Module root 

The trust root: which copy of the mesh declaration a runtime obeys (ADR 0050 rule 6, I2135).

The declaration names who this runtime trusts (trust.policy, trust.allow) and where it sends its card and envelope (rendezvous.endpoints, cooperation.seeds, broadcast.networks). Until this module, the server read it from the checkout’s working tree, so a branch — or an uncommitted edit — could add a key, point the runtime at a host of its author’s choosing, or switch the policy to trust on first use, and that checkout’s runtime obeyed. A reviewer running a contributor’s branch is exactly the person that reaches.

The rule is that a working tree may narrow trust and never widen it. When the trunk holds a committed copy of the declaration at the same path, the working tree’s declaration is used with every widening removed: the mesh is on only if the trunk’s copy is on as well, the policy is no looser than the trunk’s, and every key and every address is one the trunk’s copy also lists — or a loopback address, which reaches no other host. When the trunk holds no copy — a repository that has never committed one, or a directory that is not a git repository — the working tree is all there is, and the one widening that needs no address at all, trust on first use, is refused. Every widening removed is named, so mesh doctor can say what this checkout’s runtime ignores and why.

The trunk is the repository’s, as crate::worktree::RepositoryIdentity names it: the local branch of that name. A stale local trunk is older trust, which is the safe direction.

use majordomus_cli::mesh::root::{narrow, resolve};
use majordomus_cli::mesh::MeshConfig;
// no declaration in the working tree: nothing is obeyed and nothing was narrowed
let nowhere = tempfile::tempdir().unwrap();
let none = resolve(nowhere.path(), None);
assert!(none.declaration.is_none() && none.narrowed.is_empty());
// a declaration held against the trunk's copy keeps only what the trunk also says
let parse = |v: serde_json::Value| MeshConfig::from_metadata(&v, "x").unwrap();
let trunk = parse(serde_json::json!({"schema": "mesh/v1", "kind": "mesh-declaration", "id": "x",
    "trust": {"allow": ["aa"]}}));
let branch = parse(serde_json::json!({"schema": "mesh/v1", "kind": "mesh-declaration", "id": "x",
    "trust": {"allow": ["aa", "bb"]}}));
let (held, narrowed) = narrow(branch, &trunk);
assert_eq!(held.trust.allow, vec!["aa".to_string()]);
assert_eq!(narrowed, vec!["trust.allow: bb is not on the trunk".to_string()]);

Structs

Resolved

The declaration in force, and how it was arrived at.

Functions

is_loopback

Does an endpoint or a seed (http://host:port, or host:port) reach only this machine? A loopback address carries the card and the envelope nowhere a person on another host can read them, which is how two worktrees of one machine find each other without a hub, so a working tree may name one without the trunk’s say-so.

narrow

The working tree’s declaration with every widening of trunk removed, and a line for each.

resolve

Resolve the declaration in force for the repository at root, given the working tree’s declaration object as the index found it. None means the index found none, and then there is nothing to obey and nothing to ask git.