I2132 — A hello names the runtime it is meant for, and no other runtime accepts it

✓DONE wave 0 · p1 · implementation profile · runs alone

Part of runtime-trust — A runtime is safe to reach from another machine, and joining the mesh trusts nobody by accident.

Objective

Bind each link hello to its intended recipient inside the signed bytes, refuse a hello addressed elsewhere, and make the documented check order the one the code runs.

Why

Hello (apps/majordomus-cli/src/mesh/link.rs:444-456) names no audience. The nonce cache that refuses a replay is per answerer, held in memory and checked after trust (apps/majordomus-cli/src/mesh/cooperation.rs:1847-1875), so a captured hello replays to another runtime of the same repository, or to the same runtime after a restart, within the 300 s skew window (threat T6). The effect is a displaced inbound link and a false 'connected' for the real peer (apps/majordomus-cli/src/mesh/cooperation.rs:1918-1934); the replayer cannot sync. docs/MESH.md:128-136 and item 1 of rule project.mesh-cooperation-is-authenticated put the nonce check before protocol, self, repository and trust; the code checks it last on purpose, so strangers cannot fill the cache, while the blocking rule says 'verify, in order'. Baseline audit of 2026-10-09 at master 1fb8d6be44, mesh gap 9 and drift 1.

Current state

A valid hello is accepted by any runtime of the repository that trusts its key and has not seen its nonce.

Desired state

Hello carries an optional to (the runtime key it means to reach) inside its signed bytes; the dialer fills it whenever it knows the key (a registry target, or a runtime it linked before); accept_hello refuses a hello addressed elsewhere as misaddressed, before the replay cache sees its nonce; a hello without to is still admitted (seeds, first contacts, releases before this one), so the link protocol version is unchanged and a mixed fleet keeps linking. docs/MESH.md states the order the code checks in and why the nonce cache is last. The deferred part, bringing rule project.mesh-cooperation-is-authenticated to the code's check order, is I2703.

Scope

• apps/majordomus-cli/src/mesh/link.rs
• apps/majordomus-cli/src/mesh/cooperation.rs
• apps/majordomus-cli/tests/mesh_cooperation.rs
• docs/MESH.md
• .ai/repo/rules/project/mesh-cooperation-is-authenticated.v1.md

Dependencies

None. This issue is a root of the graph.

What waits on this

• I2703○READY The mesh cooperation rule lists the hello checks in the order the code runs them, and a test names that order

Acceptance criteria

• A hello captured from a link to runtime A and replayed to runtime B within the skew window is refused with a typed refusal and changes no link of B
• A hello replayed to A after A restarts cannot displace an established link

Validation

• bin/majordomus plan validate
• cargo test --test mesh_cooperation
• cargo test --lib mesh::cooperation

Evidence required

• hello_replay_to_another_runtime_refused_test

Evidence

Timeline

started

2026-10-17T12:01:16Z

verified

2026-10-17T12:01:30Z

completed

2026-10-17T12:01:38Z

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I2132.yaml. Read it back with majordomus plan show I2132.