I2134 — A key removed from the trust list loses its links without a restart, and a node key can be rotated

Re-read the trust declaration while the runtime runs, drop the links and admission of a de-listed key, offer a key rotation that peers can follow, and create the node key file private from its first byte.

DONE wave 0 · p0 · implementation profile · runs alone

Part of runtime-trust — A runtime is safe to reach from another machine, and joining the mesh trusts nobody by accident.

Objective

Why

Trust is frozen at activation (apps/majordomus-cli/src/mesh/manager.rs:466,486, apps/majordomus-cli/src/mesh/cooperation.rs:1150): a key removed from trust.allow keeps its links until every peer restarts, and there is no rotate or revoke flow (threat T11). A compromised key therefore cannot be cut off without restarting every runtime. The node key file is written and then chmodded to 0600 (apps/majordomus-cli/src/mesh/identity.rs:338-347), so it exists for a moment at umask permissions. Reloaded events of a revoked key are I2124's (the journal reload applies the trust policy, milestone runtime-trust); this issue is the live half. Baseline audit of 2026-10-09 at master 1fb8d6be44, mesh gap 6 and the identity row.

Current state

Revocation takes effect only on each peer's restart. Rotation does not exist. The key file is briefly readable at umask permissions.

Desired state

Cooperation holds its trust as a replaceable value; Cooperation::retrust puts a new one in force and ends the link of every peer it no longer trusts, and the server calls it with each new generation of the repository it reads, so a key withdrawn from trust.allow and committed loses its links without a restart: its next sync meets unknown_link and its hello is refused untrusted. The deferred part, rotating a node key and purging a withdrawn key's events from the running journal, is I2705.

Scope

apps/majordomus-cli/src/mesh/manager.rs
apps/majordomus-cli/src/mesh/cooperation.rs
apps/majordomus-cli/src/mesh/trust.rs
apps/majordomus-cli/src/mesh/identity.rs
apps/majordomus-cli/src/shared.rs
apps/majordomus-cli/src/capability/builtin/mesh.rs
apps/majordomus-cli/tests/mesh_cooperation.rs
docs/MESH.md

Dependencies

None. This issue is a root of the graph.

What waits on this

I2705READY A node key can be rotated, peers follow the new key, and the old key is refused

Acceptance criteria

Removing a key from trust.allow on a running runtime closes that key's links within one heartbeat and refuses its next hello, with no restart
Under a permissive umask the node key file is never readable by group or others

Validation

bin/majordomus plan validate
cargo test --test mesh_cooperation
cargo test --lib mesh::identity

Evidence required

revocation_without_restart_test
key_file_created_private_test

Evidence

covers	type	command	result	at commit
revocation_without_restart_test	test	cargo test --locked --manifest-path apps/majordomus-cli/Cargo.toml --lib -- mesh::cooperation::tests::a_withdrawn_key_loses_its_link_without_a_restart	revocation_without_restart_test names a test never written under that name; proved by mesh::cooperation::tests::a_withdrawn_key_loses_its_link_without_a_restart (delivered by 9d09a4a5f22): 1 passed at c0e3585dc8, 2026-10-14 23:3xZ, this Mac	c0e3585
key_file_created_private_test	test	cargo test --locked --manifest-path apps/majordomus-cli/Cargo.toml --lib -- mesh::identity::tests::a_node_key_is_never_readable_by_others	key_file_created_private_test names a test never written under that name; proved by mesh::identity::tests::a_node_key_is_never_readable_by_others (delivered by 37c72bbed6c): 1 passed at c0e3585dc8, 2026-10-14 23:3xZ, this Mac	c0e3585

Timeline

started: 2026-10-14T23:32:46Z
verified: 2026-10-14T23:32:54Z
completed: 2026-10-14T23:33:07Z

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I2134.yaml. Read it back with majordomus plan show I2134.