an-authorised-node-connects-from-anywhere — An authorised node reaches another across LAN, tailnet or NAT, and says how

✕BLOCKED 0 of 1 issues done

ready

0

blocked

1

active

0

verify

0

done

0

cancelled

0

Problem

Two trusted Majordomus nodes cooperate whether they share a LAN, a tailnet or neither, choose a working path by themselves, fall back to a relay when no direct path exists, and every surface shows the path in use and why it was chosen. Proposed in ADR 0202 (The mesh routes work to an identity, never an address, and selects among proven transports instead of implementing NAT traversal); ADR 0203 (GitHub Pages is a signed bootstrap anchor for the mesh, never its signalling channel) (proposed; it carries no authority until the owner accepts it). Sources: chatgpt-majordomus:c237#5, chatgpt-majordomus:c279#7, chatgpt-majordomus:c282#2.

Outcome

Two trusted Majordomus nodes cooperate whether they share a LAN, a tailnet or neither, choose a working path by themselves, fall back to a relay when no direct path exists, and every surface shows the path in use and why it was chosen.

Current state

Its issues extend existing milestones; see each issue's why.

Desired state

Every criterion of the intent is carried by an issue here and proven by its test.

Acceptance criteria

• mesh peers names, per link, the candidates tried, the one chosen and why
• Two nodes with no direct path cooperate through a trusted hub relaying authenticated frames, in the mesh lab
• A node with no peers finds the mesh from the signed Pages manifest and refuses a stale, rolled-back or unsigned one

Validation

• majordomus plan validate

Issues

Each one is an execution contract with its own acceptance criteria, validation command and required evidence. The wave column is the layer of the dependency graph it sits in.

The graph

flowchart LR
    I3176["I3176<br/>The committed mesh declaration names its hubs by node, and no private address is tracked or published"]:::blocked
    classDef done stroke:#16a34a,fill:#dcfce7,color:#14532d,stroke-width:2px
    classDef active stroke:#2563eb,fill:#eff6ff,color:#1e3a8a,stroke-width:2px
    classDef verify stroke:#7c3aed,fill:#f5f3ff,color:#4c1d95,stroke-width:2px
    classDef ready stroke:#0891b2,fill:#ecfeff,color:#164e63,stroke-width:2px
    classDef planned stroke:#0891b2,fill:#ecfeff,color:#164e63,stroke-width:2px
    classDef blocked stroke:#b45309,fill:#fffbeb,color:#78350f,stroke-width:2px
    classDef cancelled stroke:#6b7280,fill:#f9fafb,color:#374151,stroke-width:2px
    classDef superseded stroke:#6b7280,fill:#f9fafb,color:#374151,stroke-width:2px

Canonical record: .ai/repo/project/milestones/an-authorised-node-connects-from-anywhere.yaml. Read it back with majordomus plan show an-authorised-node-connects-from-anywhere.