A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live

I2123

A caller beyond loopback reads, and changes nothing it cannot authenticate

Where it stands

Readiness: complete completion is recorded and every required evidence token is present
Status: DONE
Can start: not now
Milestone: runtime-trust
Milestone status: ACTIVE
Wave: 0
Waiting on: none
Holds back: none
Behind it in all: 0
Evidence: 2 of 2

Objective: Refuse every capability that changes something to a request from an address that is not loopback, unless the capability's input is a signed message its handler verifies, on the HTTP routes and on MCP over HTTP alike.
Why: On 2026-10-09 the hub on 8791 and two servers of the primary checkout listened on every interface of the owner's machine, and the only guard on a state-changing request was the Origin check, which a program passes by sending none. Any host on the LAN or tailnet could transition a plan record, run any capability through executions.start, or post a mesh claim the node then signed with its own trusted key and replicated to every runtime.
Now: A remote request is admitted by any route whose browser Origin check it passes; the bind warning says a remote host can only read.
Wanted: ExecutionPolicy::admits_remote decides it once from the declared effect and the declared signed input; the router and the MCP endpoint refuse with forbidden/403 per request; mesh.link.hello, mesh.link.sync and mesh.register stay reachable because they authenticate their input.
Done when: unknown: the record declares no `completion`
Risk: unknown: the record declares no `risk`

Every HTTP route of a capability that does not admit a remote caller answers 403 forbidden to a request from a non-loopback address, before its handler runs
A remote MCP message calling a tool that changes something is refused with error code forbidden, and the same session's next message from loopback is not
A real server bound to 0.0.0.0 refuses plan/transition, executions/start, mesh/claims, mesh/handovers/consume and peers/announce from this machine's LAN address and still answers a read
The three signed mesh capabilities reach their handlers from a remote address
executions.start declares repository_mutation, so a local client is told it can write before it runs a writer through it

Validation: cargo test --test remote_callersMAJORDOMUS_BIN=<branch build> bash test/run.sh 1086_a_remote_caller_cannot_write
Evidence required: remote_callers_testscase_1022_red_on_0_18_0_green_on_branch
Evidence present: remote_callers_testscase_1022_red_on_0_18_0_green_on_branch

Touches: apps/majordomus-cli/src/capability/builtin/executions.rsapps/majordomus-cli/src/capability/builtin/mesh.rsapps/majordomus-cli/src/capability/builtin/mod.rsapps/majordomus-cli/src/capability/handler.rsapps/majordomus-cli/src/capability/model.rsapps/majordomus-cli/src/capability/registry.rsapps/majordomus-cli/src/httpapps/majordomus-cli/src/mcpapps/majordomus-cli/src/execution/engine.rsapps/majordomus-cli/tests/remote_callers.rstest/cases/1086_a_remote_caller_cannot_write.shdocs/MCP.mddocs/MESH.md
Not: unknown: the record declares no `non_scope`
Depends on: unknown: the record declares no `depends_on`
Priority: p0
Profile: implementation
Parallel safe: true
Owner: unknown: the record declares no `owner`

Adapter: scripts/github-sync
Repository: unknown: the derived plan's header carries no repository
External issue: unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
State there: unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

Nothing is wrong with these records.