep base-label recycling disabled.\nObjective Evidence:\n- cargo fmt --check: passed\n- cargo test -p agentkeys-core actor_omni: passed (15 tests passed; includes generation suffix and rotation separation cases)\n- cargo test -p agentkeys-broker-server --test agent_bootstrap_flow full_request_claim_poll_pending_flow: passed\n- cargo test -p agentkeys-broker-server --test agent_bootstrap_flow: passed (5 tests passed)\nVisual Evidence:\n- n.a.\nReviewer:\n- Repo Intake Reviewer\nRisks / Not Covered:\n- No UI/browser behavior was changed, so screenshot evidence is not applicable.\n- Full rotation flow and on-chain current_generation storage are documented/reserved but not implemented in this smallest safe change.\n

[crossagent-production-app]

Delivery Evidence Summary

Change:

• Initial child pairing now derives at //label/0 via generation-aware helpers, reserving /1, /2, ... for future same-agent rotation.
• Broker poll exposes derivation_path //label/0 in the J1_agent response/JWT.
• Architecture docs describe generation suffix semantics and keep base-label recycling disabled.

Objective Evidence:

• cargo fmt --check exit code 0, passed: Rust formatting check passed.
• cargo test -p agentkeys-core actor_omni exit code 0, passed: 15 tests passed, including generation suffix, rotation separation, and base-label validation cases.
• cargo test -p agentkeys-broker-server --test agent_bootstrap_flow full_request_claim_poll_pending_flow exit code 0, passed: Pairing flow passed with claim recomputing child omni at generation 0 and poll/JWT exposing //agent-a/0.
• cargo test -p agentkeys-broker-server --test agent_bootstrap_flow exit code 0, passed: 5 agent bootstrap tests passed.

Visual Evidence:

• n.a.

Reviewer:

• Repo Intake Reviewer

Risks / Not Covered:

• No UI/browser behavior was changed, so screenshot evidence is not applicable.
• Full rotation flow and on-chain current_generation storage are documented/reserved but not implemented in this smallest safe change.

Generated at: 2026-06-04T12:38:21.796Z