feat(peer): converge Mesh reachability leases by M4n5ter · Pull Request #4568 · apache/maka

M4n5ter · 2026-09-02T14:35:49Z

Summary

separate Mesh membership presentation from generic, peer-signed reachability leases
carry signed authority reachability in invitations and exchange independently versioned leases and member advertisements through bounded symmetric reconciliation
retain bounded locator history for active members while projecting honest connecting, reachable, reconnecting, and needs_repair states
serialize native transit-policy application so concurrent evidence updates cannot let an older snapshot win
intentionally replace the unpublished Mesh wire and store shape instead of maintaining a dual protocol

Verification

Verified on the complete stacked head after rebasing from main at eacfb46aa7ec93273bf468335f4270bba62d35a5:

npm run typecheck
npm run lint
npm run format:check
npm run rebuild
npm run test:dist - all workspace tests passed
npm run check:renderer-architecture - 71 passed
npm run check:release - 192 passed
git diff --check
cargo fmt --manifest-path native/runtime-host-peer/Cargo.toml -- --check
cargo clippy --locked --all-targets --manifest-path native/runtime-host-peer/Cargo.toml -- -D warnings
cargo test --locked --manifest-path native/runtime-host-peer/Cargo.toml - 28 passed
immutable installed-CLI tarball smoke
focused Peer Mesh and reachability suites - 27 passed, including 23 Peer Mesh cases

Review focus

The convergence protocol is bounded: one rotating non-authority peer per active Mesh per pass, two evidence records per response page, one retained lease per peer, and a 24-hour recovery horizon. Receipts and completed sweeps are retained only for active remote roster members.

AI use

No generative tool made a substantive contribution
Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and verified the change under maintainer direction.

Checklist

Tests cover the change and fail without it
Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

Yes - described under Summary above
No

Generated-by: Codex (gpt-5.6-sol)

jackwener

Approved at exact head a8f119a9ceb293763163d6a70f044db80f6f69a9 at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

Review notice: This approval was submitted by an automated review agent operated by WAWQAQ and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.

Two new system_note kinds and the reshaped lastRequestAnchor land in @maka/core's closed allowlists. A merge-base client handshakes on strict epoch equality and would then fail to decode the first transcript carrying them; the epoch moves so the pair refuses each other at the handshake (main is at 98 after apache#4561/apache#4568, so this lands as 99). Refs apache#4559 Generated-by: Claude Code Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

M4n5ter · 2026-09-02T14:35:49Z

Summary

separate Mesh membership presentation from generic, peer-signed reachability leases
carry signed authority reachability in invitations and exchange independently versioned leases and member advertisements through bounded symmetric reconciliation
retain bounded locator history for active members while projecting honest connecting, reachable, reconnecting, and needs_repair states
serialize native transit-policy application so concurrent evidence updates cannot let an older snapshot win
intentionally replace the unpublished Mesh wire and store shape instead of maintaining a dual protocol

Refs #4554

Verification

Verified on the complete stacked head after rebasing from main at eacfb46aa7ec93273bf468335f4270bba62d35a5:

npm run typecheck
npm run lint
npm run format:check
npm run rebuild
npm run test:dist - all workspace tests passed
npm run check:renderer-architecture - 71 passed
npm run check:release - 192 passed
git diff --check
cargo fmt --manifest-path native/runtime-host-peer/Cargo.toml -- --check
cargo clippy --locked --all-targets --manifest-path native/runtime-host-peer/Cargo.toml -- -D warnings
cargo test --locked --manifest-path native/runtime-host-peer/Cargo.toml - 28 passed
immutable installed-CLI tarball smoke
focused Peer Mesh and reachability suites - 27 passed, including 23 Peer Mesh cases

Review focus

The convergence protocol is bounded: one rotating non-authority peer per active Mesh per pass, two evidence records per response page, one retained lease per peer, and a 24-hour recovery horizon. Receipts and completed sweeps are retained only for active remote roster members.

AI use

No generative tool made a substantive contribution
Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and verified the change under maintainer direction.

Checklist

Tests cover the change and fail without it
Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

Yes - described under Summary above
No

Generated-by: Codex (gpt-5.6-sol)

jackwener

Approved at exact head a8f119a9ceb293763163d6a70f044db80f6f69a9 at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

Review notice: This approval was submitted by an automated review agent operated by WAWQAQ and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.

Two new system_note kinds and the reshaped lastRequestAnchor land in @maka/core's closed allowlists. A merge-base client handshakes on strict epoch equality and would then fail to decode the first transcript carrying them; the epoch moves so the pair refuses each other at the handshake (main is at 98 after apache#4561/apache#4568, so this lands as 99). Refs apache#4559 Generated-by: Claude Code Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

M4n5ter · 2026-09-02T14:35:49Z

Summary

separate Mesh membership presentation from generic, peer-signed reachability leases
carry signed authority reachability in invitations and exchange independently versioned leases and member advertisements through bounded symmetric reconciliation
retain bounded locator history for active members while projecting honest connecting, reachable, reconnecting, and needs_repair states
serialize native transit-policy application so concurrent evidence updates cannot let an older snapshot win
intentionally replace the unpublished Mesh wire and store shape instead of maintaining a dual protocol

Refs #4554

Verification

Verified on the complete stacked head after rebasing from main at eacfb46aa7ec93273bf468335f4270bba62d35a5:

npm run typecheck
npm run lint
npm run format:check
npm run rebuild
npm run test:dist - all workspace tests passed
npm run check:renderer-architecture - 71 passed
npm run check:release - 192 passed
git diff --check
cargo fmt --manifest-path native/runtime-host-peer/Cargo.toml -- --check
cargo clippy --locked --all-targets --manifest-path native/runtime-host-peer/Cargo.toml -- -D warnings
cargo test --locked --manifest-path native/runtime-host-peer/Cargo.toml - 28 passed
immutable installed-CLI tarball smoke
focused Peer Mesh and reachability suites - 27 passed, including 23 Peer Mesh cases

Review focus

The convergence protocol is bounded: one rotating non-authority peer per active Mesh per pass, two evidence records per response page, one retained lease per peer, and a 24-hour recovery horizon. Receipts and completed sweeps are retained only for active remote roster members.

AI use

No generative tool made a substantive contribution
Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and verified the change under maintainer direction.

Checklist

Tests cover the change and fail without it
Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

Yes - described under Summary above
No

Generated-by: Codex (gpt-5.6-sol)

jackwener

Approved at exact head a8f119a9ceb293763163d6a70f044db80f6f69a9 at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

Review notice: This approval was submitted by an automated review agent operated by WAWQAQ and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.

Two new system_note kinds and the reshaped lastRequestAnchor land in @maka/core's closed allowlists. A merge-base client handshakes on strict epoch equality and would then fail to decode the first transcript carrying them; the epoch moves so the pair refuses each other at the handshake (main is at 98 after apache#4561/apache#4568, so this lands as 99). Refs apache#4559 Generated-by: Claude Code Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

M4n5ter · 2026-09-02T14:35:49Z

Summary

separate Mesh membership presentation from generic, peer-signed reachability leases
carry signed authority reachability in invitations and exchange independently versioned leases and member advertisements through bounded symmetric reconciliation
retain bounded locator history for active members while projecting honest connecting, reachable, reconnecting, and needs_repair states
serialize native transit-policy application so concurrent evidence updates cannot let an older snapshot win
intentionally replace the unpublished Mesh wire and store shape instead of maintaining a dual protocol

Refs #4554

Verification

Verified on the complete stacked head after rebasing from main at eacfb46aa7ec93273bf468335f4270bba62d35a5:

npm run typecheck
npm run lint
npm run format:check
npm run rebuild
npm run test:dist - all workspace tests passed
npm run check:renderer-architecture - 71 passed
npm run check:release - 192 passed
git diff --check
cargo fmt --manifest-path native/runtime-host-peer/Cargo.toml -- --check
cargo clippy --locked --all-targets --manifest-path native/runtime-host-peer/Cargo.toml -- -D warnings
cargo test --locked --manifest-path native/runtime-host-peer/Cargo.toml - 28 passed
immutable installed-CLI tarball smoke
focused Peer Mesh and reachability suites - 27 passed, including 23 Peer Mesh cases

Review focus

The convergence protocol is bounded: one rotating non-authority peer per active Mesh per pass, two evidence records per response page, one retained lease per peer, and a 24-hour recovery horizon. Receipts and completed sweeps are retained only for active remote roster members.

AI use

No generative tool made a substantive contribution
Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and verified the change under maintainer direction.

Checklist

Tests cover the change and fail without it
Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

Yes - described under Summary above
No

Generated-by: Codex (gpt-5.6-sol)

jackwener

Approved at exact head a8f119a9ceb293763163d6a70f044db80f6f69a9 at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

Review notice: This approval was submitted by an automated review agent operated by WAWQAQ and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.

Two new system_note kinds and the reshaped lastRequestAnchor land in @maka/core's closed allowlists. A merge-base client handshakes on strict epoch equality and would then fail to decode the first transcript carrying them; the epoch moves so the pair refuses each other at the handshake (main is at 98 after apache#4561/apache#4568, so this lands as 99). Refs apache#4559 Generated-by: Claude Code Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

M4n5ter · 2026-09-02T14:35:49Z

Summary

separate Mesh membership presentation from generic, peer-signed reachability leases
carry signed authority reachability in invitations and exchange independently versioned leases and member advertisements through bounded symmetric reconciliation
retain bounded locator history for active members while projecting honest connecting, reachable, reconnecting, and needs_repair states
serialize native transit-policy application so concurrent evidence updates cannot let an older snapshot win
intentionally replace the unpublished Mesh wire and store shape instead of maintaining a dual protocol

Refs #4554

Verification

Verified on the complete stacked head after rebasing from main at eacfb46aa7ec93273bf468335f4270bba62d35a5:

npm run typecheck
npm run lint
npm run format:check
npm run rebuild
npm run test:dist - all workspace tests passed
npm run check:renderer-architecture - 71 passed
npm run check:release - 192 passed
git diff --check
cargo fmt --manifest-path native/runtime-host-peer/Cargo.toml -- --check
cargo clippy --locked --all-targets --manifest-path native/runtime-host-peer/Cargo.toml -- -D warnings
cargo test --locked --manifest-path native/runtime-host-peer/Cargo.toml - 28 passed
immutable installed-CLI tarball smoke
focused Peer Mesh and reachability suites - 27 passed, including 23 Peer Mesh cases

Review focus

The convergence protocol is bounded: one rotating non-authority peer per active Mesh per pass, two evidence records per response page, one retained lease per peer, and a 24-hour recovery horizon. Receipts and completed sweeps are retained only for active remote roster members.

AI use

No generative tool made a substantive contribution
Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and verified the change under maintainer direction.

Checklist

Tests cover the change and fail without it
Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

Yes - described under Summary above
No

Generated-by: Codex (gpt-5.6-sol)

jackwener

Approved at exact head a8f119a9ceb293763163d6a70f044db80f6f69a9 at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

Review notice: This approval was submitted by an automated review agent operated by WAWQAQ and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.

Two new system_note kinds and the reshaped lastRequestAnchor land in @maka/core's closed allowlists. A merge-base client handshakes on strict epoch equality and would then fail to decode the first transcript carrying them; the epoch moves so the pair refuses each other at the handshake (main is at 98 after apache#4561/apache#4568, so this lands as 99). Refs apache#4559 Generated-by: Claude Code Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

M4n5ter · 2026-09-02T14:35:49Z

Summary

separate Mesh membership presentation from generic, peer-signed reachability leases
carry signed authority reachability in invitations and exchange independently versioned leases and member advertisements through bounded symmetric reconciliation
retain bounded locator history for active members while projecting honest connecting, reachable, reconnecting, and needs_repair states
serialize native transit-policy application so concurrent evidence updates cannot let an older snapshot win
intentionally replace the unpublished Mesh wire and store shape instead of maintaining a dual protocol

Refs #4554

Verification

Verified on the complete stacked head after rebasing from main at eacfb46aa7ec93273bf468335f4270bba62d35a5:

npm run typecheck
npm run lint
npm run format:check
npm run rebuild
npm run test:dist - all workspace tests passed
npm run check:renderer-architecture - 71 passed
npm run check:release - 192 passed
git diff --check
cargo fmt --manifest-path native/runtime-host-peer/Cargo.toml -- --check
cargo clippy --locked --all-targets --manifest-path native/runtime-host-peer/Cargo.toml -- -D warnings
cargo test --locked --manifest-path native/runtime-host-peer/Cargo.toml - 28 passed
immutable installed-CLI tarball smoke
focused Peer Mesh and reachability suites - 27 passed, including 23 Peer Mesh cases

Review focus

The convergence protocol is bounded: one rotating non-authority peer per active Mesh per pass, two evidence records per response page, one retained lease per peer, and a 24-hour recovery horizon. Receipts and completed sweeps are retained only for active remote roster members.

AI use

No generative tool made a substantive contribution
Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and verified the change under maintainer direction.

Checklist

Tests cover the change and fail without it
Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

Yes - described under Summary above
No

Generated-by: Codex (gpt-5.6-sol)

jackwener

Approved at exact head a8f119a9ceb293763163d6a70f044db80f6f69a9 at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

Review notice: This approval was submitted by an automated review agent operated by WAWQAQ and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.

Two new system_note kinds and the reshaped lastRequestAnchor land in @maka/core's closed allowlists. A merge-base client handshakes on strict epoch equality and would then fail to decode the first transcript carrying them; the epoch moves so the pair refuses each other at the handshake (main is at 98 after apache#4561/apache#4568, so this lands as 99). Refs apache#4559 Generated-by: Claude Code Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

M4n5ter · 2026-09-02T14:35:49Z

Summary

separate Mesh membership presentation from generic, peer-signed reachability leases
carry signed authority reachability in invitations and exchange independently versioned leases and member advertisements through bounded symmetric reconciliation
retain bounded locator history for active members while projecting honest connecting, reachable, reconnecting, and needs_repair states
serialize native transit-policy application so concurrent evidence updates cannot let an older snapshot win
intentionally replace the unpublished Mesh wire and store shape instead of maintaining a dual protocol

Refs #4554

Verification

Verified on the complete stacked head after rebasing from main at eacfb46aa7ec93273bf468335f4270bba62d35a5:

npm run typecheck
npm run lint
npm run format:check
npm run rebuild
npm run test:dist - all workspace tests passed
npm run check:renderer-architecture - 71 passed
npm run check:release - 192 passed
git diff --check
cargo fmt --manifest-path native/runtime-host-peer/Cargo.toml -- --check
cargo clippy --locked --all-targets --manifest-path native/runtime-host-peer/Cargo.toml -- -D warnings
cargo test --locked --manifest-path native/runtime-host-peer/Cargo.toml - 28 passed
immutable installed-CLI tarball smoke
focused Peer Mesh and reachability suites - 27 passed, including 23 Peer Mesh cases

Review focus

The convergence protocol is bounded: one rotating non-authority peer per active Mesh per pass, two evidence records per response page, one retained lease per peer, and a 24-hour recovery horizon. Receipts and completed sweeps are retained only for active remote roster members.

AI use

No generative tool made a substantive contribution
Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and verified the change under maintainer direction.

Checklist

Tests cover the change and fail without it
Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

Yes - described under Summary above
No

Generated-by: Codex (gpt-5.6-sol)

jackwener

Approved at exact head a8f119a9ceb293763163d6a70f044db80f6f69a9 at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

Review notice: This approval was submitted by an automated review agent operated by WAWQAQ and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.

Two new system_note kinds and the reshaped lastRequestAnchor land in @maka/core's closed allowlists. A merge-base client handshakes on strict epoch equality and would then fail to decode the first transcript carrying them; the epoch moves so the pair refuses each other at the handshake (main is at 98 after apache#4561/apache#4568, so this lands as 99). Refs apache#4559 Generated-by: Claude Code Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

M4n5ter · 2026-09-02T14:35:49Z

Summary

separate Mesh membership presentation from generic, peer-signed reachability leases
carry signed authority reachability in invitations and exchange independently versioned leases and member advertisements through bounded symmetric reconciliation
retain bounded locator history for active members while projecting honest connecting, reachable, reconnecting, and needs_repair states
serialize native transit-policy application so concurrent evidence updates cannot let an older snapshot win
intentionally replace the unpublished Mesh wire and store shape instead of maintaining a dual protocol

Refs #4554

Verification

Verified on the complete stacked head after rebasing from main at eacfb46aa7ec93273bf468335f4270bba62d35a5:

npm run typecheck
npm run lint
npm run format:check
npm run rebuild
npm run test:dist - all workspace tests passed
npm run check:renderer-architecture - 71 passed
npm run check:release - 192 passed
git diff --check
cargo fmt --manifest-path native/runtime-host-peer/Cargo.toml -- --check
cargo clippy --locked --all-targets --manifest-path native/runtime-host-peer/Cargo.toml -- -D warnings
cargo test --locked --manifest-path native/runtime-host-peer/Cargo.toml - 28 passed
immutable installed-CLI tarball smoke
focused Peer Mesh and reachability suites - 27 passed, including 23 Peer Mesh cases

Review focus

The convergence protocol is bounded: one rotating non-authority peer per active Mesh per pass, two evidence records per response page, one retained lease per peer, and a 24-hour recovery horizon. Receipts and completed sweeps are retained only for active remote roster members.

AI use

No generative tool made a substantive contribution
Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and verified the change under maintainer direction.

Checklist

Tests cover the change and fail without it
Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

Yes - described under Summary above
No

Generated-by: Codex (gpt-5.6-sol)

jackwener

Approved at exact head a8f119a9ceb293763163d6a70f044db80f6f69a9 at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

Review notice: This approval was submitted by an automated review agent operated by WAWQAQ and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.

Two new system_note kinds and the reshaped lastRequestAnchor land in @maka/core's closed allowlists. A merge-base client handshakes on strict epoch equality and would then fail to decode the first transcript carrying them; the epoch moves so the pair refuses each other at the handshake (main is at 98 after apache#4561/apache#4568, so this lands as 99). Refs apache#4559 Generated-by: Claude Code Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

M4n5ter force-pushed the feat/peer-mesh-reachability-convergence branch from 484fe6e to 3627604Compare September 2, 2026 16:27

M4n5ter marked this pull request as ready for review September 2, 2026 16:27

github-actionsBot added the effort/XL Under 2500 readable lines label Sep 2, 2026

M4n5ter force-pushed the feat/peer-mesh-reachability-convergence branch from 3627604 to 19edc5dCompare September 2, 2026 17:29

M4n5ter force-pushed the feat/peer-mesh-reachability-convergence branch from 19edc5d to 549a5bcCompare September 2, 2026 18:16

M4n5ter force-pushed the feat/peer-mesh-reachability-convergence branch from 549a5bc to c372473Compare September 2, 2026 18:47

M4n5ter force-pushed the feat/peer-mesh-reachability-convergence branch from c372473 to 9277728Compare September 2, 2026 19:35

M4n5ter force-pushed the feat/peer-mesh-reachability-convergence branch from 9277728 to d2241bcCompare September 2, 2026 20:01

M4n5ter force-pushed the feat/peer-mesh-reachability-convergence branch from d2241bc to a2d2042Compare September 2, 2026 20:49

M4n5ter force-pushed the feat/peer-mesh-reachability-convergence branch from f63c1c7 to 30ab6ffCompare September 2, 2026 21:53

M4n5ter added 12 commits September 3, 2026 07:49

feat(peer): converge Mesh reachability leases
ca59b5d
Generated-by: Codex (gpt-5.6-sol)

fix(peer): converge reachability recovery state
b949b8b
Generated-by: Codex (gpt-5.6-sol)

fix(peer): bind mesh authority identity
75bff96
Generated-by: Codex (gpt-5.6-sol)

refactor(peer): keep one reachability authority
56f6eb5
Generated-by: Codex (gpt-5.6-sol)

fix(peer): preserve converged mesh exports
5f4b123
Generated-by: Codex (gpt-5.6-sol)

fix(peer): adopt reachability after Mesh authorization
c37206b
Generated-by: Codex (gpt-5.6-sol)

style(peer): format Mesh reachability flow
bc56bb2
Generated-by: Codex (gpt-5.6-sol)

refactor(peer): narrow Mesh reachability receipts
d8ab2c1
Generated-by: Codex (gpt-5.6-sol)

fix(peer): bound Mesh recovery sweep state
876c69d
Generated-by: Codex (gpt-5.6-sol)

fix(peer-mesh): revalidate synchronization targets
c6956bb
Generated-by: Codex (gpt-5.6-sol)

fix(peer-mesh): preserve authenticated recovery evidence
c940305
Generated-by: Codex (gpt-5.6-sol)

fix(peer-mesh): bind anti-entropy summaries to facts
134fdd7
Generated-by: Codex (gpt-5.6-sol)

fix(peer-mesh): verify reachability at trust boundary
a8f119a
Generated-by: Codex (gpt-5.6-sol)

M4n5ter force-pushed the feat/peer-mesh-reachability-convergence branch from 7d2da11 to a8f119aCompare September 2, 2026 23:56

jackwener approved these changes Sep 3, 2026
View reviewed changes

M4n5ter merged commit b3a36db into mainSep 3, 2026
13 checks passed

M4n5ter deleted the feat/peer-mesh-reachability-convergence branch September 3, 2026 00:53

Joob1n mentioned this pull request Sep 3, 2026
fix(runtime): stop estimating context fit; the provider decides, the Maka window is a user target #4574
Closed
6 tasks