mesh-host

Files

T

jschoubben 9ae30a7bbb mesh-host enrol redeems through the seat mesh-enrolment and refuses an answer the token's key did not sign

The engine dials as enrol.<node> on the pinned certificate, calls redeem with the public halves of its keys and a proof over
them (the SDK's RedeemProof, which binds the node and the keys and never the token's secret), asks again while the holder
says to, and verifies the vault's answer against the key its token carries before it keeps anything: an answer signed by
another key, naming another signer or node, or altered is refused and nothing is kept. A signed one is kept (membership,
login, keys), then the node dials as the login it was given, reads its key of node-logins, and calls confirm; nothing is
applied until its placement names a module. When the bus does not serve the seat to the token (the controller still holds its
lease) the controller's enrolment subject is used as before. The token's shape is mesh-sdk's now: identity keeps its names as
aliases. Tests: one added, paid by merging three identity token tests into one (net two fewer).

(issue 774, 774/S64)

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

2026-11-02 01:49:01 +01:00

identity_test.go

mesh-host enrol redeems through the seat mesh-enrolment and refuses an answer the token's key did not sign

2026-11-02 01:49:01 +01:00

identity.go

A machine moves to the bus its declaration tells it to

2026-09-28 00:08:44 +02:00

overlay_test.go

Take over the found tunnel: its key, its port, its peers; stop it, never flush

2026-09-23 23:26:35 +02:00

overlay.go

A machine makes its tunnel key first and joins through the tunnel