refactor(peer): separate reachability from Mesh ownership by M4n5ter · Pull Request #4561 · apache/maka

M4n5ter · 2026-09-02T13:03:25Z

Summary

introduce one bounded, self-signed reachability lease as the identity-bound locator contract, independent of Peer Mesh membership
publish that lease through authenticated Host status and consume it consistently from owner connection codes, Guest mounts, Desktop profiles, and CLI projections
reject unsigned direct route arrays at the unpublished persistence and protocol boundaries, moving the compatibility boundary to epoch 98
record the frozen four-layer recovery design, invariants, and acceptance criteria used by this stack

Verification

Verified on the complete stacked head after rebasing from main at eacfb46aa7ec93273bf468335f4270bba62d35a5:

npm run typecheck
npm run lint
npm run format:check
npm run rebuild
npm run test:dist - all workspace tests passed
npm run check:renderer-architecture - 71 passed
npm run check:release - 192 passed
git diff --check
cargo fmt --manifest-path native/runtime-host-peer/Cargo.toml -- --check
cargo clippy --locked --all-targets --manifest-path native/runtime-host-peer/Cargo.toml -- -D warnings
cargo test --locked --manifest-path native/runtime-host-peer/Cargo.toml - 28 passed
immutable installed-CLI tarball smoke

Review focus

The lease proves who issued a bounded locator snapshot; it does not grant membership or access. Consumers still authenticate the Runtime Host and require the expected PeerId before retaining or using the lease.

AI use

No generative tool made a substantive contribution
Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and verified the change under maintainer direction.

Checklist

Tests cover the change and fail without it
Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

Yes - described under Summary above
No

Generated-by: Codex (gpt-5.6-sol)

Let the aggregate peer endpoint owner remain the sole production lifetime lock and keep the durable publisher focused on local publication rather than remote fact verification. Generated-by: Codex (gpt-5.6-sol)

jackwener

Approved at exact head e86dc0bc8194e0dc5d1bab6a2aa26e603b19162f at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

Review notice: This approval was submitted by an automated review agent operated by WAWQAQ and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.

Two new system_note kinds and the reshaped lastRequestAnchor land in @maka/core's closed allowlists. A merge-base client handshakes on strict epoch equality and would then fail to decode the first transcript carrying them; the epoch moves so the pair refuses each other at the handshake (main is at 98 after apache#4561/apache#4568, so this lands as 99). Refs apache#4559 Generated-by: Claude Code Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

M4n5ter · 2026-09-02T13:03:25Z

Summary

introduce one bounded, self-signed reachability lease as the identity-bound locator contract, independent of Peer Mesh membership
publish that lease through authenticated Host status and consume it consistently from owner connection codes, Guest mounts, Desktop profiles, and CLI projections
reject unsigned direct route arrays at the unpublished persistence and protocol boundaries, moving the compatibility boundary to epoch 98
record the frozen four-layer recovery design, invariants, and acceptance criteria used by this stack

Refs #4554

Verification

Verified on the complete stacked head after rebasing from main at eacfb46aa7ec93273bf468335f4270bba62d35a5:

npm run typecheck
npm run lint
npm run format:check
npm run rebuild
npm run test:dist - all workspace tests passed
npm run check:renderer-architecture - 71 passed
npm run check:release - 192 passed
git diff --check
cargo fmt --manifest-path native/runtime-host-peer/Cargo.toml -- --check
cargo clippy --locked --all-targets --manifest-path native/runtime-host-peer/Cargo.toml -- -D warnings
cargo test --locked --manifest-path native/runtime-host-peer/Cargo.toml - 28 passed
immutable installed-CLI tarball smoke

Review focus

The lease proves who issued a bounded locator snapshot; it does not grant membership or access. Consumers still authenticate the Runtime Host and require the expected PeerId before retaining or using the lease.

AI use

No generative tool made a substantive contribution
Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and verified the change under maintainer direction.

Checklist

Tests cover the change and fail without it
Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

Yes - described under Summary above
No

Generated-by: Codex (gpt-5.6-sol)

Let the aggregate peer endpoint owner remain the sole production lifetime lock and keep the durable publisher focused on local publication rather than remote fact verification. Generated-by: Codex (gpt-5.6-sol)

jackwener

Approved at exact head e86dc0bc8194e0dc5d1bab6a2aa26e603b19162f at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

Review notice: This approval was submitted by an automated review agent operated by WAWQAQ and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.

Two new system_note kinds and the reshaped lastRequestAnchor land in @maka/core's closed allowlists. A merge-base client handshakes on strict epoch equality and would then fail to decode the first transcript carrying them; the epoch moves so the pair refuses each other at the handshake (main is at 98 after apache#4561/apache#4568, so this lands as 99). Refs apache#4559 Generated-by: Claude Code Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

M4n5ter · 2026-09-02T13:03:25Z

Summary

introduce one bounded, self-signed reachability lease as the identity-bound locator contract, independent of Peer Mesh membership
publish that lease through authenticated Host status and consume it consistently from owner connection codes, Guest mounts, Desktop profiles, and CLI projections
reject unsigned direct route arrays at the unpublished persistence and protocol boundaries, moving the compatibility boundary to epoch 98
record the frozen four-layer recovery design, invariants, and acceptance criteria used by this stack

Refs #4554

Verification

Verified on the complete stacked head after rebasing from main at eacfb46aa7ec93273bf468335f4270bba62d35a5:

npm run typecheck
npm run lint
npm run format:check
npm run rebuild
npm run test:dist - all workspace tests passed
npm run check:renderer-architecture - 71 passed
npm run check:release - 192 passed
git diff --check
cargo fmt --manifest-path native/runtime-host-peer/Cargo.toml -- --check
cargo clippy --locked --all-targets --manifest-path native/runtime-host-peer/Cargo.toml -- -D warnings
cargo test --locked --manifest-path native/runtime-host-peer/Cargo.toml - 28 passed
immutable installed-CLI tarball smoke

Review focus

The lease proves who issued a bounded locator snapshot; it does not grant membership or access. Consumers still authenticate the Runtime Host and require the expected PeerId before retaining or using the lease.

AI use

No generative tool made a substantive contribution
Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and verified the change under maintainer direction.

Checklist

Tests cover the change and fail without it
Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

Yes - described under Summary above
No

Generated-by: Codex (gpt-5.6-sol)

Let the aggregate peer endpoint owner remain the sole production lifetime lock and keep the durable publisher focused on local publication rather than remote fact verification. Generated-by: Codex (gpt-5.6-sol)

jackwener

Approved at exact head e86dc0bc8194e0dc5d1bab6a2aa26e603b19162f at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

Review notice: This approval was submitted by an automated review agent operated by WAWQAQ and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.

Two new system_note kinds and the reshaped lastRequestAnchor land in @maka/core's closed allowlists. A merge-base client handshakes on strict epoch equality and would then fail to decode the first transcript carrying them; the epoch moves so the pair refuses each other at the handshake (main is at 98 after apache#4561/apache#4568, so this lands as 99). Refs apache#4559 Generated-by: Claude Code Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

M4n5ter · 2026-09-02T13:03:25Z

Summary

introduce one bounded, self-signed reachability lease as the identity-bound locator contract, independent of Peer Mesh membership
publish that lease through authenticated Host status and consume it consistently from owner connection codes, Guest mounts, Desktop profiles, and CLI projections
reject unsigned direct route arrays at the unpublished persistence and protocol boundaries, moving the compatibility boundary to epoch 98
record the frozen four-layer recovery design, invariants, and acceptance criteria used by this stack

Refs #4554

Verification

Verified on the complete stacked head after rebasing from main at eacfb46aa7ec93273bf468335f4270bba62d35a5:

npm run typecheck
npm run lint
npm run format:check
npm run rebuild
npm run test:dist - all workspace tests passed
npm run check:renderer-architecture - 71 passed
npm run check:release - 192 passed
git diff --check
cargo fmt --manifest-path native/runtime-host-peer/Cargo.toml -- --check
cargo clippy --locked --all-targets --manifest-path native/runtime-host-peer/Cargo.toml -- -D warnings
cargo test --locked --manifest-path native/runtime-host-peer/Cargo.toml - 28 passed
immutable installed-CLI tarball smoke

Review focus

The lease proves who issued a bounded locator snapshot; it does not grant membership or access. Consumers still authenticate the Runtime Host and require the expected PeerId before retaining or using the lease.

AI use

No generative tool made a substantive contribution
Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and verified the change under maintainer direction.

Checklist

Tests cover the change and fail without it
Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

Yes - described under Summary above
No

Generated-by: Codex (gpt-5.6-sol)

Let the aggregate peer endpoint owner remain the sole production lifetime lock and keep the durable publisher focused on local publication rather than remote fact verification. Generated-by: Codex (gpt-5.6-sol)

jackwener

Approved at exact head e86dc0bc8194e0dc5d1bab6a2aa26e603b19162f at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

Review notice: This approval was submitted by an automated review agent operated by WAWQAQ and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.

Two new system_note kinds and the reshaped lastRequestAnchor land in @maka/core's closed allowlists. A merge-base client handshakes on strict epoch equality and would then fail to decode the first transcript carrying them; the epoch moves so the pair refuses each other at the handshake (main is at 98 after apache#4561/apache#4568, so this lands as 99). Refs apache#4559 Generated-by: Claude Code Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

M4n5ter · 2026-09-02T13:03:25Z

Summary

introduce one bounded, self-signed reachability lease as the identity-bound locator contract, independent of Peer Mesh membership
publish that lease through authenticated Host status and consume it consistently from owner connection codes, Guest mounts, Desktop profiles, and CLI projections
reject unsigned direct route arrays at the unpublished persistence and protocol boundaries, moving the compatibility boundary to epoch 98
record the frozen four-layer recovery design, invariants, and acceptance criteria used by this stack

Refs #4554

Verification

Verified on the complete stacked head after rebasing from main at eacfb46aa7ec93273bf468335f4270bba62d35a5:

npm run typecheck
npm run lint
npm run format:check
npm run rebuild
npm run test:dist - all workspace tests passed
npm run check:renderer-architecture - 71 passed
npm run check:release - 192 passed
git diff --check
cargo fmt --manifest-path native/runtime-host-peer/Cargo.toml -- --check
cargo clippy --locked --all-targets --manifest-path native/runtime-host-peer/Cargo.toml -- -D warnings
cargo test --locked --manifest-path native/runtime-host-peer/Cargo.toml - 28 passed
immutable installed-CLI tarball smoke

Review focus

The lease proves who issued a bounded locator snapshot; it does not grant membership or access. Consumers still authenticate the Runtime Host and require the expected PeerId before retaining or using the lease.

AI use

No generative tool made a substantive contribution
Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and verified the change under maintainer direction.

Checklist

Tests cover the change and fail without it
Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

Yes - described under Summary above
No

Generated-by: Codex (gpt-5.6-sol)

Let the aggregate peer endpoint owner remain the sole production lifetime lock and keep the durable publisher focused on local publication rather than remote fact verification. Generated-by: Codex (gpt-5.6-sol)

jackwener

Approved at exact head e86dc0bc8194e0dc5d1bab6a2aa26e603b19162f at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

Review notice: This approval was submitted by an automated review agent operated by WAWQAQ and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.

Two new system_note kinds and the reshaped lastRequestAnchor land in @maka/core's closed allowlists. A merge-base client handshakes on strict epoch equality and would then fail to decode the first transcript carrying them; the epoch moves so the pair refuses each other at the handshake (main is at 98 after apache#4561/apache#4568, so this lands as 99). Refs apache#4559 Generated-by: Claude Code Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

M4n5ter · 2026-09-02T13:03:25Z

Summary

introduce one bounded, self-signed reachability lease as the identity-bound locator contract, independent of Peer Mesh membership
publish that lease through authenticated Host status and consume it consistently from owner connection codes, Guest mounts, Desktop profiles, and CLI projections
reject unsigned direct route arrays at the unpublished persistence and protocol boundaries, moving the compatibility boundary to epoch 98
record the frozen four-layer recovery design, invariants, and acceptance criteria used by this stack

Refs #4554

Verification

Verified on the complete stacked head after rebasing from main at eacfb46aa7ec93273bf468335f4270bba62d35a5:

npm run typecheck
npm run lint
npm run format:check
npm run rebuild
npm run test:dist - all workspace tests passed
npm run check:renderer-architecture - 71 passed
npm run check:release - 192 passed
git diff --check
cargo fmt --manifest-path native/runtime-host-peer/Cargo.toml -- --check
cargo clippy --locked --all-targets --manifest-path native/runtime-host-peer/Cargo.toml -- -D warnings
cargo test --locked --manifest-path native/runtime-host-peer/Cargo.toml - 28 passed
immutable installed-CLI tarball smoke

Review focus

The lease proves who issued a bounded locator snapshot; it does not grant membership or access. Consumers still authenticate the Runtime Host and require the expected PeerId before retaining or using the lease.

AI use

No generative tool made a substantive contribution
Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and verified the change under maintainer direction.

Checklist

Tests cover the change and fail without it
Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

Yes - described under Summary above
No

Generated-by: Codex (gpt-5.6-sol)

Let the aggregate peer endpoint owner remain the sole production lifetime lock and keep the durable publisher focused on local publication rather than remote fact verification. Generated-by: Codex (gpt-5.6-sol)

jackwener

Approved at exact head e86dc0bc8194e0dc5d1bab6a2aa26e603b19162f at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

Review notice: This approval was submitted by an automated review agent operated by WAWQAQ and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.

Two new system_note kinds and the reshaped lastRequestAnchor land in @maka/core's closed allowlists. A merge-base client handshakes on strict epoch equality and would then fail to decode the first transcript carrying them; the epoch moves so the pair refuses each other at the handshake (main is at 98 after apache#4561/apache#4568, so this lands as 99). Refs apache#4559 Generated-by: Claude Code Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

M4n5ter · 2026-09-02T13:03:25Z

Summary

introduce one bounded, self-signed reachability lease as the identity-bound locator contract, independent of Peer Mesh membership
publish that lease through authenticated Host status and consume it consistently from owner connection codes, Guest mounts, Desktop profiles, and CLI projections
reject unsigned direct route arrays at the unpublished persistence and protocol boundaries, moving the compatibility boundary to epoch 98
record the frozen four-layer recovery design, invariants, and acceptance criteria used by this stack

Refs #4554

Verification

Verified on the complete stacked head after rebasing from main at eacfb46aa7ec93273bf468335f4270bba62d35a5:

npm run typecheck
npm run lint
npm run format:check
npm run rebuild
npm run test:dist - all workspace tests passed
npm run check:renderer-architecture - 71 passed
npm run check:release - 192 passed
git diff --check
cargo fmt --manifest-path native/runtime-host-peer/Cargo.toml -- --check
cargo clippy --locked --all-targets --manifest-path native/runtime-host-peer/Cargo.toml -- -D warnings
cargo test --locked --manifest-path native/runtime-host-peer/Cargo.toml - 28 passed
immutable installed-CLI tarball smoke

Review focus

The lease proves who issued a bounded locator snapshot; it does not grant membership or access. Consumers still authenticate the Runtime Host and require the expected PeerId before retaining or using the lease.

AI use

No generative tool made a substantive contribution
Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and verified the change under maintainer direction.

Checklist

Tests cover the change and fail without it
Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

Yes - described under Summary above
No

Generated-by: Codex (gpt-5.6-sol)

Let the aggregate peer endpoint owner remain the sole production lifetime lock and keep the durable publisher focused on local publication rather than remote fact verification. Generated-by: Codex (gpt-5.6-sol)

jackwener

Approved at exact head e86dc0bc8194e0dc5d1bab6a2aa26e603b19162f at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

Review notice: This approval was submitted by an automated review agent operated by WAWQAQ and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.

Two new system_note kinds and the reshaped lastRequestAnchor land in @maka/core's closed allowlists. A merge-base client handshakes on strict epoch equality and would then fail to decode the first transcript carrying them; the epoch moves so the pair refuses each other at the handshake (main is at 98 after apache#4561/apache#4568, so this lands as 99). Refs apache#4559 Generated-by: Claude Code Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

M4n5ter · 2026-09-02T13:03:25Z

Summary

introduce one bounded, self-signed reachability lease as the identity-bound locator contract, independent of Peer Mesh membership
publish that lease through authenticated Host status and consume it consistently from owner connection codes, Guest mounts, Desktop profiles, and CLI projections
reject unsigned direct route arrays at the unpublished persistence and protocol boundaries, moving the compatibility boundary to epoch 98
record the frozen four-layer recovery design, invariants, and acceptance criteria used by this stack

Refs #4554

Verification

Verified on the complete stacked head after rebasing from main at eacfb46aa7ec93273bf468335f4270bba62d35a5:

npm run typecheck
npm run lint
npm run format:check
npm run rebuild
npm run test:dist - all workspace tests passed
npm run check:renderer-architecture - 71 passed
npm run check:release - 192 passed
git diff --check
cargo fmt --manifest-path native/runtime-host-peer/Cargo.toml -- --check
cargo clippy --locked --all-targets --manifest-path native/runtime-host-peer/Cargo.toml -- -D warnings
cargo test --locked --manifest-path native/runtime-host-peer/Cargo.toml - 28 passed
immutable installed-CLI tarball smoke

Review focus

The lease proves who issued a bounded locator snapshot; it does not grant membership or access. Consumers still authenticate the Runtime Host and require the expected PeerId before retaining or using the lease.

AI use

No generative tool made a substantive contribution
Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and verified the change under maintainer direction.

Checklist

Tests cover the change and fail without it
Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

Yes - described under Summary above
No

Generated-by: Codex (gpt-5.6-sol)

Let the aggregate peer endpoint owner remain the sole production lifetime lock and keep the durable publisher focused on local publication rather than remote fact verification. Generated-by: Codex (gpt-5.6-sol)

jackwener

Approved at exact head e86dc0bc8194e0dc5d1bab6a2aa26e603b19162f at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

Review notice: This approval was submitted by an automated review agent operated by WAWQAQ and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.

Two new system_note kinds and the reshaped lastRequestAnchor land in @maka/core's closed allowlists. A merge-base client handshakes on strict epoch equality and would then fail to decode the first transcript carrying them; the epoch moves so the pair refuses each other at the handshake (main is at 98 after apache#4561/apache#4568, so this lands as 99). Refs apache#4559 Generated-by: Claude Code Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

github-actionsBot added the effort/XL Under 2500 readable lines label Sep 2, 2026

M4n5ter force-pushed the refactor/peer-reachability-domain branch 2 times, most recently from 897b4f2 to 0d7bf88Compare September 2, 2026 16:27

M4n5ter marked this pull request as ready for review September 2, 2026 16:27

M4n5ter force-pushed the refactor/peer-reachability-domain branch 2 times, most recently from c87e4e0 to f7207fbCompare September 2, 2026 18:46

M4n5ter added 12 commits September 3, 2026 05:45

refactor(peer): separate reachability from Mesh ownership
0c41dcf
Generated-by: Codex (gpt-5.6-sol)

fix(cli): read signed peer reachability
882bc6f
Generated-by: Codex (gpt-5.6-sol)

docs(peer): record the recovery stack baseline
4b6ca4d
Generated-by: Codex (gpt-5.6-sol)

fix(peer): enforce reachability lifetime ownership
b302a19
Generated-by: Codex (gpt-5.6-sol)

test(peer): keep reachability split layer coherent
7645533
Generated-by: Codex (gpt-5.6-sol)

fix(peer): survive local clock rollback
44a0a1c
Generated-by: Codex (gpt-5.6-sol)

docs(peer): record final stack baseline
90a4689
Generated-by: Codex (gpt-5.6-sol)

fix(peer): distinguish borrowed endpoint ownership
f5e3514
Generated-by: Codex (gpt-5.6-sol)

fix(peer): preserve endpoint ownership boundaries
08a79f1
Generated-by: Codex (gpt-5.6-sol)

refactor(peer): remove duplicate reachability identity
22f3d5c
Generated-by: Codex (gpt-5.6-sol)

fix(ci): read routes from the signed listener lease
61c7c7e
Generated-by: Codex (gpt-5.6-sol)

style(peer): format reachability publisher
c9a2ec8
Generated-by: Codex (gpt-5.6-sol)

M4n5ter force-pushed the refactor/peer-reachability-domain branch from ec71c61 to c9a2ec8Compare September 2, 2026 21:52

refactor(peer): narrow reachability publisher ownership
e86dc0b
Let the aggregate peer endpoint owner remain the sole production lifetime lock and keep the durable publisher focused on local publication rather than remote fact verification. Generated-by: Codex (gpt-5.6-sol)

jackwener approved these changes Sep 3, 2026
View reviewed changes

M4n5ter merged commit 4b24f53 into mainSep 3, 2026
15 checks passed

M4n5ter deleted the refactor/peer-reachability-domain branch September 3, 2026 00:53

Joob1n mentioned this pull request Sep 3, 2026
fix(runtime): stop estimating context fit; the provider decides, the Maka window is a user target #4574
Closed
6 tasks