feat(model): design-13 netguard security-group + wireguard topology models - #5
Merged
Conversation
GuardPortRange, GuardZone, GuardRule, SecurityGroup, NodeGuardBinding (versioned, with apply-state + drift-anchor fields), and the GuardNodeReality reporting contract. NetEndpoint gains an additive ZoneID for the new zone remote kind; builtin zone id constants cover public/loopback/wireguard/tailscale. Claude-Session: https://claude.ai/code/session_01D6PbasV2UT8nytJXGpn47Q
WGNetwork (mesh | hub-and-spoke | custom), WGMembership (role, address, per-member overrides, hub ExtraAllowedIPs), and WGExternalPeer for non-node devices. Topology/role constants plus WGDefaultListenPort/WGDefaultKeepalive. Additive: the existing implicit fleet mesh stays expressible through Node.WireGuard* and converts to this shape behind a render-parity gate. Claude-Session: https://claude.ai/code/session_01D6PbasV2UT8nytJXGpn47Q
5 tasks
lr00rl
changed the title
lr00rl
marked this pull request as ready for review
July 9, 2026 06:26
NetEndpoint now carries zone_id in both the Go/JSON model and the protobuf contract, and the proto contract test covers the newly introduced NetGuard and WireGuard messages so future model-only drift is visible. The free-form rate_limit field is removed before it becomes stable contract baggage; rate limiting should return as a structured type once the renderer slice exists. Constraint: design-13 is defining the shared SDK contract consumed by server and future clients Rejected: Leave protobuf unchanged | zone-scoped remotes would be silently unrepresentable outside Go/JSON Rejected: Keep rate_limit as string | opaque grammar would freeze invalid state into the public contract Confidence: high Scope-risk: moderate Directive: Do not add guard authoring fields to model.go without updating proto/lattice/v1/common.proto and proto_contract_test.go in the same slice Tested: go test ./... Not-tested: Generated protobuf bindings; repo currently stores proto contracts only
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wire contract for design-13 (LatticeNet/lattice#1) slices G1/G2/W1. Additive only.
NetGuard
GuardPortRange,GuardZone,GuardRule,SecurityGroup(versioned),NodeGuardBinding(versioned,Managed, apply-state +AppliedTableSHAdrift anchor),GuardListener/GuardInterface/GuardNodeReality(the G3 reality contract, frozen now).NetEndpoint.ZoneID+NetRefZone+ builtin zone id constants.WireGuard
WGNetwork(mesh | hub-and-spoke | custom; listen port, keepalive, MTU, DNS),WGMembership(role, server-allocated address, per-member overrides, hubExtraAllowedIPs),WGExternalPeer(non-node devices). Topology/role constants.The existing implicit fleet mesh stays fully expressible through
Node.WireGuard*and converts to this shape behind a render-parity gate (see lattice-server#6).gofmt -lclean,go test ./...green. Consumed by LatticeNet/lattice-server#6 via Go pseudo-version pin — no stable tag minted, sov0.2.16remains the latest release.https://claude.ai/code/session_01D6PbasV2UT8nytJXGpn47Q