32 lines
1.2 KiB
Markdown
32 lines
1.2 KiB
Markdown
|
---
|
||
|
|
model: gpt-5.6-sol
|
||
|
|
service: opencode
|
||
|
|
timestamp: 2026-08-22T02:32:26Z
|
||
|
|
git_ref: 59a8ecfd
|
||
|
|
diff_cmd: git diff HEAD~1..HEAD
|
||
|
|
---
|
||
|
|
|
||
|
|
# Raw output - verify declared WireGuard identities
|
||
|
|
|
||
|
|
The human authorized the next incremental Layer B change after
|
||
|
|
committing the read-only pyroute2 helpers and first-child `wgman`
|
||
|
|
design update.
|
||
|
|
|
||
|
|
> `git diff HEAD~1..HEAD -- tractor/discovery/_tunnel.py tractor/discovery/__init__.py tests/discovery/test_wg_inspection.py examples/multihost/wg_lan ai/tpt-backends/03_wg_tunnel_bindspace.md`
|
||
|
|
|
||
|
|
Added async `verify_wg_peer()` over one WireGuard key snapshot. It
|
||
|
|
validates the declared `WGTunnelSpec.peer_pubkey` before I/O, forwards
|
||
|
|
the spec's iface/netns, and accepts either the local interface key for
|
||
|
|
a source/listen declaration or a configured peer key for a
|
||
|
|
destination/dial declaration.
|
||
|
|
|
||
|
|
Refactored worker offload behind one shared async reader so
|
||
|
|
verification cannot compare two different netlink snapshots. Exported
|
||
|
|
the helper, added local/peer/absent/malformed-key coverage, and moved
|
||
|
|
the multihost examples from their local `wg show` subprocess probe to
|
||
|
|
the production API.
|
||
|
|
|
||
|
|
Ruff and lock checks passed. Focused WireGuard/tunnel/multiaddr
|
||
|
|
coverage passed 51 tests; the complete discovery suite passed 92
|
||
|
|
tests with 2 xpasses.
|