I2705 — A node key can be rotated, peers follow the new key, and the old key is refused

○READY wave 1 · p0 · implementation profile · runs alone

Part of runtime-trust — A runtime is safe to reach from another machine, and joining the mesh trusts nobody by accident.

Objective

Offer a node key rotation that peers which trusted the old key can follow to the new one, after which the old key's hello is refused, and purge a withdrawn key's events from the running journal without waiting for a restart.

Why

Split from I2134 on 2026-10-14. I2134 made a key withdrawn from trust.allow lose its links without a restart (Cooperation::retrust), and its desired_state said 'Not done here' of rotating a node key and of purging a withdrawn key's events from the running journal, while its acceptance criteria still required rotation, so it could never close. A compromised key can now be cut off live, but it cannot be replaced: there is no rotate flow (threat T11). Baseline audit of 2026-10-09 at master 1fb8d6be44, mesh gap 6 and the identity row.

Current state

The node identity is created once and loaded from its key file (apps/majordomus-cli/src/mesh/identity.rs); nothing replaces it, and no message tells a peer that a key it trusts is succeeded by another. Cooperation::retrust (apps/majordomus-cli/src/mesh/cooperation.rs), called from the live reload (apps/majordomus-cli/src/live.rs) through capability::builtin::mesh::retrust, ends the links of keys no longer trusted; a withdrawn key's events stay in the running journal until the next restart's reload applies the trust in force (I2124). The key file is written at the umask's mode and chmodded to 0600 afterwards (apps/majordomus-cli/src/mesh/identity.rs); session prismatic-majordomus-6e is fixing exactly that on its own branch, and it is not this issue's work.

Desired state

A command rotates this node's key: the new identity is signed for by the old one, peers that trusted the old key accept the succession and link to the new key, and the old key's next hello is refused. A key withdrawn from the trust in force has its events dropped from the running journal at the reload that withdrew it. docs/MESH.md describes rotation and what a peer does on it.

Scope

• apps/majordomus-cli/src/mesh/identity.rs
• apps/majordomus-cli/src/mesh/trust.rs
• apps/majordomus-cli/src/mesh/cooperation.rs
• apps/majordomus-cli/src/mesh/journal.rs
• apps/majordomus-cli/src/capability/builtin/mesh.rs
• apps/majordomus-cli/tests/mesh_cooperation.rs
• docs/MESH.md

Out of scope

• Ending a withdrawn key's links without a restart, which I2134 delivered
• Creating the key file owner-only from its first byte, which session prismatic-majordomus-6e is fixing on its own branch under I2134
• The journal reload applying the trust in force, which is I2124's

Dependencies

• I2134✓DONE A key removed from the trust list loses its links without a restart, and a node key can be rotated

Acceptance criteria

• After a rotation, peers that trusted the old key link to the new one, and the old key's next hello is refused
• A key withdrawn from trust.allow on a running runtime has its events dropped from the running journal at the reload that withdrew it, with no restart

Validation

• bin/majordomus plan validate
• cargo test --test mesh_cooperation
• cargo test --lib mesh::identity

Evidence required

• key_rotation_test

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I2705.yaml. Read it back with majordomus plan show I2705.