I2724 — A node without a route to the site takes the archive from a peer and still verifies it itself
Let a following node that cannot reach github.com or majordomus.dev fetch the release archive from a linked peer over the authenticated mesh link, and install it only after checking its digest and size against release metadata it read itself or that was relayed and signed by the publishing node.
BLOCKED wave 1 · p1 · implementation profile · parallel safe
Blocked. This issue cannot start until I2720 is done. The status is derived from that, not declared.
Objective
Let a following node that cannot reach github.com or majordomus.dev fetch the release archive from a linked peer over the authenticated mesh link, and install it only after checking its digest and size against release metadata it read itself or that was relayed and signed by the publishing node.
Why
ADR 0161. jetson has no route to github.com; on 2026-10-14 its v0.25.0 archive was copied over the LAN by hand.
Current state
A node without a route to the site is upgraded by copying an archive to it by hand.
Desired state
self update --apply on such a node asks a linked peer for the archive and the metadata, verifies before unpacking, and installs through the same installer path; a mismatch is refused and reported on the board.
Scope
- apps/majordomus-cli/src/mesh
- apps/majordomus-cli/src/release
- site/static/install.sh
- docs/MESH.md
- test/cases
Out of scope
- Trusting a digest a peer sends without metadata the node can verify
Dependencies
- I2720READY majordomus self update re-runs the published installer, and never reimplements it
- I2165DONE A released archive carries a provenance attestation the installer can check
Acceptance criteria
- A node with no route to the site upgrades from a peer's archive and verifies it before unpacking
- A peer archive whose digest differs from the metadata is refused and reported
Validation
- bin/majordomus plan validate
- MJ_TEST_JOBS=4 bash test/run.sh <the case this issue adds>
Evidence required
- relayed_archive_verified_test
Evidence
None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.
Timeline
- started
- —
- verified
- —
- completed
- —
Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.
Canonical record: .ai/repo/project/issues/I2724.yaml. Read it back with majordomus plan show I2724.