I2124 — An event reloaded from disk meets the trust policy in force, and no stamp outruns the clock
Apply the same trust predicate to events reloaded from the journal file as to events arriving over a link, and refuse an event whose Lamport stamp is further ahead of the receiver's clock than a declared bound.
DONE wave 0 · p0 · implementation profile · parallel safe
Objective
Apply the same trust predicate to events reloaded from the journal file as to events arriving over a link, and refuse an event whose Lamport stamp is further ahead of the receiver's clock than a declared bound.
Why
The runtime pack's baseline audit (2026-10-09, at 1fb8d6be44) found journal.rs:1419 reloading the persisted journal with an accept-everything trust closure beside a comment saying reloaded events pass the same checks as received ones. A key withdrawn from trust.allow had its events, claims and handovers return on the next restart. The same audit found journal.rs:1952 accepting any Lamport stamp, so one trusted key could advance every runtime's clock to u64::MAX.
Current state
Reload trusts every origin; ingest accepts any stamp.
Desired state
Cooperation::new opens the journal through Journal::open_trusting with the trust definition the live path uses (key_trust, one function); refused reloads are counted in Journal::reload_report and logged. An event more than MAX_LAMPORT_LEAD (2^32) ahead of the receiver's clock is refused as clock_ahead, live or reloaded. A backdated claim, which can still outrank a claim already admitted, is recorded as a limitation in docs/MESH.md and left to the milestone's fencing work.
Scope
- apps/majordomus-cli/src/mesh/journal.rs
- apps/majordomus-cli/src/mesh/cooperation.rs
- apps/majordomus-cli/tests/mesh_trust_reload.rs
- docs/MESH.md
Dependencies
None. This issue is a root of the graph.
Acceptance criteria
- A key withdrawn from the allowlist has none of its events believed from the journal file after a restart, and they are believed again when the key is allowed again
- An event whose stamp is more than MAX_LAMPORT_LEAD ahead of the receiver's clock is refused as clock_ahead, and one within the bound is accepted
- The live path and the reload decide trust through one function
Validation
- cargo test --test mesh_trust_reload --test mesh_cooperation --test mesh_compaction
Evidence required
- mesh_trust_reload_red_then_green
Evidence
| covers | type | command | result | at commit |
|---|---|---|---|---|
| mesh_trust_reload_red_then_green | ci | gh run view 38635619021 --log --job 116098148455 (validate on master c0e3585dc8, rust (3): cargo test --test mesh_trust_reload --test mesh_cooperation --test mesh_compaction) | red then green: 477f417d916 (PR #865) states both tests in tests/mesh_trust_reload.rs red on master before it and green with it; on master c0e3585dc8 validate run 38635619021 (success) rust (3) reports a_key_withdrawn_from_the_allowlist_is_not_believed_from_the_journal_file ... ok and a_lamport_stamp_far_ahead_of_the_receiver_is_refused ... ok (2 passed), mesh_cooperation 7 passed, mesh_compaction 3 passed | c0e3585 |
Timeline
- started
- 2026-10-15T07:44:00Z
- verified
- 2026-10-15T07:44:07Z
- completed
- 2026-10-15T07:44:18Z
Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.
Canonical record: .ai/repo/project/issues/I2124.yaml. Read it back with majordomus plan show I2124.