I2135

What it is

Objective

Let a working tree narrow the mesh's trust and never widen it: obey the working tree's declaration with every widening of the trunk's committed copy removed, report each ignored line, and refuse a committed declaration that trusts on first use.

Why

The server reads .ai/repo/mesh/ from the checkout's working tree once at start (apps/majordomus-cli/src/shared.rs:34-48,164-174). A branch, or an uncommitted edit, can add a key to trust.allow, add seeds or rendezvous.endpoints that make the runtime post its card and envelope to a host of the branch author's choosing, or set policy tofu, and that checkout's runtime obeys it (threat T12); peers judge by their own file, so the damage is local to that checkout, which is the one a reviewer runs a contributor's branch in. docs/MESH.md:365,382-399 and ADR 0050 rule 6 say the declaration is committed; ADR 0059 records this class of incident. No CI gate refuses a committed tofu declaration (enforcement table, 'no unknown remote auto-trust': unit tests only, apps/majordomus-cli/src/mesh/trust.rs:25-35, apps/majordomus-cli/src/mesh/config.rs:397). Baseline audit of 2026-10-09 at master 1fb8d6be44, mesh gap 10 and drift 12.

Now

Delivered by 4816d7c8ad and 11472da40d: mesh::root::resolve narrows the working tree's declaration to the trunk's committed copy (the trunk is the local branch the repository names as its trunk; a stale local trunk is older trust, the safe direction), every reader asks it, mesh doctor names each ignored line, and scripts/ci/mesh-check refuses a committed tofu, which case 301 now drives.

Wanted

mesh::root::resolve holds the working tree's declaration against the trunk's committed copy: enabled only if both are, a policy no looser than the trunk's, keys, endpoints, seeds and networks only as the trunk lists them (loopback endpoints and seeds admitted); with no trunk copy, tofu is refused. Every reader of the declaration asks it. mesh doctor's trust-root check names every ignored line; mesh-check refuses a committed tofu. Reading only the trunk was rejected: it broke loopback-worktree discovery and every fixture that declares a mesh, for no security gain over narrowing.

Done when

unknown: the record declares no `completion`

Risk

unknown: the record declares no `risk`

Acceptance

Scope

Touches

apps/majordomus-cli/src/shared.rsapps/majordomus-cli/src/mesh/config.rsapps/majordomus-cli/src/mesh/doctor.rsscripts/ci/mesh-checkapps/majordomus-cli/src/mesh/root.rsapps/majordomus-cli/src/capability/builtin/mesh.rsapps/majordomus-cli/tests/mesh.rsapps/majordomus-cli/tests/mesh_trust_root.rstest/casesdocs/MESH.md

Not

unknown: the record declares no `non_scope`

Depends on

none

Priority

p0

Profile

implementation

Parallel safe

false

Owner

unknown: the record declares no `owner`

The work so far

Synchronisation

Adapter

scripts/github-sync

Repository

unknown: the derived plan's header carries no repository

External issue

unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

State there

unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

Findings

Nothing is wrong with these records.