I2412 — `majordomus init` declares the mesh and enrols this machine's key, so a fresh repository cooperates

○READY wave 0 · p1 · implementation profile · parallel safe

Part of the-mesh-works-out-of-the-box — The mesh works out of the box: trusted machines find each other by every means and their sessions cooperate from the first turn.

Objective

A fresh `majordomus init` writes a mesh declaration (multicast and Tailscale discovery on, deny_unknown trust) and an enrolment command adds this machine's node key to it, so a repository becomes a mesh by init and one enrolment per machine.

Why

share/skeleton ships no declaration, so the mesh of a fresh repository is off (docs/MESH.md:396-399; share/skeleton/ai/repo/knowledge/sources.yaml:192-197 only indexes the class). Even with one, deny_unknown with an empty allowlist links nothing (mesh/config.rs:104-106), and there is no command to add a key.

Current state

A repository has a mesh only if somebody hand-writes .ai/repo/mesh/<name>.yaml and its allowlist.

Desired state

init writes the declaration; `majordomus mesh enrol` adds this node's key to the allowlist and says what to commit; nothing trusts a key nobody enrolled.

Scope

• share/skeleton
• apps/majordomus-cli/src/commands
• apps/majordomus-cli/src/mesh/config.rs
• docs/MESH.md
• test/cases

Dependencies

None. This issue is a root of the graph.

Acceptance criteria

• `majordomus init` in an empty repository writes a mesh declaration that validates
• `majordomus mesh enrol` adds this node's key once, idempotently
• A machine whose key is not enrolled opens no mesh socket (I2261 still holds)

Validation

• bin/majordomus plan validate
• MJ_TEST_JOBS=4 bash test/run.sh 01_init

Evidence required

• init_declares_mesh_case

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I2412.yaml. Read it back with majordomus plan show I2412.