Roadmap

The problem

The runtime pack's baseline audit (2026-10-09, M01) read the server and the mesh against their documents and found the security model held only on the network hop. A server bound beyond loopback accepted every state-changing request from any host that sent no Origin header: plan transitions, continuity writes, any capability through executions.start, and mesh sessions, claims, handovers and reviews that the node then signed with its own trusted key. Three servers on the owner's machine were bound that way at the time. Beside it: reloading the journal skips the trust check, so a revoked key's events return on restart; Lamport stamps are not bounded, so a trusted key can backdate a claim to win every conflict; an expired claim revives and wins after a partition; hello messages name no recipient; trust is read from the branch's working tree; discovery inputs have unbounded channels and reply reads.

The outcome

Discovery is not trust, trust is not authorization, and a caller is admitted to change anything only by a key the trust policy names. A host that can reach a runtime reads it and changes nothing it cannot authenticate; every event in the journal was checked against the trust policy that holds now, whether it arrived over a link or from disk; and the limits the documents state are the limits the code enforces.

Where it stands

Remote state-changing requests were admitted by address alone (fixed by I2123). The journal reload, Lamport bounds, claim revival, hello recipient, trust-root and unbounded-input findings stand as recorded in the audit.

Where it should stand

Every threat in docs/MESH.md's security model names the test that defends it, and every finding of the baseline audit's threat list is either defended with a test or recorded as a limitation the documents state.

In scope

• apps/majordomus-cli/src/http
• apps/majordomus-cli/src/mcp
• apps/majordomus-cli/src/mesh
• apps/majordomus-cli/src/capability
• docs/MESH.md
• docs/MCP.md
• test/cases

Out of scope

• Encrypting the transport. ADR 0032 decided no TLS dependency; confidentiality stays the network's.
• Accounts or a login. A remote writer, when one is needed, is admitted by a key the trust policy names.

Proven when

• A request from an address that is not loopback runs only a capability that reads or whose input is a signed message, on every transport that knows the caller's address
• Every event the journal holds passed the trust policy in force, whether it arrived over a link or was reloaded from disk
• A trusted key cannot order its claim before claims already admitted, and an expired claim does not return as live
• Every bound the security model names is enforced on the input it names, with a test that sends one more