cryptoRandom

A kotlin.random.Random backed by a cryptographically secure source (KotlinCrypto CryptoRand, multiplatform).

This is the source to use in production when minting a LogTapJoinToken or when supplying the nonce source to us.tractat.kuilt.otel.tap.LogTapAdmission.Verify. The join code is the only secret in the admission scheme, so it must be drawn from a CSPRNG — never Random.Default or a seeded Random, which are predictable. The Random parameters on those APIs are injectable only so tests can supply a seeded, deterministic source.

val secure = cryptoRandom()
val token = LogTapJoinToken.issue(secure, Clock.System)
installLogTap(loom, exporter, scope, admission = LogTapAdmission.Verify(token, Clock.System, secure))