I3837 — A case that enables the mesh declares its tailnet provider off, so it stays hermetic on a machine that runs Tailscale

✕BLOCKED wave 1 · p2 · implementation profile · parallel safe

Part of the-mesh-works-out-of-the-box — The mesh works out of the box: trusted machines find each other by every means and their sessions cooperate from the first turn.

Objective

Give every shell case that writes an enabled mesh declaration with its other discovery providers off a `tailscale: enabled: false` beside `multicast: enabled: false`, and add a structure check that refuses a new case whose enabled declaration leaves the tailnet provider on unless the case says it tests the tailnet.

Why

I2410 makes the tailnet a discovery provider, on by default. A fixture that switched multicast off to stay hermetic then still asks the real tailnet on any machine whose PATH has the Tailscale CLI: on macbook-2 on 2026-10-21 health_server's mesh-dimension tests saw 2 real nodes where they assert none (fixed for the Rust fixtures inside I2410). Eighteen shell cases have the same exposure and pass only because CI's runners have no Tailscale: 130, 301, 495, 821, 827, 993, 1023, 1050, 1051, 1052, 1053, 1054, 3051, 3066, 3067, 3068, 3069, 3151.

Current state

Those cases write `multicast:\\n enabled: false` and no `tailscale:` key into .ai/repo/mesh/majordomus.yaml of their fixture; nothing checks that a case's declaration is hermetic.

Desired state

Every case's enabled declaration names the tailnet provider; a case that leaves it on says why, and a check refuses one that does not.

Scope

• test/cases
• scripts/ci

Out of scope

• The Rust test fixtures (done in I2410)
• Changing the provider's production default

Dependencies

• I2410○READY A trusted machine on the tailnet is found through Tailscale, with no address written by hand

Acceptance criteria

• Each of the eighteen cases declares `tailscale: enabled: false` and passes on a machine with the Tailscale CLI on PATH, named in the evidence
• A fixture case whose enabled declaration omits the tailnet key is refused by the check, and one that declares it, or says it tests the tailnet, is admitted

Validation

• bash test/run.sh 3847_a_case_that_enables_the_mesh_declares_its_tailnet_off
• bin/majordomus plan validate

Evidence required

• every_mesh_case_is_hermetic_test

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3837.yaml. Read it back with majordomus plan show I3837.