ONE Utilities — signed agent telemetry protocol v0.1
ENGINEERING REFERENCE, NOT A CONTINUOUS OR APPROVED PRODUCTION AGENT

Prerequisites:
- An administrator-activated ONE Accounts organization
- A device already enrolled under ONE Devices with an Ed25519 public key
- A registered inventory asset within the SAME organization
- Explicit approval in ONE Utilities Manager Console pairing that asset
  with the enrolled device
- A corresponding existing private Ed25519 key residing ONLY on an
  authorized, protected device (never on the public VPS)

The included Python reference sender signs a narrow JSON observation using
the enrolled device key. It does not read a printer, contact a switch, read
ink levels, discover a network or post anything automatically. The default
is DRY RUN: nothing is transmitted. --send must be given explicitly.

Example dry run on an authorized engineering workstation:
  python one_utilities_sign_report.py --private-key-file private-device.pem --asset-id <your-asset-id> --status warning --jobs 4 --issue queue_warning

After pairing and review, a single intentional request:
  python one_utilities_sign_report.py --private-key-file private-device.pem --asset-id <your-asset-id> --status warning --jobs 4 --issue queue_warning --send

Requirements: Python 3.9+ and cryptography. Do not move private keys to the
VPS, bypass OS security controls, or perform a live rollout before
independent device-level acceptance. The server verifies signature,
pairing, tenant membership, 5-minute freshness and one-time nonce.
It does not verify that the printer provided the data. Toner is not
available in this schema. Data is marked signed_agent and becomes
unverified if older than 5 minutes or once the pairing is revoked.
Accepted reports must be at least 10 seconds apart.

Scheduled polling, SNMPv3, IPP, equipment remediation, unattended print
jobs, AI analysis and notification delivery are NOT included.
The sender uses one pinned HTTPS endpoint only and has no setting for
an arbitrary URL. Never share an API signing key or print its contents.
