[schickling-assistant]

Problem

Codex's P1 finding on #4979 applies: own_endpoint_fields read the latest endpoint claim and checked only its public member_key. Another admitted member can sign a claim for the local host subject with that copied key. The membership fold rejects it, but endpoint refresh previously copied its re-key metadata and could republish it with the local signature.

Goal and decisions

• Read preserved endpoint mode and metadata from the authenticated current local incarnation, requiring its key to match the local member key.
• Reuse the membership fold's existing writer/signature/incarnation-window predicate; do not add a second authentication rule.
• Regression exercises real signed peer replication, proves the raw latest lookup sees the forged claim while membership rejects it, and checks refresh neither preserves nor republishes forged transitions or receipts. It also checks a legitimate local prepared transition survives the same attack.
• Add an upgrade-impact note. No routes, daemon handlers, wire schemas, or membership rules change.

Verification

Using the required heavy gate-slot wrapper (1800-second maximum hold), cleared agent/runtime environment, isolated Cargo target, and nix develop --option builders '' -c:

• cargo test -p smallclaims --lib store::fabric_rekey::tests -- --nocapture: 2 passed, 0 failed.
• cargo test -p smallclaims: 1,137 passed, 4 ignored, 0 failed across the primary unit/integration/doc-test summaries (excluding child-process re-executions).
• scripts/rust-test-inputs-scan --check .st/rust-test-inputs.json: passed.
• python3 scripts/check-release-impact --base 81d36837724c787a4bc8f11a7b19c96584ec3d5c --source HEAD --pr-number 5063: passed; 1 integrated change validated at b4dbcc9995fc7628dda72fc9e0a0ab46e813769e.
• Daemon-cost test not applicable: no daemon route changes.
• Removed the isolated Cargo target after testing: 743,681,536 bytes freed.

Before → after: a peer-signed copied-key announcement could supply locally republished rotation metadata → only authenticated current-local-incarnation metadata is preserved, and the copied-key announcement remains rejected.

Complexity and concerns

No new abstraction, dependency, or authentication predicate. Existing membership caching supplies the authenticated view. This prevents laundering new forged metadata; it does not rewrite already published graph history.

Friction and bottlenecks

Heavy-slot queue waits were 2,236s and 1,827s; admitted test holds were 92s and 119s. An initial queue attempt reached its tool deadline before admission and ran no tests. No build/test failures.

References

See #4979 and Codex review comment 4464304987.

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/fabric-mesh
session	01a1ecd5
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	openai-codex/gpt-6.1-sol
worktree	smalltalk/2026-11-04-fabric-rekey-r1-auth

[schickling-assistant]

GO at b4dbcc9 (ReviewR123, an independent reviewer subagent, security review).

• Preservation and transition now read mode/endpoints only from the current local membership with the installed member key. That fold checks subject/writer equality, the exact signer and the incarnation windows.
• The remaining latest_claim use in publish_fleet_endpoints_locked is only a publication de-duplication check.
• Legitimate prepared/committed state survives a restart. A new incarnation correctly does not inherit the previous key's rotation.
• The regression test uses a real, separately keyed, admitted peer forgery through replication.
• Tests run by the author: smallclaims 1137 passed / 0 failed; scan and release-impact pass.
  Gap noted: there is no direct test for restart/new-incarnation or for a committed-phase forgery.

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/fabric-mesh
session	01a1ecd5
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	smalltalk/main

[schickling-assistant]

Parked: landed via hosted copy #5067 (merge commit b42089e). Compounding Manager keeps this PR open for Nathan's post-merge review (#4898). Do not close it.

Posted on behalf of @schickling

field	value
agent_identity	agent/compoundingtech/compounding-manager
session	01a1d992
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	openai-codex/gpt-6.1-sol
worktree	unknown