[kixelated]

Summary

The mesh coordinator's grant now publishes mesh/node/<id>/**, mesh/service/*/.server/<id>, and mesh/service/*/.client/<id> in place of mesh/<id>/**. A service named after another member can no longer put .server/<other> under its own grant and answer as that member. Lands before the cut first publishes moq_auth::mesh, so no release ever issued the old shape.

• rs/moq-auth/src/mesh/coordinator.rs: the new patterns; mesh/mod.rs docs.
• Contract test asserts the member publishes its node subtree and its own service ends, and cannot publish another member's node, a service named after another member answering as it, or the old mesh/<id>/... path.
• doc/bin/relay/auth.md names the new grant.
• moq-crypto and @moq/crypto sign examples and tests move to mesh/node/<key>/....
• Deletes the quest and its links in quest/m2/README.md and quest/m3/mesh/.

Impact

Public API: the grant a mesh coordinator issues changes; no Rust or JS signature does. A hosted coordinator implementing the JSON contract must issue the same grant. Applications built on main re-enroll (or refresh) to get the new grant. js/auth has no mesh module, so nothing there to keep in step. Wire: none.

Decisions

Taken by the agent under /quest-afk, for the maintainer's review:

• Service patterns are exact (.server/<id>, not .server/<id>/**), as the quest wrote them. Rejected: a subtree per service end, which nothing needs yet and would widen the grant.
• Subscribe stays mesh/**. Rejected: narrowing it to mesh/node/** + mesh/service/**, which changes nothing reachable today.

Validation

• cargo test -p moq-auth --all-features mesh: 18 passed, including the extended contract test (enrolls a second device and checks every cross-member path is refused).
• cargo test -p moq-crypto: pass. just check: only failure was rustfmt, fixed; JS crypto tests passed.

Caused by

No single PR: the old grant predates the service split decided in review of moq-dev/moq#8214.

Follow-ups

None.

Models

Size: S
Implementer: Claude Code, claude-opus-5-5, unknown effort

🤖 Generated with Claude Code

(Written by Opus 5.5)

Review

Rewritten by quest review after each round.

• Head: 77fa5c6

• Base: origin/main at 4fec611

• Reviewer: Codex, gpt-6.1-sol, medium effort

• Session: 01a1da4d-0797-7410-9fb7-364eb10b28c1, round 1

• Score: 9/10, The implementation, documentation, and contract coverage are consistent, with no actionable defects found through source review; builds and tests were not run as instructed.

• Rounds: 1; findings 0: fixed 0, refuted 0, open 0

• Findings: none

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 24 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a78f0213-cb7d-4065-a7e8-c4a6ae6822a2

Commits

Reviewing files that changed from the base of the PR and between 77c9ca5 and 77fa5c6.

Files selected for processing: 13

• doc/bin/relay/auth.md
• js/crypto/README.md
• js/crypto/src/sign/index.ts
• js/crypto/src/sign/sign.test.ts
• quest/m2/README.md
• quest/m2/mesh-grant-shape.md
• quest/m3/mesh/README.md
• quest/m3/mesh/endpoint.md
• rs/moq-auth/src/mesh/contract_tests.rs
• rs/moq-auth/src/mesh/coordinator.rs
• rs/moq-auth/src/mesh/mod.rs
• rs/moq-crypto/README.md
• rs/moq-crypto/src/sign/tests.rs

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[pullfrog]

ℹ️ No critical issues — one stale migration note outside the diff.

Reviewed changes

Reviewed the full PR: the mesh coordinator's grant shape, its docs and contract test, and the follow-on path renames in the signing examples and quest files.

• Grant shape — claims() in coordinator.rs now publishes mesh/node/<id>/**, mesh/service/*/.server/<id>, and mesh/service/*/.client/<id> in place of the mesh/<id> subtree. Subscribe is unchanged.
• Contract test — enrolls a second device and asserts the member cannot publish the other member's node, a service named after itself answering as the other member, or the old mesh/<id>/... path.
• Docs — mesh/mod.rs, Enrollment::token, and doc/bin/relay/auth.md name the new grant.
• Signing examples — moq-crypto and @moq/crypto README/doc examples and tests use mesh/node/<key>/....
• Quest bookkeeping — deletes quest/m2/mesh-grant-shape.md and rewrites its links.

ℹ️ MIGRATE.md still tells readers to build the old mesh/<id> grant

The Unreleased entry "Mesh endpoints use the signing public key" in rs/moq-auth/MIGRATE.md says to build the publish pattern with Pattern::subtree(&format!("mesh/{endpoint}")). After this PR the coordinator no longer issues that pattern, so anyone following the note gets the grant this PR exists to remove. The release cut copies Unreleased entries forward, so this would ship unless it's fixed first.

Technical details

# Stale mesh publish-pattern guidance in MIGRATE.md

## Affected sites
- rs/moq-auth/MIGRATE.md:45-46 — "Build the publish pattern with `Pattern::subtree(&format!("mesh/{endpoint}"))` instead of `endpoint.publish()`."

## Required outcome
- The note either names the three new patterns (`mesh/node/<id>/**`, `mesh/service/*/.server/<id>`, `mesh/service/*/.client/<id>`) or drops the pattern sentence. `moq_auth::mesh` has never been released, so the replacement for `endpoint.publish()` may not need its own line at all.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using claude-opus-5-5 ｜ 𝕏}

[kixelated]

Closing unmerged: the maintainer moved mesh enrollment to Kixel on 2026-11-14, and moq-dev/moq#8756 removes moq_auth::mesh from moq. Kixel's coordinator already has its own certificate-based contract, so this change has no consumer to port to.

(Written by Opus 5.5)