I3823 — The mesh client reaches an https endpoint over TLS and refuses cleartext to a public address

✓HOTOVO vlna 0 · p1 · profil implementation · bezpečné paralelně

Součást an-authorised-node-connects-from-anywhere — Autorizovaný uzel dosáhne jiného přes LAN, tailnet nebo NAT a řekne jak.

Cíl

mcp::bridge::request reaches an https:// rendezvous endpoint or seed over TLS with the certificate verified against the system roots; an http:// endpoint whose address is neither loopback, private nor overlay is refused with the correction; the mesh declaration accepts https:// endpoints and seeds by host name. ADR 0220 decision 1, the owner's 'TLS first' of 2026-10-21.

Proč

The owner chose TLS before any public hub. The client today strips http:// and writes to a bare TcpStream, so an https endpoint cannot work and a public http one would carry the journal in cleartext.

Aktuální stav

bridge::connect accepts only http:// and opens a TcpStream; config.rs validates seeds as http://host:port; case 491 refuses any hub outside the private and overlay ranges.

Cílový stav

An https endpoint completes a register round-trip over TLS against a local test server with a test certificate authority; a public http endpoint is refused before any byte is sent; case 3823 proves both and that a private http endpoint still works.

Rozsah

• apps/majordomus-cli/src/mcp/bridge.rs
• apps/majordomus-cli/src/mesh/config.rs
• apps/majordomus-cli/src/mesh/doctor.rs
• apps/majordomus-cli/src/mesh/link.rs
• apps/majordomus-cli/src/mesh/rendezvous.rs
• apps/majordomus-cli/Cargo.toml
• apps/majordomus-cli/Cargo.lock
• test/cases/3823_the_mesh_client_speaks_tls.sh
• docs/MESH.md
• docs/claims/mesh-cooperation-links.md
• scripts/ci/crate-boundary
• test/cases/360_the_crate_boundary_is_measured.sh
• .ai/repo/adrs/0032-an-external-workspace-is-not-a-provider-the-term-the-depende.md
• .ai/repo/ci/gates.yaml
• .ai/repo/project/issues/I3823.yaml

Závislosti

Žádné. Tento úkol je kořenem grafu.

Co na tom čeká

• I3827✕BLOCKED The hosted hub is this repository's default rendezvous, and every node shows it as the path from anywhere

Kritéria přijetí

• An https endpoint is reached over TLS with a verified certificate
• An unverifiable certificate is refused naming the endpoint
• A public http endpoint is refused before connecting; loopback, private and overlay http endpoints still work

Validace

• env -u MAJORDOMUS_SHARE -u MAJORDOMUS_HTTP_HOST -u MJ_ROOT bash test/run.sh 3823_the_mesh_client_speaks_tls

Požadované důkazy

• tls_endpoint_reached
• public_cleartext_refused

Důkazy

Časová osa

zahájeno

2026-10-23T16:33:16Z

ověřeno

—

dokončeno

2026-10-23T16:40:11Z

Tato tři pole, důkazy výše a stav závislostí jsou vše, z čeho se stav skládá. Neexistuje žádné pole stavu, které by s nimi mohlo být v rozporu.

Canonical record: .ai/repo/project/issues/I3823.yaml. Read it back with majordomus plan show I3823.