A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live
I2132
A hello names the runtime it is meant for, and no other runtime accepts it
Where it stands
devtask.issue- Readiness
- ready no dependency and no gate holds it; nobody has started it
- Status
- READY
- Can start
- startable
- Milestone
- Milestone status
- ACTIVE
- Wave
0- Waiting on
- none
- Holds back
- Behind it in all
1- Evidence
0of1
Moves
plan.transitionWhat it is
- Objective
- Bind each link hello to its intended recipient inside the signed bytes, refuse a hello addressed elsewhere, and make the documented check order the one the code runs.
- Why
- Hello (apps/majordomus-cli/src/mesh/link.rs:444-456) names no audience. The nonce cache that refuses a replay is per answerer, held in memory and checked after trust (apps/majordomus-cli/src/mesh/cooperation.rs:1847-1875), so a captured hello replays to another runtime of the same repository, or to the same runtime after a restart, within the 300 s skew window (threat T6). The effect is a displaced inbound link and a false 'connected' for the real peer (apps/majordomus-cli/src/mesh/cooperation.rs:1918-1934); the replayer cannot sync. docs/MESH.md:128-136 and item 1 of rule project.mesh-cooperation-is-authenticated put the nonce check before protocol, self, repository and trust; the code checks it last on purpose, so strangers cannot fill the cache, while the blocking rule says 'verify, in order'. Baseline audit of 2026-10-09 at master 1fb8d6be44, mesh gap 9 and drift 1.
- Now
- A valid hello is accepted by any runtime of the repository that trusts its key and has not seen its nonce.
- Wanted
- Hello carries an optional to (the runtime key it means to reach) inside its signed bytes; the dialer fills it whenever it knows the key (a registry target, or a runtime it linked before); accept_hello refuses a hello addressed elsewhere as misaddressed, before the replay cache sees its nonce; a hello without to is still admitted (seeds, first contacts, releases before this one), so the link protocol version is unchanged and a mixed fleet keeps linking. docs/MESH.md states the order the code checks in and why the nonce cache is last. The deferred part, bringing rule project.mesh-cooperation-is-authenticated to the code's check order, is I2703.
- Done when
- unknown: the record declares no `completion`
- Risk
- unknown: the record declares no `risk`
Acceptance
- A hello captured from a link to runtime A and replayed to runtime B within the skew window is refused with a typed refusal and changes no link of B
- A hello replayed to A after A restarts cannot displace an established link
- Validation
bin/majordomus plan validatecargo test --test mesh_cooperationcargo test --lib mesh::cooperation- Evidence required
hello_replay_to_another_runtime_refused_test- Evidence present
- unknown: the record carries no `evidence` entries
Scope
- Touches
apps/majordomus-cli/src/mesh/link.rsapps/majordomus-cli/src/mesh/cooperation.rsapps/majordomus-cli/tests/mesh_cooperation.rsdocs/MESH.md.ai/repo/rules/project/mesh-cooperation-is-authenticated.v1.md- Not
- unknown: the record declares no `non_scope`
- Depends on
- none
- Priority
- p1
- Profile
- implementation
- Parallel safe
- false
- Owner
- unknown: the record declares no `owner`
The work so far
- Branches
- none
- Merged
- none
- Commits
0- Trunk
- master
- Sessions
- none
- Created
- 2026-10-09
- Updated
- 2026-10-14
- Started
- unknown: the record declares no `started_at`
- Verified
- unknown: the record declares no `verified_at`
- Completed
- unknown: the record declares no `completed_at`
Synchronisation
- Adapter
scripts/github-sync- Repository
- unknown: the derived plan's header carries no repository
- External issue
- unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
- State there
- unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
Findings
| Level | Code | Message | Reproduce |
|---|---|---|---|
| WARN | scope_conflict | shares docs/MESH.md with I2140; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | shares apps/majordomus-cli/src/mesh/link.rs with I2410; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | shares docs/MESH.md with I2411; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | shares docs/MESH.md with I2412; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | shares docs/MESH.md with I2413; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | shares apps/majordomus-cli/tests/mesh_cooperation.rs with I2414; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | shares apps/majordomus-cli/src/mesh/cooperation.rs with I2415; they may not run concurrently | majordomus plan validate |
| WARN | scope_conflict | shares apps/majordomus-cli/src/mesh/link.rs with I2723; they may not run concurrently | majordomus plan validate |