I3823 — The mesh client reaches an https endpoint over TLS and refuses cleartext to a public address
mcp::bridge::request reaches an https:// rendezvous endpoint or seed over TLS with the certificate verified against the system roots; an http:// endpoint whose address is neither loopback, private nor overlay is refused with the correction; the mesh declaration accepts https:// endpoints and seeds by host name. ADR 0220 decision 1, the owner's 'TLS first' of 2026-10-21.
DONE wave 0 · p1 · implementation profile · parallel safe
Objective
mcp::bridge::request reaches an https:// rendezvous endpoint or seed over TLS with the certificate verified against the system roots; an http:// endpoint whose address is neither loopback, private nor overlay is refused with the correction; the mesh declaration accepts https:// endpoints and seeds by host name. ADR 0220 decision 1, the owner's 'TLS first' of 2026-10-21.
Why
The owner chose TLS before any public hub. The client today strips http:// and writes to a bare TcpStream, so an https endpoint cannot work and a public http one would carry the journal in cleartext.
Current state
bridge::connect accepts only http:// and opens a TcpStream; config.rs validates seeds as http://host:port; case 491 refuses any hub outside the private and overlay ranges.
Desired state
An https endpoint completes a register round-trip over TLS against a local test server with a test certificate authority; a public http endpoint is refused before any byte is sent; case 3823 proves both and that a private http endpoint still works.
Scope
- apps/majordomus-cli/src/mcp/bridge.rs
- apps/majordomus-cli/src/mesh/config.rs
- apps/majordomus-cli/src/mesh/doctor.rs
- apps/majordomus-cli/src/mesh/link.rs
- apps/majordomus-cli/src/mesh/rendezvous.rs
- apps/majordomus-cli/Cargo.toml
- apps/majordomus-cli/Cargo.lock
- test/cases/3823_the_mesh_client_speaks_tls.sh
- docs/MESH.md
- docs/claims/mesh-cooperation-links.md
- scripts/ci/crate-boundary
- test/cases/360_the_crate_boundary_is_measured.sh
- .ai/repo/adrs/0032-an-external-workspace-is-not-a-provider-the-term-the-depende.md
- .ai/repo/ci/gates.yaml
- .ai/repo/project/issues/I3823.yaml
Dependencies
None. This issue is a root of the graph.
What waits on this
Acceptance criteria
- An https endpoint is reached over TLS with a verified certificate
- An unverifiable certificate is refused naming the endpoint
- A public http endpoint is refused before connecting; loopback, private and overlay http endpoints still work
Validation
- env -u MAJORDOMUS_SHARE -u MAJORDOMUS_HTTP_HOST -u MJ_ROOT bash test/run.sh 3823_the_mesh_client_speaks_tls
Evidence required
- tls_endpoint_reached
- public_cleartext_refused
Evidence
| covers | type | command | result | at commit |
|---|---|---|---|---|
| tls_endpoint_reached | ci | bash test/run.sh 3823_the_mesh_client_speaks_tls | ok, passed in master validate 39784979979 (success at 2034d4a3f0b, which holds case 3823; fix c6eda574264); also ok in a local run on 2026-10-23 (9 s): an https hub is reached over TLS with its certificate verified | 376493c |
| public_cleartext_refused | ci | bash test/run.sh 3823_the_mesh_client_speaks_tls | ok, same run: the mesh doctor transport check refuses a public http hub or seed naming the address and the correction | 376493c |
Timeline
- started
- 2026-10-23T16:33:16Z
- verified
- —
- completed
- 2026-10-23T16:40:11Z
Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.
Canonical record: .ai/repo/project/issues/I3823.yaml. Read it back with majordomus plan show I3823.