kyleandClaude Opus 5.5
7e3783faae
M4 is split into M4a and M4b. The M4a spec rests on facts checked against the owner's server and Mattermost's source at v11.11.0: the REST and WebSocket shapes, and that clients will not post a message starting with '/'. Records the design decisions, proposes P15 (secrets from a systemd credential, the environment or an owner-only file), and adds the run-time rows egress.md was missing since M2a and M3b. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
1.3 KiB
1.3 KiB
Egress
Every outbound network call the project makes, at run time or in development. Nothing else is allowed.
| When | From | To | What |
|---|---|---|---|
| Development | cargo |
crates.io | Downloading the crates listed in docs/dependencies.md |
| Development | make verify-device, tools/check-m3a-device.sh |
straylight's llama-server |
Checks against the real model through a private inferproxy; the script also reads /slots with curl first |
| Development | make audit |
github.com/rustsec/advisory-db | The RustSec advisory database, fetched by cargo deny check advisories |
| Run time (M2a) | inferproxy |
the llama-server router on the host (straylight:11434) |
Every inference request loopd makes, forwarded byte for byte |
| Run time (M3b) | brokerd's egress proxy container, for one http_fetch call |
only the hosts the call's grant names, on port 443, at public addresses | The tool's HTTPS request, end to end; the proxy sees only the host name |
| Run time (M4a) | gatewayd |
the owner's Mattermost at https://straylight.scylla-hammerhead.ts.net (tailnet) |
REST calls and one WebSocket: the owner's messages in, Boxmaker's answers out. Mattermost stores messages unencrypted in its database; the server is the owner's |
The two run-time rows for M2a and M3b were missing until 2026-09-23; they were added with the M4a spec.