1.2 KiB
Raw output - verify declared WireGuard identities
The human authorized the next incremental Layer B change after committing the read-only pyroute2 helpers and first-child wgman design update.
git diff HEAD~1..HEAD -- tractor/discovery/_tunnel.py tractor/discovery/__init__.py tests/discovery/test_wg_inspection.py examples/multihost/wg_lan ai/tpt-backends/03_wg_tunnel_bindspace.md
Added async verify_wg_peer() over one WireGuard key snapshot. It validates the declared WGTunnelSpec.peer_pubkey before I/O, forwards the spec’s iface/netns, and accepts either the local interface key for a source/listen declaration or a configured peer key for a destination/dial declaration.
Refactored worker offload behind one shared async reader so verification cannot compare two different netlink snapshots. Exported the helper, added local/peer/absent/malformed-key coverage, and moved the multihost examples from their local wg show subprocess probe to the production API.
Ruff and lock checks passed. Focused WireGuard/tunnel/multiaddr coverage passed 51 tests; the complete discovery suite passed 92 tests with 2 xpasses.