feat(mesh): Phase 2 gap-close — Gate 3 probe, bootstrap smoke tests, token hardening - #88
Merged
Merged
Conversation
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| { host: 'headscale.micklethefickle.bolabaden.org', path: '/web/settings.html' }, | ||
| ]; | ||
|
|
||
| const primary = process.env.HEADSCALE_PRIMARY || 'micklethefickle'; |
…smoke tests, token rotation hardening - scripts/verify-internal-mesh-dns.sh: add Gate 3 Headscale API reachability + pairwise tailnet ping (R7) - tests/bootstrap-smoke: add headscale-four-urls.spec.ts and headscale-mirror.spec.ts Playwright smoke tests - docs/runbooks/cloudflare-scoped-tokens.md: harden preauth key TTL (24h), fail-closed semantics, rotation table - .gitignore: exclude infra/bin/ compiled binaries and test-results/
… U6 spec + docs U1 (residual): - scripts/provision-mesh-ddns-token.sh: verify-only by default; --create is out-of-band only; exits non-zero on missing/invalid/inactive token - scripts/test_provision_mesh_ddns_token.sh: 10 unit tests (T1–T10), 12 assertions all passing; T10 proves primary fail-closed integration - arbitrary-scripts/bootstrap/generate-implicit-env.sh: replace WARN-continue with IS_PRIMARY-gated fail-closed block (R5/KTD1) — standbys skip silently U6: - tests/bootstrap-smoke/mesh-targets-enrolled.spec.ts: Playwright spec for three-target enrollment gate (Gate 1 API, Gate 2 FQDN, Gate 3 machine list, Gate 4 aggregate); skips offline, runs live with MESH_TARGETS_TEST=1 - docs/solutions/integration-issues/bootstrap-from-scratch-vractormania.md: U6 contract section with secret injection matrix, command sequence, fail-closed gates, and proof log table - docs/plans/2026-07-25-001-feat-hands-off-mesh-targets-plan.md: check off residual U1 (fail-closed), U2 (rotation docs), solution doc, and U6 spec DoD items
oldrepublicwizard
force-pushed
the
feat/mesh-phase2-gap-close
branch
from
July 25, 2026 16:10
3cb9197 to
208671e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Phase 2 mesh gap-close work: tightens proof coverage and operational hardening.
Changes
scripts/verify-internal-mesh-dns.sh): adds primary Headscale API reachability check + pairwise tailnet ping when--require-targetsis set (R7 coverage)tests/bootstrap-smoke/): Playwright specs for Headscale UI four-URL entrypoints and mirror-domain bootstrap pre-fill behaviordocs/runbooks/cloudflare-scoped-tokens.md): 24h preauth key TTL enforcement, fail-closed semantics documented, rotation table with named owners and cadenceinfra/bin/compiled binaries andtest-results/dirsPrior commit on this branch
fed9411docs: bring plan 001 brownfield re-scope and STRATEGY Phase 1 closeTesting
bash scripts/verify-internal-mesh-dns.sh --require-targetscovers Gate 3npx playwright testintests/bootstrap-smoke/