Function closed_to 

pub fn closed_to(config: &MeshConfig, public_key: &str) -> Option<String>

Why the mesh stays closed on a machine the declaration does not name, or None when it may open. Under deny_unknown and allowlist a machine joins only when its own public key is in trust.allow: an unlisted machine — a contributor’s clone of a public repository, a new machine nobody enrolled — would otherwise announce itself on its network and dial whatever endpoints the repository commits, trusted by nobody. It opens no socket instead, and says which key to list. tofu trusts whoever answers first, so it never closes on this ground.

use majordomus_cli::mesh::config::MeshConfig;
use majordomus_cli::mesh::manager::closed_to;

let declared = |allow: &[&str], policy: &str| -> MeshConfig {
    serde_json::from_value(serde_json::json!({
        "schema": "mesh/v1", "kind": "mesh", "id": "m", "enabled": true,
        "trust": { "policy": policy, "allow": allow },
    })).unwrap()
};
let key = "ab".repeat(32);
assert!(closed_to(&declared(&[], "deny_unknown"), &key).unwrap().starts_with("closed: "));
assert!(closed_to(&declared(&["cd"], "allowlist"), &key).is_some());
assert_eq!(closed_to(&declared(&[&key], "deny_unknown"), &key), None, "listed: it opens");
assert_eq!(closed_to(&declared(&[], "tofu"), &key), None);