[schickling-assistant]

Problem

A Fabric-only member cannot rotate its live NodeID before peers learn and authorize the replacement. The former draft documented this boundary without implementing the command.

Change

• Merge origin/main with merge commit 48c9985e85d0c1dd828187a4c8178dc951fd8b69 (no rebase or force-push). Resolve the deleted guide conflict by updating its current location.
• Add fractal fleet transports rekey fabric: Fabric identity prepare → signed announcement over the old route → verified peer adapter receipt → committed endpoint and permanent-policy receipt → guarded identity activate.
• Keep the stable fleet member key. Persist command phases and the original ten-minute deadline in the local rekey journal; resume lost replies and crash recovery without extending that deadline. Refuse non-Fabric members and unavailable/old identity APIs. Missing confirmation aborts without activating the new local key.
• Stage the next NodeID with immutable Fabric expiry while retaining the old permanent identity. Commit promotes the new record atomically and expires the old record at the original deadline. Adapter authorization derives from signed membership and final verified policy snapshots; signed receipts bind member key, old/new NodeIDs, deadline, and phase. No terminal grants, key-file edits, or static-policy rewrites.
• Preserve protocol metadata across worker refreshes, but allow explicit transport withdrawal/dial-out to clear the rotation rather than resurrect its route.
• Update fleet and two-machine guides plus release-notes/fabric-rekey-command.json.
• Fabric is consumed as an external CLI/control API, not a Cargo dependency. Update the Nix input and lock used by fabric-pairing to bd45ec9cac98c217266855a696f772d364fe66a5 (feat(resync): notify a live agent when a declared resource carrier changes #345), including fix(run): bound child output capture and reaper threads #340/Resync events: notify a live agent when a declared resource carrier changes on disk #341 and identity recovery fixes. This pin must move to the v0.9.4 tag before this PR is ready.

Verification

Published head: 18eb5c940255b78de22c5da0c0c9a116fdc51a51.

Local focused Cargo runs used the repository perf shell, an isolated target directory, and shared-host build admission; no full workspace build or live host mutation:

Command	Result
cargo test --locked -p fractal-fabric-adapter	53 passed
cargo test --locked -p smallclaims --lib fabric_rekey	8 passed
cargo test --locked -p fractal-api-core --lib signed_rekey_route	1 passed
cargo test --locked -p fractal --bin st3 fleet_cli::rekey::tests	6 passed at published head
cargo build --locked -p fractal --bin st3 -p fractal-fabric-adapter --bin st-fabric-adapter	passed at published head

The first three suites passed at ba7a466721a4cf74a7d8cbffdf8e592d22883739; subsequent commits only corrected CLI fixture UUID/envelope shapes. Fake-Fabric tests cover phase flow, immutable expiry, abort, expired staging, exact receipts, crash-resume, and lost activation replies. Earlier CLI failures exposed fixture contract errors and an ambiguous print macro; those are fixed. Existing unrelated TUI/API dead-code warnings remain.

The dedicated target directory was removed after verification: 9,400,940,416 apparent bytes / 3,162,225,152 allocated bytes. No real multi-machine rekey, hosted CI success, or independent review GO is claimed. This PR remains draft.

Open questions

• Nathan: please confirm the v0.9.4 tag includes fix(run): bound child output capture and reaper threads #340, Resync events: notify a live agent when a declared resource carrier changes on disk #341, and feat(resync): notify a live agent when a declared resource carrier changes #345 and is the supported consumer baseline; replace this temporary commit pin with that tag before readiness.
• Nathan: please confirm owner-scoped atomic remove/re-add is the supported promotion of a staged expiring runtime record to permanent authorization. This implementation follows the explicit replacement semantics in docs/runtime-peer-api.md; it never tries to clear an immutable expiry in place.
• Maintainers: the availability policy requires at least one remote current member to confirm both phases, not every offline member. Offline members must learn the signed cutover through another reachable member. If a committed receipt or abort publication is partitioned at the deadline, local identity rollback does not prove remote policy rollback; recovery still requires claim delivery. Static and other-owner rights remain operator-owned.

Complexity and concerns

One durable local command journal and signed non-routing metadata in existing member-endpoint claims; no new dependency or database schema. Runtime expiry is already implemented upstream by #340: it is not an adapter timer, and a stopped adapter cannot extend the installed deadline. Fabric never serves two local identities simultaneously.

Friction and bottlenecks

Shared build admission queued individual attempts for roughly 23–49 minutes; one attempt also waited behind a host maintenance drain. sccache reported server shutdowns and fell back to local compilation. Verification stayed within the admitted affected-crate lane.

References

• Expire runtime peer records through atomic overlap batches fabric#340
• Prepare and activate consumer identities in place fabric#341
• Identity activation follow-ups from #341 review fabric#345
• https://github.com/compoundingtech/fabric/blob/main/docs/runtime-peer-api.md#bounded-overlap-expiry

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/fabric-mesh
session	01a1ecd5
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	smalltalk/fabric-rekey-implementation

[schickling-assistant]

Parked: waits for Fabric v0.9.4 (fabric#345 review by the maintainer); under the rename it must also rebase onto the B1 adapter dual-owner readers (#4623). Reissue: when v0.9.4 is tagged, repin, rebase on main, re-prove old/new owner recovery, then a delta review.

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/fabric-mesh
session	01a1ecd5
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	smalltalk/main