huskies: merge 628_story_websocket_connect_time_mutual_auth_using_node_identity_primitives

server/src/main.rs

@@ -418,10 +418,10 @@ async fn main() -> Result<(), std::io::Error> {
 
     // (CRDT state layer is initialised above alongside the legacy pipeline.db.)
 
-    // Start the CRDT sync rendezvous client if configured in project.toml.
+    // Load trusted keys and start the CRDT sync rendezvous client if configured.
     // In agent mode, the --rendezvous flag overrides project.toml.
-    let rendezvous_url_for_sync = if is_agent {
-        agent_rendezvous.clone()
+    let sync_config = if is_agent {
+        agent_rendezvous.clone().map(|url| (url, Vec::new()))
     } else {
         app_state
             .project_root
@@ -429,10 +429,22 @@ async fn main() -> Result<(), std::io::Error> {
             .unwrap()
             .as_ref()
             .and_then(|root| config::ProjectConfig::load(root).ok())
-            .and_then(|cfg| cfg.rendezvous)
+            .and_then(|cfg| cfg.rendezvous.map(|url| (url, cfg.trusted_keys)))
     };
-    if let Some(rendezvous_url) = rendezvous_url_for_sync {
+    if let Some((rendezvous_url, trusted_keys)) = sync_config {
+        crdt_sync::init_trusted_keys(trusted_keys);
         crdt_sync::spawn_rendezvous_client(rendezvous_url);
+    } else {
+        // Even without rendezvous, initialise trusted keys for incoming connections.
+        let keys = app_state
+            .project_root
+            .lock()
+            .unwrap()
+            .as_ref()
+            .and_then(|root| config::ProjectConfig::load(root).ok())
+            .map(|cfg| cfg.trusted_keys)
+            .unwrap_or_default();
+        crdt_sync::init_trusted_keys(keys);
     }
 
     // ── Agent mode: headless build agent ────────────────────────────────