A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live

I2134

A key removed from the trust list loses its links without a restart, and a node key can be rotated

Where it stands

devtask.issue

Readiness: complete completion is recorded and every required evidence token is present
Status: DONE
Can start: not now
Milestone: runtime-trust
Milestone status: ACTIVE
Wave: 0
Waiting on: none
Holds back: I2705
Behind it in all: 1
Evidence: 2 of 2

Moves

plan.transition

What it is

Objective: Re-read the trust declaration while the runtime runs, drop the links and admission of a de-listed key, offer a key rotation that peers can follow, and create the node key file private from its first byte.
Why: Trust is frozen at activation (apps/majordomus-cli/src/mesh/manager.rs:466,486, apps/majordomus-cli/src/mesh/cooperation.rs:1150): a key removed from trust.allow keeps its links until every peer restarts, and there is no rotate or revoke flow (threat T11). A compromised key therefore cannot be cut off without restarting every runtime. The node key file is written and then chmodded to 0600 (apps/majordomus-cli/src/mesh/identity.rs:338-347), so it exists for a moment at umask permissions. Reloaded events of a revoked key are I2124's (the journal reload applies the trust policy, milestone runtime-trust); this issue is the live half. Baseline audit of 2026-10-09 at master 1fb8d6be44, mesh gap 6 and the identity row.
Now: Revocation takes effect only on each peer's restart. Rotation does not exist. The key file is briefly readable at umask permissions.
Wanted: Cooperation holds its trust as a replaceable value; Cooperation::retrust puts a new one in force and ends the link of every peer it no longer trusts, and the server calls it with each new generation of the repository it reads, so a key withdrawn from trust.allow and committed loses its links without a restart: its next sync meets unknown_link and its hello is refused untrusted. The deferred part, rotating a node key and purging a withdrawn key's events from the running journal, is I2705.
Done when: unknown: the record declares no `completion`
Risk: unknown: the record declares no `risk`

Acceptance

Removing a key from trust.allow on a running runtime closes that key's links within one heartbeat and refuses its next hello, with no restart
Under a permissive umask the node key file is never readable by group or others

Validation: bin/majordomus plan validatecargo test --test mesh_cooperationcargo test --lib mesh::identity
Evidence required: revocation_without_restart_testkey_file_created_private_test
Evidence present: revocation_without_restart_testkey_file_created_private_test

Scope

Touches: apps/majordomus-cli/src/mesh/manager.rsapps/majordomus-cli/src/mesh/cooperation.rsapps/majordomus-cli/src/mesh/trust.rsapps/majordomus-cli/src/mesh/identity.rsapps/majordomus-cli/src/shared.rsapps/majordomus-cli/src/capability/builtin/mesh.rsapps/majordomus-cli/tests/mesh_cooperation.rsdocs/MESH.md
Not: unknown: the record declares no `non_scope`
Depends on: none
Priority: p0
Profile: implementation
Parallel safe: false
Owner: unknown: the record declares no `owner`

The work so far

Branches: none
Merged: none
Commits: 0
Trunk: master
Sessions: none
Created: 2026-10-09
Updated: 2026-10-14T23:33:07Z
Started: 2026-10-14T23:32:46Z
Verified: 2026-10-14T23:32:54Z
Completed: 2026-10-14T23:33:07Z

Synchronisation

Adapter: scripts/github-sync
Repository: unknown: the derived plan's header carries no repository
External issue: unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
State there: unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

Findings

Nothing is wrong with these records.