curl -sf -X POST https://gateway.flocks.local/v1/enroll \
  -H 'Content-Type: application/json' \
  -d @enroll.json

​
Request

{
  "join_token":         "<base64>",
  "node_public_key":    "ed25519:abc…",
  "address":            "100.64.0.7:7878",
  "role":               "roost",
  "capabilities":       ["claude", "codex", "shell"],
  "isolation_classes":  ["process"]
}

​
Response

{
  "receipt": {
    "node_id":          "ed25519:abc…",
    "role":             "roost",
    "capabilities":     ["claude", "codex", "shell"],
    "isolation_classes":["process"],
    "issued_at":        "2026-04-25T20:00:00Z",
    "signature":        "<base64>"
  },
  "gateway_verifying_key": "<hex>"
}
The roost stores the signed receipt and presents it on every dispatch.