{ "summary": "Fresh absolute SPT_HOME values isolate IPC, identities, stores, stop-inhibit, and spawn locks; one candidate `node run`/`daemon run` launches broker plus supervised brain. Override docs HTTP port, retain peer pump, use fresh subnet material and native pair-join with explicit live responder address. Two important constraints: public subnet creation requires an elevated interactive admin-capture ceremony, and elevated daemon startup can rewrite the resident's shared Windows firewall rule even with SPT_INSTALL_NO_FIREWALL=1.", "files": [ { "path": "crates/spt-daemon/src/endpoint.rs:18-102", "description": "Home-derived socket names and daemon.pid/brain.ready locations." }, { "path": "crates/spt-store/src/daemon_inhibit.rs:28-46,124-153", "description": "Stop inhibit and exclusive spawn lock are per-home files, not a machine-global daemon mutex." }, { "path": "crates/spt-daemon/src/daemon.rs:185-244,480-566,780-840", "description": "Fresh identity creation, broker/net startup, brain reap ordering, network scope, public start/stop routing." }, { "path": "crates/spt-daemon/src/firewall.rs:31-36,331-365,597-627", "description": "Shared named UDP firewall rule and elevated startup repair hazard." }, { "path": "crates/spt-daemon/src/config.rs:91-130,199-231,251-280", "description": "daemon.json schema, relay policy, docs and optional LAN bootstrap ports." }, { "path": "crates/spt-daemon/src/docshost.rs:1-18,89-138", "description": "Loopback-only HTTP proxy listener; config supports port zero, env SPT_DOCS_PORT=0 is ignored, bound-port discovery." }, { "path": "crates/spt-net/src/net/endpoint.rs:322-397", "description": "Production QUIC binds ephemeral UDP ports; fixed port exists as library BindScope, not a daemon config option." }, { "path": "crates/spt/src/cli.rs:1042-1120,1875-1957,13832-13945,8742-8830,8900-8928", "description": "Run/start/stop commands, lack of explicit address on public join, creation elevation/capture gate, live node status identity/address fields." }, { "path": "crates/spt-daemon/src/msg.rs:881-923,998-1036", "description": "Live network/process identity messages and explicit responder_addr pairing request." }, { "path": "crates/spt-daemon/src/broker.rs:9587-9629", "description": "Native pair-join dispatch decodes explicit EndpointAddr and runs real ceremony without rendezvous." }, { "path": "crates/spt-daemon/src/transport.rs:37-92", "description": "Windows namespaced pipe transport; one-way hello then framed requests." }, { "path": "crates/spt-daemon/src/codec.rs:1-54", "description": "Four-byte big-endian JSON frame length and envelope encoding." }, { "path": "crates/spt-daemon/src/pairhost.rs:355-418", "description": "Direct-address real pairing, observed-address persistence and roster/seed transfer." }, { "path": "crates/spt-store/src/nodeid.rs:1-16,54-99", "description": "Fresh random node key minted only if absent, 32-byte secret seed stored as hex." }, { "path": "crates/spt-store/src/hostlabel.rs:1-57", "description": "Windows labels come from COMPUTERNAME, not SPT_HOME or config." }, { "path": "crates/spt/tests/webserve_cross_node_e2e.rs:115-285,441-517", "description": "Closest proven source pattern: fresh real daemon homes, port isolation, scoped cleanup, fixture subnet preparation, live address exchange." }, { "path": "crates/spt-daemon/tests/support/serving.rs:32-101", "description": "Real seed control owns serving commands/bound port; fixture broker name alone is insufficient." }, { "path": "crates/spt/tests/n1_pairing.rs:56-66,89-98", "description": "PID-scoped Windows tree cleanup and separate broker/brain process proof." }, { "path": "crates/spt-daemon/tests/daemon_e2e.rs:172-209", "description": "Older in-process lifecycle test; not sufficient proof of real two-process daemon startup." }, { "path": "crates/spt-daemon/tests/daemon_lifecycle_real_brain.rs:39-85", "description": "Real brain entrypoint fixture and isolated home, but in-process broker/thread fixture rather than public daemon startup." }, { "path": "crates/spt-daemon/tests/pairjoin.rs:114-159", "description": "Explicit-address native pairing against real responder; no discovery dependency." } ], "architecture": "Broker owns home-namespaced IPC, QUIC endpoint, HTTP listener and PTY sessions, and supervises the separate candidate brain. Brain owns dispatcher and peer pump. Pairing authenticates/transfers fresh subnet membership through the broker's real endpoint; HTTP cross-node fetch enters the requesting home's loopback listener and proxies via trusted QUIC to the owner.", "report": "## Isolation and non-negotiable startup constraint\n\nSPT_HOME is the isolation boundary. Use new absolute paths with exactly the same spelling for every command/child on that node. `endpoint.rs:18-38` hashes the PathBuf using Rust DefaultHasher into `spt-daemon-{broker,seed,...}-.sock`; named pipes are selected by that tag. Do not try to hash the path with SHA256 or substitute a resident pipe. `daemon.pid`, `brain.ready`, identity/node.key, registry, trust, serving entries, logs and stop inhibition stay under the new home. Autostart serialization is `/daemon-spawn.lock` via fs2 (`daemon_inhibit.rs:124-153`), NOT a global daemon mutex. Windows start/stop never control the installed logon task (`service.rs:254-278`).\n\n**Shared-global hazard:** broker startup calls `firewall::verify_and_record_self` after network bind. On Windows an elevated process with Missing/PathMismatch invokes repair_windows, deleting/recreating the product rule named `spt-core inbound UDP`. This is not home-isolated. `SPT_INSTALL_NO_FIREWALL=1` gates installer reconcile only, NOT this startup verify path. Therefore do not launch an elevated candidate broker on a host whose shared rule names the resident image. Especially check ENLYZEAM's SSH token: headless elevated Windows can lack a de-elevation target and remain elevated. Merely setting the opt-out env variable is not protection. Launch unelevated or establish a separately reviewed no-repair condition before launch; otherwise resident-impact-free startup cannot be promised.\n\nShared but non-store-isolated resources: OS UDP/TCP namespace, mDNS multicast discovery, Windows firewall policy, OS hostname and machine identity, OS account/ACL identity. Production daemon forces mDNS and all-interface QUIC; there is no daemon.json off switch for mDNS. The global bootstrap-firewall mutex (`serveverb.rs:451-455`, `Global\\\\spt-core-bootstrap-firewall-v1`) is only on optional bootstrap administration; do not invoke that surface.\n\n## Minimal configuration and ports\n\nFor each fresh home, daemon.json may be:\n\n {\"relay\":\"disabled\",\"docs_port\":0,\"peer_pump\":true,\"full_auto_update\":false}\n\nOnly docs_port override is required to avoid fixed listening-port collision for normal operation. `docs_port:0` passes zero to the listener and gets an ephemeral TCP port. Alternative: reserve a distinct known-free nonzero port per host/home. Do NOT use SPT_DOCS_PORT=0 alone: that environment value is explicitly ignored; default would remain 5474. `SPT_TEST_EPHEMERAL_ADVISORY_PORTS=1` is the existing test-only alternative, but config zero suffices without it. Discover the ACTUAL port through `spt docs url` / serving status or `DOCS_SERVER_UP` in the fixture's daemon log; never assume an env/default port.\n\nQUIC uses ephemeral UDP sockets automatically, so no SPT UDP port override is needed or exposed by this production configuration. Library `BindScope::AllOnPort` is not the production daemon selection. Pairing rendezvous also binds independent transient endpoints. The optional LAN bootstrap listener defaults to TCP 5470 but is OFF unless `serve lan --bootstrap` is invoked: leave it off. If it were needed, override `lan_bootstrap_port`/SPT_LAN_BOOTSTRAP_PORT as well; it cannot serve ordinary HTTP files and brings global firewall work, so it is unnecessary here. `relay:disabled` prevents reliance on public relays; it does not disable mDNS.\n\nKeep peer_pump=true for the field driver: the webserve test's peer_pump=false is a manually preseeded controlled experiment, not a suitable replacement for naturally learned endpoint and node-label state. Optional shorter registry_pump_period_ms can accelerate fixture convergence, but is not required and changes cadence.\n\n## Executable public launch/status/stop recipe\n\nRun this only in a known UNELEVATED PowerShell execution context on each host. Main substitutes that node's actual candidate absolute path and NEW absolute fixture home. On ENLYZEAM run the same script body through `ssh decid@enlyzeam powershell -NoProfile ...` (or encoded command); do not assume local environment overrides cross SSH.\n\n $exe = ''\n $fixtureHome = ''\n Get-ChildItem Env: | Where-Object { $_.Name -match '^(SPT_|SPTC_|OWL_)' } | ForEach-Object { Remove-Item ('Env:' + $_.Name) }\n $env:SPT_HOME = $fixtureHome\n $env:SPT_INSTALL_NO_FIREWALL = '1' # defense for installer paths only; NOT startup firewall safety\n New-Item -ItemType Directory -Path $fixtureHome -ErrorAction Stop | Out-Null\n [IO.File]::WriteAllText((Join-Path $fixtureHome 'daemon.json'), '{\"relay\":\"disabled\",\"docs_port\":0,\"peer_pump\":true,\"full_auto_update\":false}', [Text.UTF8Encoding]::new($false))\n & $exe node start\n & $exe node status --json\n & $exe docs url\n\n`node` is current primary spelling; `daemon` is supported and used throughout the existing fixtures. `node start` uses the Windows detached ladder and forwards SPT_* variables; no resident daemon sees the fixture's home-specific IPC. Alternatively supervise `& $exe daemon run` as a real long-lived process with stdout/stderr redirected: it launches its own brain; do not manually launch a second brain. Public foreground run can refuse when an elevated token would trigger detached de-elevation, so use a deliberately unelevated launcher instead of treating that refusal as readiness.\n\nFresh boot creates its own random identity/node.key. Do not copy node.key, roster, trust, adapter services, or existing homes from either resident node. Do not log secret node.key bytes. Status is a real IPC query: require running=true, net_up=true, nonempty node_id_hex and self_addr, and a live pid matching the candidate broker. `brain.ready` is JSON with pid, not just decimal text. Correlate both recorded PIDs with `Get-CimInstance Win32_Process -Filter \"ProcessId = \"` ExecutablePath/CommandLine/ParentProcessId and candidate image hash. Broker command should be candidate `daemon run`; brain command candidate `daemon brain ...`. A version string alone is insufficient for a dirty-source build. Re-read current brain PID before eventual forced cleanup because supervisor can rotate it. Status's `pid` is live broker/supervisor identity; brain.ready is a breadcrumb, not liveness proof.\n\nShutdown under the SAME scrubbed fixture environment and candidate path:\n\n & $exe node stop --force\n & $exe node status --json\n\nStop records a per-home inhibit, asks only that home's seed-control pipe to stop, disables supervisor respawn, then reaps brain subtree (`daemon.rs:480-494`). Prefer ordinary stop after endpoint children are finished; use --force when fixture-owned sessions remain. If IPC cannot stop, use `taskkill /PID /F /T`, then only a separately verified surviving fixture brain PID if needed. Never image-wide taskkill, installed daemon restart, service/task manipulation, or a PID inferred solely from stale files. Native test helpers use PID trees, not machine-wide process names.\n\n## Pairing: public path versus unattended native fixture path\n\nPublic path is `spt subnet create --open` on A, then `spt subnet show-code ` and `spt subnet join --code --verbose` on B. It is NOT an unattended direct-IP solution: create requires elevation AND interactive admin-key capture proof before saving; --open only skips the mode question. Public join has no --peer or --addr option and performs rendezvous. Do not claim those flags exist or that piped create is enough. If using elevated create, start the already-isolated broker unelevated first so creation's ensure-daemon cannot spawn an elevated broker.\n\nFor automated field preparation, the existing test pattern initializes fixture membership directly. A minimal legacy-compatible seed-holder record is `/identity/subnet.json`:\n\n {\"subnets\":[{\"name\":\"\",\"seed_hex\":\"\",\"epoch\":1,\"user\":null}]}\n\nThis is the shape produced by test `add_joined(...,1,None,None)`, not a claim that the public create/admin-capture ceremony ran. Generate fresh cryptographic seed bytes for this run; never reuse the committed test seed. Seed only A, leave B membership absent, then perform actual native pairing B→A. Prefer establish this before daemon start; responder reads live membership as well. Missing mode means inherited implicit-open for this isolated rig; if admin governance is part of the requested experiment, this legacy test pattern would not prove it.\n\nObtain A's live `self_addr` and `node_id_hex` using `node status --json`; exchange through SSH. Use the fixture broker's **native IPC** on B to send `pair-join` with:\n\n {\"protocol_version\":1,\"kind\":\"pair-join\",\"payload\":{\"subnet\":\"\",\"code\":\"\",\"responder_addr\":}}\n\nThis goes through `dispatch_pair_join` and actual SPAKE2 ceremony, transferring the seed and writing trust/roster/observed addresses on both fixtures. Expected response is kind pair-joined, payload.ok=true. Current code is the standard 30-second six-digit member TOTP; obtain with elevated `subnet show-code` or compute from the newly owned fixture seed as the test does. Do not publish seeds/codes in general result artifacts.\n\nExact wire: Windows namespaced broker pipe from endpoint.rs, each message is 4-byte big-endian UTF-8 JSON byte length followed by JSON. First write one hello envelope `{ \"protocol_version\":1,\"kind\":\"hello\",\"payload\":{\"protocol_version\":1,\"role\":\"brain\"}}`; no hello reply is required. Then send native request and read framed reply. `net-status` and `broker-image` accept null payload and are suitable to confirm correct endpoint/process BEFORE pair-join. Use home-derived pipe name from a native helper or enumerate named pipes and verify server PID against the live fixture broker PID using GetNamedPipeServerProcessId; never select the first `spt-daemon-broker-*` pipe or attempt pairing on any unverified pipe. The serde `EndpointAddr` is opaque to SPT: preserve the live returned JSON, rather than assuming peeraddrs unit-test fake JSON is transport-valid. Choose an address carrying the reachable cross-host LAN/tailnet IP with the ACTUAL ephemeral UDP port. SSH reachability alone establishes TCP reachability, NOT QUIC UDP reachability. An ordinary SSH -L forwards TCP, not SPT QUIC.\n\nFollowing pair success, both homes should show exactly the fresh subnet and fixture node keys in their roster/trust views; neither resident key should appear. Allow natural pump convergence, then verify fixture endpoint visibility from the other fixture before running cells. Pairing records observed direct peer routes automatically; no manual copying of resident peer-addrs is appropriate. If explicit route reinforcement is needed, the validated native/test precedent is `/identity/peer-addrs.json` keyed by the exact remote public key, retaining its live EndpointAddr, but this is not a substitute for seed-proof pairing.\n\n## Labels and HTTP fetch constraints\n\nWindows labels come from COMPUTERNAME (`hostlabel.rs:48-57`), not home or key. Therefore fixture and resident on one physical host share HFENDULEAM/ENLYZEAM labels by default. This is safe ONLY because fixture membership/registry excludes residents. Config's owner_node_label should remain the actual remote advertised label, and HTTP node segments are lowercased. There is no native node-label daemon.json override; changing COMPUTERNAME only for some commands would make a torn label universe.\n\nFetch remote-owned files through the REQUESTING fixture's actual loopback HTTP port: `http://localhost:/enlyzeam/f/`, not `http://enlyzeam:/...` (owner docs binds loopback only), and not resident localhost:5474. Remote label must resolve through learned fixture roster/registry. Unknown label is not a direct-host DNS fallback. Serving adds go through real seed-control, not a seed-named fake broker. Entry URL emitted by the owner contains its bound port; when consuming cross-node, use requester's bound port while retaining remote node/resource path. Fetch must pass owner WEB access and any per-entry audience/provenance restrictions. Keep peer pump enabled so node labels and endpoint types are naturally advertised; the cited webserve test explicitly seeds labels before boot only because it disables pump.\n\nNo files were edited, no processes started, no build/test/validation commands executed. All conclusions are source investigation; actual elevation, firewall admission, UDP reachability, candidate PID/image identity and runtime pairing remain Main's setup observations." }