kayg/infraternal
Watch
1
0
Fork
You've already forked infraternal
 0
Code Issues 356 Pull requests Projects Releases Packages Wiki Activity Actions

Mac mesh break-it on dev 9b0c731e8 (J267) #375

New issue
Open
opened 2026-11-05 22:55:30 +00:00 by kayg · 5 comments
kayg commented 2026-11-05 22:55:30 +00:00
Owner
Copy link

J267 break-it tester. Measure and break the merged dev mesh stack (GotaTun, mesh, mesh SSH, mesh DNS) with the macOS VM as a mesh node and compute01 as the Linux end. Report only, no code fixes.

Links: #260 (GotaTun perf), #285 (Mac parity). Decisions: D166, D327, D340, D346, D348, D352.

Base: origin/dev 9b0c731e89

Plan (estimate ~3 h):

  1. Build the release CLI on the Mac at the base SHA; measure Mac <-> compute01 over GotaTun vs the plain path (iperf3 1 and 8 flows, p99 ping RTT). Measurement, not a gate.
  2. Break cases on the Mac node: kill -9 mid-transfer + restart, interface down/up, revoke mid-flow (and after restart), userspace packet filter allowed vs denied port, mesh DNS resolve + revoked name stops resolving, stale run/state after crash, D166 no rotation in a mesh with a Mac.
  3. One issue per real bug with a reproducer, ranked by severity.
  4. Clean up Mac + Linux, release mac lock and mesh-vm claim, delete scratch targets.
J267 break-it tester. Measure and break the merged dev mesh stack (GotaTun, mesh, mesh SSH, mesh DNS) with the macOS VM as a mesh node and compute01 as the Linux end. Report only, no code fixes. Links: #260 (GotaTun perf), #285 (Mac parity). Decisions: D166, D327, D340, D346, D348, D352. Base: origin/dev 9b0c731e89b70408ac719ef3a10cb1bf36bebf99 Plan (estimate ~3 h): 1. Build the release CLI on the Mac at the base SHA; measure Mac <-> compute01 over GotaTun vs the plain path (iperf3 1 and 8 flows, p99 ping RTT). Measurement, not a gate. 2. Break cases on the Mac node: kill -9 mid-transfer + restart, interface down/up, revoke mid-flow (and after restart), userspace packet filter allowed vs denied port, mesh DNS resolve + revoked name stops resolving, stale run/state after crash, D166 no rotation in a mesh with a Mac. 3. One issue per real bug with a reproducer, ranked by severity. 4. Clean up Mac + Linux, release mac lock and mesh-vm claim, delete scratch targets.
kayg commented 2026-11-05 23:07:37 +00:00
Author
Owner
Copy link

J267 start (Claude Opus 5.5). Review/break-it job, no code changes, so no branch of my own.

  • Base: origin/dev 9b0c731e89b70408ac719ef3a10cb1bf36bebf99.
  • Worktrees: claude@compute01:~/worktrees/j267, lume@mac:~/worktrees/j267 (detached at the base).
  • Builds: compute01 static x86 server (--features desktop) plus web UI, through build-slot (log ~/.cache/codex-scratch/j267/logs/build.log). Mac: cargo build --locked --release -p infraternal under lockf /tmp/mac-bench.lock (log ~/j267-evidence/build.log).
  • Setup (from J80 and J255): a throwaway root server on compute01 with private data, ports and a private software passkey. Its embedded agent is the Linux GotaTun node. The Mac enrolls with a key-bound invitation (POST /remote/invitations, agent join), then mesh up starts the launchd node.
  • ~/mesh-vm.claim on compute01 is held by J175, so the Linux side waits for it. Builds and the Mac-only checks run now.
  • Mac pre-existing state: /var/lib/infraternal/{agent,state,bin,j80-preserve,j80d-preserve} plus the plist, all from J80, with the service unloaded. I'll snapshot it before I touch it and restore it at cleanup.
**J267 start** (Claude Opus 5.5). Review/break-it job, no code changes, so no branch of my own. - Base: origin/dev `9b0c731e89b70408ac719ef3a10cb1bf36bebf99`. - Worktrees: `claude@compute01:~/worktrees/j267`, `lume@mac:~/worktrees/j267` (detached at the base). - Builds: compute01 static x86 server (`--features desktop`) plus web UI, through build-slot (log `~/.cache/codex-scratch/j267/logs/build.log`). Mac: `cargo build --locked --release -p infraternal` under `lockf /tmp/mac-bench.lock` (log `~/j267-evidence/build.log`). - Setup (from J80 and J255): a throwaway root server on compute01 with private data, ports and a private software passkey. Its embedded agent is the Linux GotaTun node. The Mac enrolls with a key-bound invitation (`POST /remote/invitations`, `agent join`), then `mesh up` starts the launchd node. - `~/mesh-vm.claim` on compute01 is held by J175, so the Linux side waits for it. Builds and the Mac-only checks run now. - Mac pre-existing state: `/var/lib/infraternal/{agent,state,bin,j80-preserve,j80d-preserve}` plus the plist, all from J80, with the service unloaded. I'll snapshot it before I touch it and restore it at cleanup.
kayg commented 2026-11-05 23:58:13 +00:00
Author
Owner
Copy link

J267 progress (05:30 IST). Both builds are done at 9b0c731e8:

  • Mac: cargo build --locked --release -p infraternal, Finished release in 34m 12s, sha256 2f9863b217ba07b2c99f69403852e4194898b5f02582c176f528e9fb5f254d12. otool -L shows only Security, CoreFoundation, /usr/lib/libiconv, /usr/lib/libSystem. GotaTun comes from the fork (kaygdotorg/gotatun?rev=84b7bb28). Log: lume@mac:~/j267-evidence/build.log.
  • compute01: static x86 server, --features desktop, plus the web build. sha256 a49e75df457a52e1f70abb80bdf07d00bcb05771a0536efad23e057dd584e2f7. Log: ~claude/.cache/codex-scratch/j267/logs/build.log. The first attempt failed only because I skipped scripts/auth-toolchain (no zig, exit 127). That was my error, not a dev bug.

What the shipped binaries contain (string counts, lume@mac:~/j267-evidence/strings-check.txt):

  • hickory = 0 in the Mac binary and 0 in the Linux server binary. Mesh DNS (D327) sits behind the mesh-dns-spike feature (crates/plugins/mesh/Cargo.toml:30), and its module is Linux-only (lib.rs:71, cfg(all(feature = "mesh-dns-spike", target_os = "linux"))). No release build, Mac or Linux, can answer mesh DNS on dev. The live test confirms it below.
  • The Mac has no userspace packet filter on dev: macos_node.rs has ENFORCEMENT = "unavailable", and installed_peers installs only peers whose inbound policy is All, plus the coordinator. So D340 isn't merged yet, and the coordinator host reaches every port on the Mac, a gap the owner accepted under #265 J162 F1. The live test checks the fail-closed behaviour instead.
  • D166 scheduled WireGuard rotation isn't on dev. It's on #285 trust-285-b, which isn't merged. On dev, the Mac's only key changes are macos_key's re-registrations (enrolment change, ad-hoc keychain denial).

Baseline, plain path, Mac VM → compute01 over NetBird 10.69.69.218 (the only route between them; WAN, about 143 ms). Load on compute01 was 9.2 → 18.8, because builds were running. Data: lume@mac:~/j267-evidence/m-baseline-netbird/.

ping-idle.txt        n=300 p50=143.25 p99=178.85 max=213.10 sent/recv=300/300
ping-loaded-down.txt n=240 p50=143.10 p99=174.45 max=184.59 sent/recv=240/240
ping-loaded-up.txt   n=240 p50=143.29 p99=188.43 max=251.01 sent/recv=240/240
iperf-P1-down.json 132.4 Mbit/s retrans=138
iperf-P1-up.json    93.0 Mbit/s retrans=30
iperf-P8-down.json 374.1 Mbit/s retrans=34885
iperf-P8-up.json   161.6 Mbit/s retrans=1862

Up = Mac → Linux. Down = Linux → Mac (-R). iperf3 3.21: 12 s per run, 2 s omitted at the start.

Waiting: ~/mesh-vm.claim is still J175's (its verify fast is running). The throwaway server is staged in root@compute01:/root/j267/ and starts once the claim is free. The Mac's J80 state is snapshotted in /var/root/j267-preserve/var-lib-infraternal.tar (root-only; sha256 6103614a…efc1).

**J267 progress (05:30 IST).** Both builds are done at `9b0c731e8`: - **Mac:** `cargo build --locked --release -p infraternal`, `Finished release in 34m 12s`, sha256 `2f9863b217ba07b2c99f69403852e4194898b5f02582c176f528e9fb5f254d12`. `otool -L` shows only Security, CoreFoundation, `/usr/lib/libiconv`, `/usr/lib/libSystem`. GotaTun comes from the fork (`kaygdotorg/gotatun?rev=84b7bb28`). Log: `lume@mac:~/j267-evidence/build.log`. - **compute01:** static x86 server, `--features desktop`, plus the web build. sha256 `a49e75df457a52e1f70abb80bdf07d00bcb05771a0536efad23e057dd584e2f7`. Log: `~claude/.cache/codex-scratch/j267/logs/build.log`. The first attempt failed only because I skipped `scripts/auth-toolchain` (no zig, exit 127). That was my error, not a dev bug. **What the shipped binaries contain** (string counts, `lume@mac:~/j267-evidence/strings-check.txt`): - `hickory` = 0 in the Mac binary and 0 in the Linux server binary. Mesh DNS (D327) sits behind the `mesh-dns-spike` feature (`crates/plugins/mesh/Cargo.toml:30`), and its module is Linux-only (`lib.rs:71`, `cfg(all(feature = "mesh-dns-spike", target_os = "linux"))`). **No release build, Mac or Linux, can answer mesh DNS on dev.** The live test confirms it below. - The Mac has no userspace packet filter on dev: `macos_node.rs` has `ENFORCEMENT = "unavailable"`, and `installed_peers` installs only peers whose inbound policy is `All`, plus the coordinator. So D340 isn't merged yet, and the coordinator host reaches every port on the Mac, a gap the owner accepted under #265 J162 F1. The live test checks the fail-closed behaviour instead. - D166 scheduled WireGuard rotation isn't on dev. It's on #285 `trust-285-b`, which isn't merged. On dev, the Mac's only key changes are `macos_key`'s re-registrations (enrolment change, ad-hoc keychain denial). **Baseline, plain path, Mac VM → compute01** over NetBird `10.69.69.218` (the only route between them; WAN, about 143 ms). Load on compute01 was 9.2 → 18.8, because builds were running. Data: `lume@mac:~/j267-evidence/m-baseline-netbird/`. ``` ping-idle.txt n=300 p50=143.25 p99=178.85 max=213.10 sent/recv=300/300 ping-loaded-down.txt n=240 p50=143.10 p99=174.45 max=184.59 sent/recv=240/240 ping-loaded-up.txt n=240 p50=143.29 p99=188.43 max=251.01 sent/recv=240/240 iperf-P1-down.json 132.4 Mbit/s retrans=138 iperf-P1-up.json 93.0 Mbit/s retrans=30 iperf-P8-down.json 374.1 Mbit/s retrans=34885 iperf-P8-up.json 161.6 Mbit/s retrans=1862 ``` Up = Mac → Linux. Down = Linux → Mac (`-R`). iperf3 3.21: 12 s per run, 2 s omitted at the start. **Waiting:** `~/mesh-vm.claim` is still J175's (its `verify fast` is running). The throwaway server is staged in `root@compute01:/root/j267/` and starts once the claim is free. The Mac's J80 state is snapshotted in `/var/root/j267-preserve/var-lib-infraternal.tar` (root-only; sha256 `6103614a…efc1`).
kayg commented 2026-11-06 01:08:19 +00:00
Author
Owner
Copy link

J267: measurement, Mac VM ↔ compute01 over GotaTun (dev 9b0c731e8)

Setup: a throwaway root server on compute01 (/root/j267, private data, CA and ports 45267/45268). Its embedded agent is the Linux mesh node: GotaTun, infraternal0 10.254.0.1, MTU 1380. The Mac enrolled through a key-bound invitation and agent join, then mesh up started the launchd node: utun4 10.254.0.2, MTU 1280, fork GotaTun. The only route between the two hosts is NetBird (wt0 / utun100, MTU 1280, about 143 ms RTT), so the mesh runs inside NetBird. Mesh default policy: Allow. This is a measurement, not a benchmark gate: a WAN path, shared hosts, and compute01 at load 9–19 from other jobs' builds.

Commands (Mac, under lockf /tmp/mac-bench.lock): ~/j267-evidence/measure.sh <target> <label>, which runs sudo ping -c 300 -i 0.05 idle, iperf3 -c <target> -p 45269 -t 12 -O 2 -P {1,8} [-R] -J, and during the 1-flow runs ping -c 240 -i 0.05 (loaded). The server is iperf3 -s -B <addr> -p 45269 on compute01. Up = Mac → Linux. Down = Linux → Mac.

Path 1 flow up 1 flow down 8 flows up 8 flows down idle RTT p50 / p99 loaded p99 up / down (loss)
Plain (NetBird), run 1 93.0 132.4 161.6 374.1 143.3 / 178.9 ms 188.4 / 174.5 ms (0 / 0)
Mesh (GotaTun) 119.2 0.5 125.3 33.5 144.0 / 177.4 ms 237.1 / 211.5 ms (2/240, 8/240)
Plain (NetBird), run 2, right after 63.8 145.1 297.8 529.4 143.5 / 172.6 ms 255.0 / 149.2 ms (0 / 0)

All in Mbit/s. Idle latency: the mesh adds under 1 ms. Upload is on par with the plain path. Download collapses. Evidence: lume@mac:~/j267-evidence/m-{baseline-netbird,mesh-gotatun,baseline-netbird-2}/summary.txt plus the raw JSON.

Finding F1 (P2, performance): Linux → Mac mesh TCP collapses when the underlay MTU is below the mesh MTU + overhead

  • Per-second throughput, 1 flow down: [0.0, 0.0, 0.0, 0.0, 1.08, 0.0, 1.16, 0.97, 0.0, 0.97, 0.0, 1.2, 0.96] Mbit/s, MSS 1228. A repeat with the Linux iperf3 client sending to an iperf3 server on the Mac's mesh address gave 0.2 Mbit/s, 317 retransmits (claude@compute01:~/.cache/codex-scratch/j267/evidence/l2m-mss/).
  • Cause: the mesh MTU is a constant (gotatun_tun.rs:30 MESH_MTU = 1380, macos_node.rs:49 UTUN_MTU = 1280). Nothing derives it from the route to the peer's endpoint. TCP picks MSS 1228 from the Mac's 1280, so a full inner packet is 1280 B, and the GotaTun datagram is 1280 + 32 + 8 + 20 = 1340 B, which exceeds the 1280 underlay. Every full-size packet fragments outside the tunnel.
  • UDP by size, Linux → Mac (iperf3 -u -t 8, …/evidence/l2m-udp/summary.txt):
Path, datagram, rate Loss
mesh, 1100 B (outer 1228, unfragmented), 20M / 80M 0.00% / 0.80%
mesh, 1200 B (outer 1328, fragmented), 20M ×3 37.7%, 19.4%, 19.2%
mesh, 1200 B, 80M 12.5% (sender also stalled: 14,309 of about 66k datagrams)
plain, 1200 B (1228, unfragmented), 20M / 80M 0% / 0%
plain, 1300 B (1328, fragmented), 20M ×3 0%, 0% (3.8 Mbit/s received), 69.4%
plain, 1300 B, 80M 78.2%
  • So the drops come from fragments crossing this underlay, on both paths. GotaTun itself doesn't drop anything here (unfragmented mesh traffic is clean). The product problem is that the mesh always sends packets the underlay must fragment, and Mac reassembly over this path loses them, so a mesh flow towards the Mac stalls while the plain path stays at 130+ Mbit/s. Mac → Linux (Linux reassembles) is unaffected.
  • Where it bites outside this lab: any underlay with MTU below 1340 towards a Mac, or below 1440/1460 between Linux nodes (IPv4/IPv6 outer). Examples are another VPN, some mobile links and 1280-MTU IPv6 paths. compute01's own eth0 is 1450, so even a Linux ↔ Linux mesh over IPv6 there would fragment at 1380.
  • Repro: mesh between a Mac and a Linux node whose only route crosses a 1280-MTU link, then iperf3 -c <mac mesh ip> from Linux. Expected: throughput near the plain path. Actual: under 1 Mbit/s.
  • Rejected explanations: an MTU black hole (no: 1252-byte pings, so 1280 inner, pass both ways) and GotaTun loss (no: 0% for unfragmented sizes).
  • A fix direction to decide: per-peer path MTU (probe or derive from the endpoint route) or an MSS clamp on the mesh interface. I'm not choosing; it's a foundational transport choice.

Break cases come next.

**J267: measurement, Mac VM ↔ compute01 over GotaTun (dev `9b0c731e8`)** Setup: a throwaway root server on compute01 (`/root/j267`, private data, CA and ports 45267/45268). Its embedded agent is the Linux mesh node: GotaTun, `infraternal0` 10.254.0.1, MTU 1380. The Mac enrolled through a key-bound invitation and `agent join`, then `mesh up` started the launchd node: `utun4` 10.254.0.2, MTU 1280, fork GotaTun. The only route between the two hosts is NetBird (`wt0` / `utun100`, MTU 1280, about 143 ms RTT), so the mesh runs inside NetBird. Mesh default policy: Allow. This is a measurement, not a benchmark gate: a WAN path, shared hosts, and compute01 at load 9–19 from other jobs' builds. Commands (Mac, under `lockf /tmp/mac-bench.lock`): `~/j267-evidence/measure.sh <target> <label>`, which runs `sudo ping -c 300 -i 0.05` idle, `iperf3 -c <target> -p 45269 -t 12 -O 2 -P {1,8} [-R] -J`, and during the 1-flow runs `ping -c 240 -i 0.05` (loaded). The server is `iperf3 -s -B <addr> -p 45269` on compute01. Up = Mac → Linux. Down = Linux → Mac. | Path | 1 flow up | 1 flow down | 8 flows up | 8 flows down | idle RTT p50 / p99 | loaded p99 up / down (loss) | |---|---:|---:|---:|---:|---:|---:| | Plain (NetBird), run 1 | 93.0 | 132.4 | 161.6 | 374.1 | 143.3 / 178.9 ms | 188.4 / 174.5 ms (0 / 0) | | **Mesh (GotaTun)** | **119.2** | **0.5** | **125.3** | **33.5** | 144.0 / 177.4 ms | 237.1 / 211.5 ms (2/240, 8/240) | | Plain (NetBird), run 2, right after | 63.8 | 145.1 | 297.8 | 529.4 | 143.5 / 172.6 ms | 255.0 / 149.2 ms (0 / 0) | All in Mbit/s. Idle latency: the mesh adds under 1 ms. Upload is on par with the plain path. **Download collapses.** Evidence: `lume@mac:~/j267-evidence/m-{baseline-netbird,mesh-gotatun,baseline-netbird-2}/summary.txt` plus the raw JSON. ### Finding F1 (P2, performance): Linux → Mac mesh TCP collapses when the underlay MTU is below the mesh MTU + overhead - Per-second throughput, 1 flow down: `[0.0, 0.0, 0.0, 0.0, 1.08, 0.0, 1.16, 0.97, 0.0, 0.97, 0.0, 1.2, 0.96]` Mbit/s, MSS 1228. A repeat with the Linux iperf3 client sending to an iperf3 server on the Mac's mesh address gave 0.2 Mbit/s, 317 retransmits (`claude@compute01:~/.cache/codex-scratch/j267/evidence/l2m-mss/`). - Cause: the mesh MTU is a constant (`gotatun_tun.rs:30 MESH_MTU = 1380`, `macos_node.rs:49 UTUN_MTU = 1280`). Nothing derives it from the route to the peer's endpoint. TCP picks MSS 1228 from the Mac's 1280, so a full inner packet is 1280 B, and the GotaTun datagram is 1280 + 32 + 8 + 20 = 1340 B, which exceeds the 1280 underlay. Every full-size packet fragments outside the tunnel. - UDP by size, Linux → Mac (`iperf3 -u -t 8`, `…/evidence/l2m-udp/summary.txt`): | Path, datagram, rate | Loss | |---|---| | mesh, 1100 B (outer 1228, unfragmented), 20M / 80M | 0.00% / 0.80% | | mesh, 1200 B (outer 1328, fragmented), 20M ×3 | 37.7%, 19.4%, 19.2% | | mesh, 1200 B, 80M | 12.5% (sender also stalled: 14,309 of about 66k datagrams) | | plain, 1200 B (1228, unfragmented), 20M / 80M | 0% / 0% | | plain, 1300 B (1328, fragmented), 20M ×3 | 0%, 0% (3.8 Mbit/s received), 69.4% | | plain, 1300 B, 80M | 78.2% | - So the drops come from fragments crossing this underlay, on both paths. GotaTun itself doesn't drop anything here (unfragmented mesh traffic is clean). The product problem is that the mesh always sends packets the underlay must fragment, and Mac reassembly over this path loses them, so a mesh flow towards the Mac stalls while the plain path stays at 130+ Mbit/s. Mac → Linux (Linux reassembles) is unaffected. - Where it bites outside this lab: any underlay with MTU below 1340 towards a Mac, or below 1440/1460 between Linux nodes (IPv4/IPv6 outer). Examples are another VPN, some mobile links and 1280-MTU IPv6 paths. compute01's own `eth0` is 1450, so even a Linux ↔ Linux mesh over IPv6 there would fragment at 1380. - Repro: mesh between a Mac and a Linux node whose only route crosses a 1280-MTU link, then `iperf3 -c <mac mesh ip>` from Linux. Expected: throughput near the plain path. Actual: under 1 Mbit/s. - Rejected explanations: an MTU black hole (no: 1252-byte pings, so 1280 inner, pass both ways) and GotaTun loss (no: 0% for unfragmented sizes). - A fix direction to decide: per-peer path MTU (probe or derive from the endpoint route) or an MSS clamp on the mesh interface. I'm not choosing; it's a foundational transport choice. Break cases come next.
kayg commented 2026-11-06 01:36:23 +00:00
Author
Owner
Copy link

J267 progress (07:05 IST): break cases 1, 2, 4 and 5 done. Case 6 is blocked by the Mac lock.

# Case Expected Actual Evidence
1 kill -9 of the Mac mesh daemon during a 45 s upload launchd restarts it; utun, address and routes return; the flow survives; no key change Pass. pid 36534 → 38680 in about 1 s (runs 2 → 3). utun4 10.254.0.2 and both routes back. Rotation log unchanged (10 lines). Upload dipped from about 120 to 22–50 Mbit/s and recovered; 1 of 249 pings lost lume@mac:~/j267-evidence/case1-kill/
2a ifconfig utun4 down for 10 s mid-flow traffic stops while down, resumes after up, daemon untouched Pass. Same pid, no rotation. Ping gap seq 32–66. The flow resumed about 2 s after up and climbed back to 140 Mbit/s …/case2a-utun/
2b underlay en0 down for 11 s mid-flow (NetBird rebuilt utun100 too) the mesh recovers by itself Pass. Same pid, no rotation, utun4 and routes intact. Pings back about 2 s after en0 up; TCP back after its RTO backoff, ramping to about 90 Mbit/s …/case2b-en0/
2c sleep/wake – Not attempted. This Virtualization.framework VM has no reliable wake source, so 2b stands in for it –
4 Access rules, default Deny only granted ports pass, each way Mac → Linux (Linux node enforces): with no grant only the control plane 45268 passes, and 45267/45269/45271 are refused. Grant Mac→Linux tcp/45269: 45269 connects, 45271 refused. Linux → Mac, grant tcp/45270: 45270 connects; 45272 and 22 time out at the Linux egress set. The Mac itself enforces nothing. With 10.254.0.2 . 45272 and . 22 added to Linux's outgoing4_tcp (standing in for a peer that ignores the rules), the Mac accepts 45272 and its sshd on 22. This is the documented gap (macos_node.rs ENFORCEMENT="unavailable", #265 J162 F1, D340 not merged yet), confirmed live, so no new issue. Elements removed afterwards /tmp/j267-case4-bypass.txt (copied to compute01 evidence)
5 Mesh DNS from the Mac names resolve; a revoked peer's name stops Not available on dev. Nothing answers on 10.254.0.1:53 or 10.254.0.2:53 (dig times out). No /etc/resolver, no scutil resolver for internal, and Linux resolvectl reports "not found". The only cause in the code: D327 DNS is behind mesh-dns-spike, Linux-only, enabled in no release (0 hickory strings in either binary). The revoked-name half can't be tested until it ships dig output in the job log

Correction to my 05:30 comment: WireGuard rotation (#285) is on dev now. It merged at 363d95468, after my base 9b0c731e8 (origin/dev moved to 0b72f638a during this run). My statement held for the base, but D166 can now be tested, so I'm rebuilding both sides at 0b72f638a (Linux queued in build-slot). The D166 case will run on that build, against a fresh server.

Candidate P3 (setup UX): on a Mac already enrolled with another server, agent prepare-join-key <new origin> prints the old identity's key digest (remote.rs:291 prepared_key reuses identity.json). agent join then refuses that invitation on purpose (remote.rs:471, different server), with only "Remote infraternal agent operation failed". J80c lost time to the same trap (#265, 76774). The fix belongs in the CLI wording or in prepare-join-key refusing. Not filed separately yet.

Blocked now: the Mac lock (/tmp/mac-bench.lock) has been held for 16+ minutes by an idle interactive shell (netbird ssh exec … lockf -k /tmp/mac-bench.lock bash -l, pid 40239, not mine), so case 6 (revoke) is queued. The node delete already landed (revision 6, Linux sets emptied at 01:23:18 UTC); the Mac part will show whether traffic stays stopped across kill -9 and mesh down/up. Whoever holds the lock: please take it per step only.

**J267 progress (07:05 IST): break cases 1, 2, 4 and 5 done. Case 6 is blocked by the Mac lock.** | # | Case | Expected | Actual | Evidence | |---|---|---|---|---| | 1 | `kill -9` of the Mac mesh daemon during a 45 s upload | launchd restarts it; utun, address and routes return; the flow survives; no key change | **Pass.** pid 36534 → 38680 in about 1 s (`runs` 2 → 3). `utun4` 10.254.0.2 and both routes back. Rotation log unchanged (10 lines). Upload dipped from about 120 to 22–50 Mbit/s and recovered; 1 of 249 pings lost | `lume@mac:~/j267-evidence/case1-kill/` | | 2a | `ifconfig utun4 down` for 10 s mid-flow | traffic stops while down, resumes after `up`, daemon untouched | **Pass.** Same pid, no rotation. Ping gap seq 32–66. The flow resumed about 2 s after `up` and climbed back to 140 Mbit/s | `…/case2a-utun/` | | 2b | underlay `en0` down for 11 s mid-flow (NetBird rebuilt `utun100` too) | the mesh recovers by itself | **Pass.** Same pid, no rotation, `utun4` and routes intact. Pings back about 2 s after `en0` up; TCP back after its RTO backoff, ramping to about 90 Mbit/s | `…/case2b-en0/` | | 2c | sleep/wake | – | **Not attempted.** This Virtualization.framework VM has no reliable wake source, so 2b stands in for it | – | | 4 | Access rules, default **Deny** | only granted ports pass, each way | **Mac → Linux** (Linux node enforces): with no grant only the control plane 45268 passes, and 45267/45269/45271 are refused. Grant Mac→Linux tcp/45269: 45269 connects, 45271 refused. **Linux → Mac**, grant tcp/45270: 45270 connects; 45272 and 22 time out at the **Linux egress** set. **The Mac itself enforces nothing.** With `10.254.0.2 . 45272` and `. 22` added to Linux's `outgoing4_tcp` (standing in for a peer that ignores the rules), the Mac accepts 45272 and its sshd on 22. This is the documented gap (`macos_node.rs` `ENFORCEMENT="unavailable"`, #265 J162 F1, D340 not merged yet), confirmed live, so no new issue. Elements removed afterwards | `/tmp/j267-case4-bypass.txt` (copied to compute01 evidence) | | 5 | Mesh DNS from the Mac | names resolve; a revoked peer's name stops | **Not available on dev.** Nothing answers on 10.254.0.1:53 or 10.254.0.2:53 (`dig` times out). No `/etc/resolver`, no `scutil` resolver for `internal`, and Linux `resolvectl` reports "not found". The only cause in the code: D327 DNS is behind `mesh-dns-spike`, Linux-only, enabled in no release (0 `hickory` strings in either binary). The revoked-name half can't be tested until it ships | dig output in the job log | **Correction to my 05:30 comment:** WireGuard rotation (#285) **is** on dev now. It merged at `363d95468`, **after** my base `9b0c731e8` (origin/dev moved to `0b72f638a` during this run). My statement held for the base, but D166 can now be tested, so I'm rebuilding both sides at `0b72f638a` (Linux queued in build-slot). The D166 case will run on that build, against a fresh server. **Candidate P3 (setup UX):** on a Mac already enrolled with another server, `agent prepare-join-key <new origin>` prints the **old** identity's key digest (`remote.rs:291` `prepared_key` reuses `identity.json`). `agent join` then refuses that invitation on purpose (`remote.rs:471`, different server), with only "Remote infraternal agent operation failed". J80c lost time to the same trap (#265, 76774). The fix belongs in the CLI wording or in `prepare-join-key` refusing. Not filed separately yet. **Blocked now:** the Mac lock (`/tmp/mac-bench.lock`) has been held for 16+ minutes by an idle interactive shell (`netbird ssh exec … lockf -k /tmp/mac-bench.lock bash -l`, pid 40239, not mine), so case 6 (revoke) is queued. The node delete already landed (revision 6, Linux sets emptied at 01:23:18 UTC); the Mac part will show whether traffic stays stopped across `kill -9` and `mesh down/up`. Whoever holds the lock: please take it per step only.
kayg commented 2026-11-06 02:38:15 +00:00
Author
Owner
Copy link

J267 final: Mac mesh break-it. This was a review/measurement job: no code changed, so the gate doesn't apply. Bases: dev 9b0c731e8 (measurement, cases 1–6), plus dev 0b72f638a for D166, because #285 merged mid-run at 363d95468.

Measurement (Mac VM ↔ compute01, NetBird underlay MTU 1280, ~143 ms; Mbit/s; full table in the "J267: measurement" comment)

Path 1 flow up / down 8 flows up / down idle RTT p99
Plain (two runs) 93.0 / 132.4 · 63.8 / 145.1 161.6 / 374.1 · 297.8 / 529.4 178.9 · 172.6 ms
GotaTun mesh 119.2 / 0.5 125.3 / 33.5 177.4 ms (adds under 1 ms)

Uploads over the mesh match the plain path. Downloads to the Mac collapse because of outer fragmentation (#381).

Break cases (Mac as the mesh node, Linux = the server's embedded agent)

# Case Result
1 kill -9 of the Mac daemon mid-transfer Pass. launchd restart in about 1 s, utun and routes back, flow survives, no key change
2a/2b utun4 down/up; underlay en0 down 11 s Pass both. Same daemon, recovery about 2 s after up. Sleep/wake not attempted (VM)
4 Access rules, default Deny Linux side: pass in both directions (granted ports pass, others are refused). The Mac enforces nothing itself: documented gap until D340, confirmed live including sshd :22, no new issue
5 Mesh DNS Not available. No release build includes it (mesh-dns-spike, Linux-only), so nothing answers. The revoked-name half can't be tested
6 Mesh node delete, then kill -9 and mesh down/up Pass. Stays cut; no auto re-join (tombstone)
6b Host revocation mid-flow Pass. 105 → 0 Mbit/s at the revoke; Linux drops the Mac within about 3 s; stays cut after kill -9 and down/up
7 Stale /run/state after a crash Linux node: fail (#382). Mac: re-enrolment forgets the old state correctly, but mesh status says "running" while cut off (#383)
D166 Rotation in a mesh with a Mac (kernel-engine Linux node, interval 120 s) Pass. Control: the Linux-only mesh rotated twice. With the Mac enrolled: no rotation for 301 s (2.5 periods), peer_unsupported. Mac deleted → rotation started within 3 s. Mixed version: a 9b0c Mac counts as non-rotating

Findings (issues filed, each with a reproducer)

  • P1: none.
  • P2: #379 dev doesn't build on macOS since the #285 merge (restart.rs SO_PEERCRED). #380 nodes built before #285 get no mesh from an upgraded server, silently (Peer.previous_active against deny_unknown_fields). #381 Linux → Mac throughput collapse from the fixed MTU. #382 stale node state refuses a new or restored server's snapshots (J255 F4; may be P1 if restore-from-backup is supported).
  • P3: #383 infraternal status says "not set up" on an enrolled Mac, and cut-off nodes look healthy. #384 prepare-join-key returns the old server's digest. #385 every completed rotation logs an ERROR at store.rs:199.
  • Noted, not filed (not reproduced cleanly in a real browser): on a fresh server, the "Unlock" toast's button was covered by div.cl-region in my headless driver and needed a JS click, and the toast said "The server restarted" on a brand-new server. Also, invitations returned 503 for a few seconds after a reported unlock.

Cleanup

  • Mac: service stopped (unloaded and launchd-disabled, as mesh down leaves it). /var/lib/infraternal and the plist restored to the J80 state from my snapshot: the same files and dates, binary 7dcc2272…, plist byte-identical. The only exception is the stale 3 Nov plugins.sock socket, which tar can't archive; the next daemon start recreates it. Hosts line, listeners, preserve dir (with throwaway keys) and worktree removed. Kept: ~/j267-evidence (1 MB).
  • compute01: throwaway servers, embedded agents and 3 orphan shims stopped by PID. infraternal0 and inet infraternal_mesh deleted (neither existed before). /run/infraternal restored to what I found: the two stale J255-F4 files, hashes checked, empty sessions. /root/j267 deleted. iperf servers, the browser driver, software-authenticator state, the target dir and the worktree removed. ~/mesh-vm.claim released. Kept: ~/.cache/codex-scratch/j267/{evidence,logs} (716 KB).
  • Process slips on my side, all fixed during the run: one pkill -f matched only my own ssh shell, and two driver instances briefly overlapped.
**J267 final: Mac mesh break-it.** This was a review/measurement job: no code changed, so the gate doesn't apply. Bases: dev `9b0c731e8` (measurement, cases 1–6), plus dev `0b72f638a` for D166, because #285 merged mid-run at `363d95468`. ### Measurement (Mac VM ↔ compute01, NetBird underlay MTU 1280, ~143 ms; Mbit/s; full table in the "J267: measurement" comment) | Path | 1 flow up / down | 8 flows up / down | idle RTT p99 | |---|---|---|---| | Plain (two runs) | 93.0 / 132.4 · 63.8 / 145.1 | 161.6 / 374.1 · 297.8 / 529.4 | 178.9 · 172.6 ms | | GotaTun mesh | **119.2 / 0.5** | **125.3 / 33.5** | 177.4 ms (adds under 1 ms) | Uploads over the mesh match the plain path. Downloads to the Mac collapse because of outer fragmentation (#381). ### Break cases (Mac as the mesh node, Linux = the server's embedded agent) | # | Case | Result | |---|---|---| | 1 | `kill -9` of the Mac daemon mid-transfer | **Pass.** launchd restart in about 1 s, utun and routes back, flow survives, no key change | | 2a/2b | `utun4` down/up; underlay `en0` down 11 s | **Pass** both. Same daemon, recovery about 2 s after up. Sleep/wake not attempted (VM) | | 4 | Access rules, default Deny | Linux side: **pass** in both directions (granted ports pass, others are refused). **The Mac enforces nothing itself**: documented gap until D340, confirmed live including sshd :22, no new issue | | 5 | Mesh DNS | **Not available.** No release build includes it (`mesh-dns-spike`, Linux-only), so nothing answers. The revoked-name half can't be tested | | 6 | Mesh node delete, then `kill -9` and `mesh down`/`up` | **Pass.** Stays cut; no auto re-join (tombstone) | | 6b | Host revocation mid-flow | **Pass.** 105 → 0 Mbit/s at the revoke; Linux drops the Mac within about 3 s; stays cut after `kill -9` and `down`/`up` | | 7 | Stale `/run`/state after a crash | Linux node: **fail** (#382). Mac: re-enrolment forgets the old state correctly, but `mesh status` says "running" while cut off (#383) | | D166 | Rotation in a mesh with a Mac (kernel-engine Linux node, interval 120 s) | **Pass.** Control: the Linux-only mesh rotated twice. With the Mac enrolled: no rotation for 301 s (2.5 periods), `peer_unsupported`. Mac deleted → rotation started within 3 s. Mixed version: a 9b0c Mac counts as non-rotating | ### Findings (issues filed, each with a reproducer) - **P1:** none. - **P2:** #379 dev doesn't build on macOS since the #285 merge (`restart.rs` `SO_PEERCRED`). #380 nodes built before #285 get no mesh from an upgraded server, silently (`Peer.previous_active` against `deny_unknown_fields`). #381 Linux → Mac throughput collapse from the fixed MTU. #382 stale node state refuses a new or restored server's snapshots (J255 F4; may be P1 if restore-from-backup is supported). - **P3:** #383 `infraternal status` says "not set up" on an enrolled Mac, and cut-off nodes look healthy. #384 `prepare-join-key` returns the old server's digest. #385 every completed rotation logs an ERROR at `store.rs:199`. - Noted, not filed (not reproduced cleanly in a real browser): on a fresh server, the "Unlock" toast's button was covered by `div.cl-region` in my headless driver and needed a JS click, and the toast said "The server restarted" on a brand-new server. Also, invitations returned 503 for a few seconds after a reported unlock. ### Cleanup - **Mac:** service stopped (unloaded and launchd-disabled, as `mesh down` leaves it). `/var/lib/infraternal` and the plist restored to the J80 state from my snapshot: the same files and dates, binary `7dcc2272…`, plist byte-identical. The only exception is the stale 3 Nov `plugins.sock` socket, which tar can't archive; the next daemon start recreates it. Hosts line, listeners, preserve dir (with throwaway keys) and worktree removed. Kept: `~/j267-evidence` (1 MB). - **compute01:** throwaway servers, embedded agents and 3 orphan shims stopped by PID. `infraternal0` and `inet infraternal_mesh` deleted (neither existed before). `/run/infraternal` restored to what I found: the two stale J255-F4 files, hashes checked, empty `sessions`. `/root/j267` deleted. iperf servers, the browser driver, software-authenticator state, the target dir and the worktree removed. `~/mesh-vm.claim` released. Kept: `~/.cache/codex-scratch/j267/{evidence,logs}` (716 KB). - Process slips on my side, all fixed during the run: one `pkill -f` matched only my own ssh shell, and two driver instances briefly overlapped.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
j470b-server-mesh-rejoin
mesh-compat-382
j444b-d381-key-wins-flood
j461b-macos-utun-reader-thread
j475b-remove-host-motion
fix-reconnect-new-link
j481-d380
dev
j479-mesh-soak
fix/j476-host-facts
j475-motion-pill-split
j470-mac-node-join
root-upgrade-d376
j474-review-merge
latency-targets-120hz
nightly-suite-shards
gotatun-pin-j469
macos-utun-reader-thread
fix-flood-echo-stall
wip/j416
motion-fast-ease-out
mesh-addhost-j259
takeover-close-terminals-d368
kbd-instant-followups
fix-trust-key-double-click
nightly-suite-partial-report
appwin-icons-j207
rusqlite-slice1
swipe-content-first-d374
mesh-mtu-381
addhost-instant-open
glass-contrast-d365-mock
glass-contrast-d365
signout-followups-442
fix-startup-toast-red
research-gotatun-matrix-j317
themes-sync-j304
fix-load-flakes
fix-nix-zig-patch
fix-compute01-browser-baseline
ratchet-size-baseline-419
predict-auto-d130
revoke-coverage-d367
nightly-suite-queue-timeout
nightly-browser-suite
fix-rustsec-2026-0459
fonts-ioskeley-obel
log-retention-d375
fix-kbd-no-anim-427
fix-dev-red-specs-2
takeover-proof-305-j205
wip/j410-server-pump
ui-consistency-d372
fix-osc52-clipboard
libghostty-vt-1.0
forget-retired-host-d369
j404-merge-426
fix-setup-lock-race
fix-touch-select-426
revoke-access-report-ui
fix-predictive-echo-specs
fix-selinux-agent-exec
wip/j395-checkpoint2
wip/j395
j391-review-scratch
ui-consistency-j195-deferred-rebased
fix-rustc-paths-421
decisions-wording-341
fix-install-suite-red
fix-dev-rtt-specs
fix-pending-removal-align
fix-privileged-skip
fix-install-suite-404
review-j368
mesh-dns-j254
revoke-access-report-d356b
revoke-privilege-round5
fix-removal-confirm
review-j360
gotatun-rotation-367
deps-refresh-340
review-j354
review-J351
review-j350
addhost-takeover-d359
revoke-report-items-347
revoke-end-sessions-d362
review-j348
size-mesh-ssh-346
size-trim-337
revoke-access-diff-d356
j259-pre-rebase-b06c5a6
j305-ended-at-start-spec
addhost-sudo-consent
fix-layout-real-specs-411
fix-shell-open-411
fix-console-hosts-373
fix-shell-exit
fuzz-host-name-353
fix-host-details-410
macos-filter-j197
research-gotatun-tricks
revoke-p3-j216l
stale-state-pill
revoke-followups-j216k
revoke-progress-j216e
backup/macos01-20261106/lume/j197
backup/macos01-20261106/lume/appwin-icons-j207-stash0
backup/macos01-20261106/claude/stash-0
backup/macos01-20261106/claude/stash-1
backup/macos01-20261106/claude/J80-macos-s1
backup/macos01-20261106/claude/J80
backup/macos01-20261106/claude/J80-slice1-20261102
backup/macos01-20261106/claude/J16b-appwin-on-dev
backup/macos01-20261106/claude/appwin-launch-idle-146
backup/macos01-20261106/claude/J80-s1-run
wip/j259
trust-285-p3c
runtime-lock-j216f
mesh-ssh-p3-j175
tun-proof-p3b
trust-285-p3
terminal-polish-j271
tun-proof-p3
ssh-install-flakes-j216i
fuzz-fixes-j264
trust-285-a
trust-285-b
restart-oversized-fixture-j198
backup/macos01-20261106/lume/appwin-icons-j207
restart-bound-j216h
up-preflight-p3-j198
backup/macos01-20261106/lume/j251
up-preflight-j198
wip/up-preflight-j198-j245-p2
wip/up-preflight-j198-j245-p1
agent-fsync-offloop-j196
wip/up-preflight-j198-j245
settings-offscreen-j231
wip/up-preflight-j198-j226-inspection
wip/j103f
themes-j206
wip/up-preflight-j198-j226
flakes-j216c
backup/macos01-20261106/claude/j197
flakes-j216b
backup/macos01-20261106/claude/j197-red
wip/up-preflight-j198-review
flakes-j216
backup/macos01-20261106/claude/appwin-icons-j207
engineering-j208b
appwin-mock-j209
toast-stack-j165
engineering-j208
decisions-d351
decisions-d350
decisions-d349
appearance-presets-mock-j129
decisions-d348
docs-audit-spec
doc-coverage-baseline-raise
decisions-d347
decisions-d346b
decisions-d346
j88h-profile
ui-consistency-j195-deferred
ui-consistency-j195
engineering-practices-j194
preferred-login-ui-j166
signin-pools-263-j174
macos-node-265-s1
decisions-d345
decisions-d344
proxy-cgroup-j164
verify-quick-fuzz-329
proxy-start-io-j168
timing-flakes-j163
up-263-s1
mcp-events-j147
verify-quick-fuzz-j158
proxy-p3-j159
agent-resource-j157-detect
wip/j103d-final
remote-cancel-hang-j155
proxy-traefik-281-j62d
j149-verify-quick
proxy-traefik-281-j62b
j150-drop-unnamed
wip/j79d-red-r4
wip/j103d-d332
rootless-toast-j142
wip/j103d-head
wip/j103d
j125c-mcp
macos-build-j136
backup/macos01-20261106/claude/j136
wip/j79d-red-cli
wip/j79d-red-server
j121-link-liveness
j118c-tracer-failures
wip/j79c-head
release-desktop-j131
j124c-signed-macos
wip/j79c-red-p3
wip/j79c-red-p23
wip/j79c-red-p22
merge-j128-check
perf-deferred-j128
sidebar-toggle-260
j127-shortcut-changed-dot
j125-mcp
j118-tracer-failures
j126-account-summary
settings-sections-mock-j92
j120-pinch-lock
sidebar-292
backup/macos01-20261106/claude/j120
taste-2026-11-03
row-actions-242-215
backup/macos01-20261106/claude/stash-0-untracked
backup/macos01-20261106/claude/J80-265-s1-run
backup/macos01-20261106/claude/J80-macos-s1-20261102
j112-canvas-commands
ui-no-overshoot-scroll
fix-recovery-restart
backup/macos01-20261106/claude/stash-1-untracked
taste-2026-11-02
size-baseline-ratchet
machine-cards-structure-j108
j109-boot-copy-mockups
fix-dev-red
wip/up-263-s1
j95b-settings-rows
proxy-traefik-281
j95-option-rows
docs-human-j91
docs-keys-palette
fix-flood-1013-270-j38d
mesh-ssh-s1
mesh-ssh-s0
addhost-d291-tunnel
test-stability-load
mesh-relay-220
repro-296
shim-thp-off-24
mesh-pins-258-v2
mesh-dns
signin-d311-merged
docs-pages
ui-size-283
fix-ui-batch-specs
wip/j12b-edge-update
gate-on-arm
fix-rename-sync-293
trust-285-j60b
fix-focus-ring-clip
integ-ui-1101
edge-update-v2
signin-d311
taste-2026-11-01
layout-per-tab-250
ui-approved-splitopt-224
ui-approved-splitopt-224-on-dev
icon-text-centre-282
ui-approved-189-212-216
research-reverse-proxy
transfer-budget-320
review-mesh-pins-258-r2
sidebar-pill-259
review-mesh-relay-220
wip/j12-edge-update-v2
nix-package
status-crash-loop-237
fix-dev-test-failures
fix-fixture-socket-path
wip/mesh-relay-220-pre-dev-advance-rebase
fix-canvas-side-clip
research-head-to-head
frosted-real-256
review-mesh-pins-258
wip/mesh-relay-220-pre-final-rebase
review-layout-per-tab-250-r2
broad-suite-triage
nix-devshell
review-status-crash-loop-237-r3
wip/nix-devshell-pre-p3
taste-frosted-real
wip/code-serve-demo-2026-10-30
wip/code-serve-glass-2026-10-30
wip/code-serve-clusters-2026-10-30
wip/code-merge-release94-dev-2026-10-30
wip/rproxy-delta-scratch-2026-10-30
wip/stale-note-257-staged-2026-10-30
wip/d241-size-staged-2026-10-30
review-broad-suite-207
wip/mesh-pins-258-pre-split
wip/mesh-relay-220-pre-rebase
mesh-measure-220
plan-211-update
review-edge-autoupdate-r3
perf24-reconnect
review-stale-note-r2
release-prod-live
d241-shell-marker
review-mesh-pins-server-258
review-revocation-r3
review-setup-token-r2
review-sync-journal-r3
wip/review-mesh-pins-258-prune-review-1995fee46
frosted-scroll-256
sync-journal-r3
revocation-per-account-wip
review-tokio-asyncfd-0386
review-sync-p3s
wip/stash-8by64-stash0-2026-10-30
mesh-drag-r2
setup-token-data-wip
release-9-4
auth-busy-1013
mesh-view-overlap
sync-p3s
review-auth-busy-wake
review-readd-r8-wip
mesh-drag-bounds
audit-auth-93
app-windows-stream-start
review-authority-cap-r3
app-windows-r7-measure
readd-minimal-r6
readd-minimal-r5
app-windows-r7-soak
readd-minimal-r4
app-windows-r7
app-windows-r6
readd-minimal-r3
readd-minimal-r2
readd-minimal
merge-release8-dev
review-busy-page-liveness-r2
review-busy-page-liveness
mesh-view-trim
review-authority-read-retry-r2
review-remove-uninstall-r2
release-retry-reattach
release-retry
review-remove-uninstall
review-authority-read-retry
app-windows-ship
mesh-autoswitch-p2
mesh-ssh
mesh-relay
mesh-macos-node
screen-and-control
session-labels
review-real-logins-r5
review-real-logins-r4
review-real-logins-r3
shim-memory-r2
review-real-logins-r2
shim-memory
shadow-addhost-instant
shadow-real-logins
shadow-same-session-flood
shadow-prod-perf-fix
hosts-from-server
app-windows-real
app-windows-transport
release-prod-6w
mesh-policy-verify
quiet-close-toast
dev-merge-r4
review-mesh-agent-transport
review-app-windows-transport
settings-roundtrip
review-release-pipeline-r4
mesh-agent-transport
ended-strip-fix
review-audit-ca-update-d244
settings-rows
phone-width
signout-clear
fix-restart-tests
dev-merge-rp
signer-hardening
review-audit-ca-update
terminal-fidelity
review-audit-ca-update-wip
mesh-integrate
review-mesh-agent-transport-515d3712
review-mesh-dataplane-feec1988
mesh-dataplane
signout
research-canvas-node
wip/review-renderer-cost
wip/review-terminal-fidelity
padlock-glyph
review-release-pipeline-2e95b689
phone-polish
sidebar-polish
inbox-generic
review-mesh-dataplane-378d4055
prod-batch
ui-inbox
ui-ca-unlock
ui-machine-sections
review-mesh-dataplane-a5f744fb
tls-session-prod
session-bounds-prod
fix-dead-session
session-bounds
tls-session
palette-polish
shortcuts-d222
research-appmeta
phone-gutter
ui-centre-button
wip/ui-centre-button
wip/tls-session
review-addhost-breakit
ui-platform
renderer-cost
remote-agents
mesh-api
ssh-bootstrap
prod-hotfix2
prod-fixes
review-remote-agents
review-mesh-dataplane
session-life
research-browser
review-mesh-api
research-capture
review-mesh-api-round3
review-mesh-api-round1
gate-stability
review-gate-stability
review-relay-direct
review-mesh-api-findings
proto-sessions
font-picker
proto-addhost
proto-windows
mesh-core
latency-gate
research-bsd
research-discovery
keytray-mods
mock-core
ui-tweaks
fix-motion-sel
fix-motion
integrate2
fix-robust
t-web
t-server
vt-ghostty
fix-snap-echo
t-web-auth
review-vt2
t-agent
lane-protocol
lane-shim
lane-auth
s1-base
s1-contracts
s1-workspace
No results found.
Labels
Clear labels   
launch-qa
Findings from launch QA.

No labels
launch-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/infraternal#375
No description provided.