I3190 — The mesh lab proves links behind NAT, with the relay, a hub outage and an address change

✕BLOCKED wave 3 · p3 · verification profile · parallel safe

Part of mesh-connectivity — Trusted nodes connect across NAT through proven transports, and every surface says which path.

Objective

Add NAT topologies to test/mesh-lab (two private networks behind masquerading routers, one blocked UDP) and scenarios for relayed link, direct upgrade, hub down, address change and compromised bootstrap, each with measured connect time, required by scripts/ci/mesh-lab-evidence.

Why

The 10-12 criteria require network namespaces and never localhost as proof of NAT traversal; the 10-16 matrix listed Pages offline, hub offline, symmetric NAT, IP change and partition. The lab has ten scenarios on one bridge network. Proposed in ADR 0202 (The mesh routes work to an identity, never an address, and selects among proven transports instead of implementing NAT traversal) (proposed; it carries no authority until the owner accepts it). Sources: chatgpt-majordomus:c282#5, chatgpt-majordomus:c102#14, chatgpt-majordomus:c166#6.

Current state

Verified: test/mesh-lab/run scenarios claim_conflict ... three_node_convergence; no NAT.

Desired state

The lab's required set includes the NAT scenarios; case 414 holds the set.

Scope

• test/mesh-lab
• scripts/ci/mesh-lab-evidence
• .github/workflows/validate.yml

Out of scope

• Proving traversal on a real multi-network (a manual, recorded run)

Dependencies

• I3189✕BLOCKED Two nodes with no direct path cooperate through a trusted hub that relays their authenticated frames

Acceptance criteria

• Each scenario has a measured outcome
• A dropped scenario fails case 414
• The relayed_link scenario runs both nodes on private networks that cannot dial each other and reach the hub only over a private or overlay network, so the lab proves the relay without a public cleartext hop

Validation

• majordomus plan validate
• bash test/run.sh 414_mesh_lab_evidence

Evidence required

• mesh_lab_nat_matrix

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3190.yaml. Read it back with majordomus plan show I3190.