mesh.enrol

Add this machine's public key to trust.allow of the repository's mesh declaration, under a comment naming the machine, creating the node identity first when there is none. Idempotent: a listed key changes nothing. The comments and every other line of the declaration stay as they were, and an edit that would not parse back as a declaration is refused before anything is written. Under deny_unknown a machine opens its mesh only once its key is listed, so this is the one step that joins a machine; commit the file and restart the server.

• command
• experimental
• module mesh
• #mesh
• #identity
• #trust

Exposure

Where this one definition is reachable. Absence is explicit: a surface not listed does not carry it.

Schemas

The canonical input and output, from the Rust types; the MCP tool schema and the OpenAPI parameters and responses are derived from these.

{
  "additionalProperties": false,
  "description": "No input.",
  "title": "Empty",
  "type": "object"
}

{
  "description": "The answer of `mesh.enrol`: which declaration, which key, and whether it changed.",
  "properties": {
    "added": {
      "description": "Whether the key was added now; `false` when it was listed already.",
      "type": "boolean"
    },
    "key": {
      "description": "This machine's public key: what is listed, never a secret.",
      "type": "string"
    },
    "next": {
      "description": "What to do next: commit the file, or nothing.",
      "type": "string"
    },
    "path": {
      "description": "The declaration file, repository-relative.",
      "type": "string"
    }
  },
  "required": [
    "path",
    "key",
    "added",
    "next"
  ],
  "title": "MeshEnrolment",
  "type": "object"
}

Policies

benchmark

waived — waived: destructive

cache

disabled — every call runs the handler

Benchmark targets

Derived from the registry for this repository: one requirement per transport, and the cases the input type provides. The whole matrix is on the benchmarks page.