I2721 — An enrolled mesh node follows the stable pointer by itself

✕BLOCKED wave 1 · p0 · implementation profile · runs alone

Part of safe-self-update — Every mesh node follows the published release by itself, versions meet safely, and a release's provenance can be checked.

Objective

Make every node the mesh declaration enrolls keep its installation at the version releases/latest.json names, checking at server start, every 15 minutes with jitter and when the mesh announces a release, and applying through self update.

Why

ADR 0161. On 2026-10-14 v0.25.0 reached the five mesh nodes only after one session upgraded each by hand, and v0.26.0 sat on the stable pointer while every node ran 0.25.0.

Current state

No process reads releases/latest.json except install.sh run by a person.

Desired state

The mesh declaration carries follow: stable | pinned <version> | off per node, defaulting to stable for an enrolled node of the owner's mesh. A following node's server checks the pointer as above, never while blocking a request, and applies a forward, stable, listed version through self update --apply. A mesh release announcement only triggers a check; nothing a peer sends is trusted as a version or digest.

Scope

• apps/majordomus-cli/src/mesh
• apps/majordomus-cli/src/commands/serve.rs
• apps/majordomus-cli/src/release
• .ai/repo/mesh/majordomus.yaml
• share/schemas
• docs/MESH.md
• docs/DISTRIBUTION.md
• test/cases

Out of scope

• A network fetch on entering a repository
• Repositories that adopt Majordomus without enrolling machines in this mesh

Dependencies

• I2720○READY majordomus self update re-runs the published installer, and never reimplements it

Acceptance criteria

• A following node whose installed version is behind the stable pointer is upgraded within one check interval with no person on it
• A pinned node and a node with follow: off are left alone, and say so in mesh doctor
• A mesh announcement naming a version the metadata does not list changes nothing

Validation

• bin/majordomus plan validate
• MJ_TEST_JOBS=4 bash test/run.sh <the case this issue adds>

Evidence required

• node_follows_stable_pointer_test
• peer_announcement_not_trusted_test

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I2721.yaml. Read it back with majordomus plan show I2721.