I3837 — A case that enables the mesh declares its tailnet provider off, so it stays hermetic on a machine that runs Tailscale

✕BLOKOVÁNO vlna 1 · p2 · profil implementation · bezpečné paralelně

Součást the-mesh-works-out-of-the-box — Mesh funguje ihned po instalaci: důvěryhodné stroje se najdou všemi způsoby a jejich relace spolupracují od prvního tahu.

Cíl

Give every shell case that writes an enabled mesh declaration with its other discovery providers off a `tailscale: enabled: false` beside `multicast: enabled: false`, and add a structure check that refuses a new case whose enabled declaration leaves the tailnet provider on unless the case says it tests the tailnet.

Proč

I2410 makes the tailnet a discovery provider, on by default. A fixture that switched multicast off to stay hermetic then still asks the real tailnet on any machine whose PATH has the Tailscale CLI: on macbook-2 on 2026-10-21 health_server's mesh-dimension tests saw 2 real nodes where they assert none (fixed for the Rust fixtures inside I2410). Eighteen shell cases have the same exposure and pass only because CI's runners have no Tailscale: 130, 301, 495, 821, 827, 993, 1023, 1050, 1051, 1052, 1053, 1054, 3051, 3066, 3067, 3068, 3069, 3151.

Aktuální stav

Those cases write `multicast:\\n enabled: false` and no `tailscale:` key into .ai/repo/mesh/majordomus.yaml of their fixture; nothing checks that a case's declaration is hermetic.

Cílový stav

Every case's enabled declaration names the tailnet provider; a case that leaves it on says why, and a check refuses one that does not.

Rozsah

• test/cases
• scripts/ci

Mimo rozsah

• The Rust test fixtures (done in I2410)
• Changing the provider's production default

Závislosti

• I2410○PŘIPRAVENO Důvěryhodný stroj na tailnetu se najde přes Tailscale, bez ručně zapsané adresy

Kritéria přijetí

• Each of the eighteen cases declares `tailscale: enabled: false` and passes on a machine with the Tailscale CLI on PATH, named in the evidence
• A fixture case whose enabled declaration omits the tailnet key is refused by the check, and one that declares it, or says it tests the tailnet, is admitted

Validace

• bash test/run.sh 3847_a_case_that_enables_the_mesh_declares_its_tailnet_off
• bin/majordomus plan validate

Požadované důkazy

• every_mesh_case_is_hermetic_test

Důkazy

Nic nezaznamenáno. Za každým tokenem výše musí stát příkaz nebo artefakt, než lze tento úkol dokončit; vyprávění se odmítá.

Časová osa

zahájeno

—

ověřeno

—

dokončeno

—

Tato tři pole, důkazy výše a stav závislostí jsou vše, z čeho se stav skládá. Neexistuje žádné pole stavu, které by s nimi mohlo být v rozporu.

Canonical record: .ai/repo/project/issues/I3837.yaml. Read it back with majordomus plan show I3837.