Prove a machine joins through the tunnel with the bus closed to it (hq ADR 0169) #61

Merged

mesh-admin merged 6 commits from feat/a-machine-joins-through-the-tunnel into main

2026-10-08 08:24:17 +00:00

Author	SHA1	Message	Date
jochen	e80a4b1642	Prove a machine joins through the tunnel in a bed of its own mesh/delivery delivered Details mesh/delivery-group group feat/a-machine-joins-through-the-tunnel delivered: every member is delivered Details mesh/merge-gate pass: the change touches no module of the mesh's graph Details mesh/repo-check pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (typescript), replays/merge-check.sh (go) Details Two machines: the anchor raises the foundation, joins over its own loopback and becomes the hub; the joiner makes its tunnel key, is issued a token for it and enrols with the bus's port closed to its own address, so the enrolment can arrive only over the tunnel (novox/hq ADR 0169). The check that had been added to the two-node walk moves here, closing the port the bundle publishes the bus on rather than the bus's own. And the uplink's range may be named: behind a VPN client that routes every private range, incus had none left to pick and no scenario could be raised.	2026-10-08 01:52:58 +02:00
jschoubben	4b7ad9a387	The two-node bed stocks the packet filter's seat runtime The filter module now serves its verbs from a runtime the mesh builds (novox/hq ADR 0170), and a bed registered its raw manifest, which the mesh refuses as unbuilt. The bed stocks mesh-runtime-nftables and the filter helper registers the module through the stocked image.	2026-10-08 01:39:02 +02:00
jschoubben	8fdbf9ca90	The two-node bed waits for the anchor's first apply before its filter	2026-10-08 01:39:02 +02:00
jschoubben	db0069f262	The two-node bed joins its second machine through the tunnel A token carries the bus's address, and at genesis that is the anchor's loopback, which no other machine reaches. The anchor joins locally and becomes the hub; the laptop makes its tunnel key, is issued a token for it and joins over the tunnel (novox/hq ADR 0169, issue 146).	2026-10-08 01:39:02 +02:00
jschoubben	960539066e	The two-node bed places the bus's users as genesis must This bed raises genesis by hand, so it places the composed user list after each token and each enrolment, as the trust bed does (novox/hq issue 146); without it the first join was refused.	2026-10-08 01:39:02 +02:00
jschoubben	d2c6e8fc5a	The two-node bed proves a machine joins through the tunnel with the bus closed to it A third machine makes its tunnel key, is issued a token for it, and enrols while the anchor drops its packets to the bus at the first hook; it can only have arrived over the tunnel (novox/hq ADR 0169).	2026-10-08 01:39:02 +02:00