mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
Michael Neale
ce4e1503f7
Buzz decides membership; mesh enforces it — the idiomatic split: - Every Buzz-managed node gets an auto-initialized mesh owner identity (mesh-llm auth init, cached at mesh-node/owner.key) and runs with --owner-key --owner-required --trust-policy allowlist. - The relay's kind:30621 sanitizer now carries the reporter's VERIFIED owner id (unverified claims are dropped), so the membership-gated status pipeline doubles as the trust-allowlist distribution channel. - Desktops build --trust-owner lists from those events at node start (trusted_owner_ids_from_events); own owner id always included. - Invite tokens remain dial metadata only. Proven by an ignored 3-node e2e (mesh_trust_allowlist_admits_member_rejects_stranger): a peer with an allowlisted owner is admitted; a stranger holding the SAME valid invite token never enters the peer table. - mesh-llm added to KNOWN_AGENT_BINARIES and the node stamped with BUZZ_MANAGED_AGENT, so the orphan sweep reclaims crash leftovers without touching user-run standalone mesh-llm processes. - Public iroh relays stay disabled (v1 posture): reachability continues to flow through the relay's membership-validated call-me-now pairing.