I3842 — A caller on another host never sees this process's executions, live or recorded

✕BLOCKED wave 2 · p1 · implementation profile · runs alone

Part of an-authorised-node-connects-from-anywhere — An authorised node reaches another across LAN, tailnet or NAT, and says how.

Objective

Refuse the /events WebSocket upgrade to a caller beyond loopback, declare executions.list, executions.get, executions.events and executions.demonstrate local-only, and add /cockpit/executions to the pages that answer this machine alone, so that a hosted hub shows an anonymous caller the repository and liveness and nothing of what runs in it. ADR 0220 decision 4.

Why

I3826 refused the mesh's reads to a remote caller, but an execution of one of them that a local worker starts through executions.start still streamed over /events and was listed by executions.list to anyone who could reach the server; on a hosted hub that is every visitor. The gap was observed as a knowledge defect on 2026-10-21 when I3826 was verified.

Current state

Router::websocket refuses only a rebound browser page; the executions read capabilities admit every remote caller (ADR 0126); /cockpit/executions answers anyone.

Desired state

A remote caller is answered 403 by the live channel's upgrade, by every executions read and by /cockpit/executions; this machine follows, lists and reads its executions as before; case 3861 and the router's unit tests prove both halves.

Scope

• apps/majordomus-cli/src/http/router.rs
• apps/majordomus-cli/src/capability/builtin/executions.rs
• test/cases/3861_a_remote_caller_never_sees_the_executions.sh
• docs/MESH.md
• .ai/repo/project/issues/I3842.yaml

Out of scope

• apps/majordomus-cli/src/http/events.rs: what the channel carries is unchanged; who may open it is decided before it is opened
• An authenticated remote reader of executions (ADR 0204's signed-in Cockpit), which is a later slice

Dependencies

• I3826✕BLOCKED A hosted hub keeps one key from a secret, advertises its URL, and shows the mesh only to those it trusts

Acceptance criteria

• The /events upgrade from a caller beyond loopback is refused with 403 and opens for this machine
• executions.list, executions.get, executions.events and executions.demonstrate answer a remote caller 403 and this machine as before
• /cockpit/executions and its subpaths answer a remote caller 403

Validation

• env -u MAJORDOMUS_SHARE -u MAJORDOMUS_HTTP_HOST -u MJ_ROOT bash test/run.sh 3861_a_remote_caller_never_sees_the_executions
• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --lib http::router

Evidence required

• case_a_remote_caller_never_sees_the_executions

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3842.yaml. Read it back with majordomus plan show I3842.