huskies: merge 480_story_cryptographic_node_auth_for_distributed_mesh

server/src/config.rs

@@ -53,6 +53,13 @@ pub struct ProjectConfig {
     /// so both machines see the same pipeline state in real-time.
     #[serde(default)]
     pub rendezvous: Option<String>,
+    /// List of hex-encoded Ed25519 public keys of trusted nodes.
+    /// When non-empty, only nodes whose public key is in this list may
+    /// connect via the CRDT sync WebSocket. Nodes authenticate by signing
+    /// a random challenge with their private key.
+    /// When empty (default), the mesh is open — any node may connect.
+    #[serde(default)]
+    pub trusted_keys: Vec<String>,
 }
 
 /// Configuration for the filesystem watcher's sweep behaviour.
@@ -228,6 +235,7 @@ impl Default for ProjectConfig {
             rate_limit_notifications: default_rate_limit_notifications(),
             timezone: None,
             rendezvous: None,
+            trusted_keys: Vec::new(),
         }
     }
 }
@@ -304,6 +312,7 @@ impl ProjectConfig {
                             rate_limit_notifications: legacy.rate_limit_notifications,
                             timezone: legacy.timezone,
                             rendezvous: None,
+                        trusted_keys: Vec::new(),
                         };
                         validate_agents(&config.agent)?;
                         return Ok(config);
@@ -332,6 +341,7 @@ impl ProjectConfig {
                         rate_limit_notifications: legacy.rate_limit_notifications,
                         timezone: legacy.timezone,
                         rendezvous: None,
+                        trusted_keys: Vec::new(),
                     };
                     validate_agents(&config.agent)?;
                     Ok(config)
@@ -348,6 +358,7 @@ impl ProjectConfig {
                         rate_limit_notifications: legacy.rate_limit_notifications,
                         timezone: legacy.timezone,
                         rendezvous: None,
+                        trusted_keys: Vec::new(),
                     })
                 }
             }