intent: replace daemon-owned adhoc with submitted intent

Cargo.toml

@@ -33,7 +33,6 @@ inquire = "0.9.1"
 ipnet = { version = "2.10.1", features = ["serde"] }
 itertools = "0.14.0"
 libc = "0.2"
-local-ip-address = "0.6.5"
 prost = "0.14.1"
 rand = "0.9"
 serde = { version = "1.0.221", features = ["derive"] }

build.rs

@@ -4,7 +4,6 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     println!("cargo:rerun-if-changed=build.rs");
     std::env::set_var("PROTOC", protoc_bin_vendored::protoc_bin_path()?);
     tonic_prost_build::compile_protos("proto/intermesh.proto")?;
-    tonic_prost_build::compile_protos("proto/adhoc.proto")?;
 
     // Embed git commit hash at build time
     println!("cargo:rerun-if-changed=.git/HEAD");

context/interfaces/src/admin.md

@@ -4,7 +4,8 @@
 ## Responsible for
 - Serving the local Unix-socket admin API.
 - Providing a client used by CLI commands.
-- Dispatching admin commands to daemon state and modules.
+- Dispatching admin commands to daemon state.
+- Enforcing local self-endorsement intent boundaries at the admin API.
 
 ## Public interface
 ```rust
@@ -19,7 +20,6 @@ impl AdminServer {
     pub(crate) async fn run(
         self,
         grpc: GrpcService,
-        adhoc: adhoc::Handle,
         cancel: CancellationToken,
     ) -> anyhow::Result<()>;
 }
@@ -31,13 +31,19 @@ impl AdminClient {
     /// Create a client for the configured or default admin socket.
     pub(crate) fn new(socket_path: Option<PathBuf>) -> Self;
 
-    /// Return a client for ad-hoc admin RPCs.
-    pub(crate) async fn adhoc_admin_service_client(&self) -> anyhow::Result<AdhocAdminServiceClient<Channel>>;
-
     /// Fetch a structured debug/status dump from the daemon.
     pub(crate) async fn debug_dump(&self) -> anyhow::Result<StateDump>;
 
-    /// Submit one unsigned endorsement intent to the daemon for local signing.
-    pub(crate) async fn endorse(&self, endorsement: endor::Base) -> anyhow::Result<()>;
+    /// Get unsigned endorsement intents.
+    pub(crate) async fn intent_get(&self) -> anyhow::Result<Vec<endor::Base>>;
+
+    /// Add unsigned endorsement intents for the daemon to sign and install.
+    pub(crate) async fn intent_add(&self, endorsements: Vec<endor::Base>) -> anyhow::Result<()>;
+
+    /// Remove unsigned endorsement intents by exact match.
+    pub(crate) async fn intent_remove(&self, endorsements: Vec<endor::Base>) -> anyhow::Result<()>;
+
+    /// Replace the unsigned endorsement intent set.
+    pub(crate) async fn intent_replace(&self, endorsements: Vec<endor::Base>) -> anyhow::Result<()>;
 }
 ```

context/interfaces/src/connect.md

@@ -18,9 +18,6 @@ impl IntermeshClient {
         trust_engine: Arc<TrustEngine>,
     ) -> Self;
 
-    /// Add a single-use IP hint for bootstrapping an unknown IMID.
-    pub(crate) fn with_bootstrap_hint(self, imid: Imid, ip: IpAddr) -> Self;
-
     /// Connect to either `<imid>.imid` or a mesh name.
     pub(crate) async fn connect(&mut self, host: &str, port: u16) -> anyhow::Result<ClientTlsStream<TcpStream>>;
 

context/interfaces/src/manager.md

@@ -3,55 +3,30 @@
 
 ## Responsible for
 - Owning the endorsement lifecycle and invoking the trust engine.
-- Storing local endorsement intent from modules.
-- Reconciling local intent against observed signed state.
+- Reading durable endorsement intent from `State`.
+- Reconciling durable intent against observed signed state.
 - Publishing local endorsements and revocations through `State`.
 - Preprocessing observed signed endorsements into effective derivation input.
 - Calling `TrustEngine::update`.
 - Garbage collecting expired signed state.
-- Persisting durable state after observed signed state changes.
+- Notifying durable state changes for asynchronous persistence.
 
-`Intent` owns source-keyed local intent. `Manager` owns the lifecycle loop that
-reacts to store and intent changes, signs missing or renewable local
-endorsements, publishes local signed state, revokes retained self-endorsements
-that fell out of intent, preprocesses observed signed state, updates trust
-derivation, removes expired signed state, and persists signed-state changes
-through `State`.
+`Manager` owns the lifecycle loop that reacts to observed-message and durable-intent changes, signs missing or renewable local endorsements, revokes retained self-endorsements that fell out of intent, updates the trust derivation, and removes expired signed state through `State`.
 
 ## Public interface
 ```rust
-/// Source-keyed local endorsement intent.
-pub(crate) struct Intent;
-
-impl Intent {
-    /// Create an empty local intent set signed by this node.
-    pub(crate) fn new(keypair: ImidKeypair) -> Self;
-
-    /// Declare intended adhoc membership endorsements.
-    pub(crate) async fn set_adhoc(&self, bases: BTreeSet<endor::Base>);
-
-    /// Declare intended daemon self-IP endorsements.
-    pub(crate) async fn set_daemon(&self, bases: BTreeSet<endor::Base>);
-
-    /// Add a one-off admin-injected debug endorsement.
-    pub(crate) async fn add_debug(&self, base: endor::Base);
-}
-
-/// Lifecycle coordinator for local intent and observed signed state.
+/// Lifecycle coordinator for durable intent and observed signed state.
 pub(crate) struct Manager;
 
 impl Manager {
-    /// Create a lifecycle manager for local intent and observed signed state.
-    pub(crate) fn new(state: Arc<state::State>, trust_engine: Arc<TrustEngine>) -> Self;
-
-    /// Return the module-facing local intent handle.
-    pub(crate) fn intent(&self) -> Arc<Intent>;
+    /// Create a lifecycle manager for durable intent and observed signed state.
+    pub(crate) fn new(state: Arc<State>, trust_engine: Arc<TrustEngine>) -> Self;
 
     /// Run the lifecycle loop until cancelled.
     ///
-    /// The loop reconciles local intent, publishes local endorsements and
-    /// revocations, preprocesses observed signed state, updates `TrustEngine`,
-    /// and removes expired signed state through `State`.
+    /// The loop reconciles `State::intents()`, preprocesses observed signed
+    /// state, updates `TrustEngine`, then publishes local signed-state changes
+    /// through `State` so subscribers wake with the new derivation.
     pub(crate) async fn run(&self, cancel: CancellationToken);
 }
 ```