Solverify Kernel Registry token auth

Build and persona registry for the Solverify node fleet. Nodes install vendored browser kernels and mint per-launch fingerprints from this service — a node only ever needs to reach this host.

Authentication

Every /v1/* call must send Authorization: Bearer <token>. /healthz is always open for health checkers.

curl -H "Authorization: Bearer <token>" "kernelserver.theyka.net/v1/kernel?type=chrome&kernel=154&system=x64"

Endpoints

Route	Description
`GET /healthz`	Liveness and registry status.
`GET /v1/kernel?type=chrome&kernel=154&system=x64[&refresh=1]`	One build descriptor. Served from cache; `refresh=1` forces a re-query.
`GET /v1/manifest?spec=chrome:140-154,firefox:144,147,150,153&system=x64[&refresh=1]`	Bulk lookup used by node installs; returns `{ kernels, missing }`.
`GET /v1/download?type=…&kernel=…&system=…`	Streams the kernel zip. Supports `Range` / resume and adds `X-Kernel-*` metadata headers.
`POST /v1/refresh?spec=…`	Forces a re-query of a kernel set.
`GET /v1/personas/manifest`	Persona inventory: per-family counts, kernel list, per-OS breakdown.
`POST /v1/personas/mint`	One persona for a browser launch (body: `{ family, count?, kernels?, os? }`).

system is one of x64 / x86 (Windows), mac / arm64 (macOS), linux_x64 (Linux). It defaults to this service's own platform.

Build descriptor

{
  "type": "chrome", "kernel": "154", "system": "x64",
  "version": "20261009", "name": "kernel-chrome-154-20261009.zip",
  "md5": "E1B6518DF54ACA807A9C644D165131BD",
  "size": "240.53MB", "sizeBytes": 252213985,
  "url": "kernelserver.theyka.net/v1/download?type=chrome&kernel=154&system=x64"
}

Personas (per-launch fingerprints)

The node engine asks for one persona at browser launch and drops it when the browser closes — nothing is stored on the node. Pools live on this host under personas/ (fingerprints-chrome.jsonl, fingerprints-firefox.jsonl; built by the Node project's harvest pipeline). Each record is served at most once per cycle, so the fleet walks the whole pool before any persona repeats.

Route	Description
`GET /v1/personas/manifest`	Per-family record counts, kernel list and per-OS breakdown. Node installs plan their kernel set from it.
`POST /v1/personas/mint`	Body `{ "family": "chrome", "kernels": ["153","154"], "os": "windows" }` → `{ records: [ … ] }`. Errors: `404` no pool, `409` no match.

curl -X POST -H "Authorization: Bearer <token>" -H "content-type: application/json" \
  -d '{"family":"chrome","kernels":["153","154"]}' kernelserver.theyka.net/v1/personas/mint

Node side: SOLVERIFY_PERSONA_SOURCE=server mints per launch (defaults to SOLVERIFY_KERNEL_API / SOLVERIFY_KERNEL_API_TOKEN). With local (default), nodes read the JSONL pools themselves.

Node usage

$env:SOLVERIFY_KERNEL_API = "kernelserver.theyka.net"
$env:SOLVERIFY_KERNEL_API_TOKEN = "<token>"   # only when token auth is enabled
npm run kernel-install

The worker runs the same installer automatically before its browser pool starts; fully installed machines skip it without any network call.