# ryu-mesh
The **read/shape side** of Ryu's optional Tailscale/Headscale mesh plane (unified-tool-
gateway epic #478, P5–P7). Core owns *what runs* — the optional `tailscaled` daemon,
a `Sidecar` managed Core-side. This crate shapes its status, resolves the peer-listing
bearer, and exposes the Funnel helpers public webhook ingress consumes.
## Role in the decomposition
An extracted **Core capability crate**, compiled into `apps/core` as the in-process
default (every entry point is a plain function call, never IPC) and consumed as a
**non-optional** path dependency — the fail-closed startup gate reads `is_enabled()` /
`is_insecure_auth_token_placeholder()` unconditionally.
Zero dependency on `apps/core`. The one kernel coupling — the `tailscale` /
`tailscaled` process shell-outs — inverts through the narrow **`MeshHost`** trait
(`status_json`, `ensure_funnel`, `funnel_url`), implemented in
`apps/core/src/mesh_host.rs` and installed once at boot via `set_global_host`.
**That trait is the swap seam.**
## Key surface
- `MeshHost` + `set_global_host` — the inverted daemon shell-out seam.
- `query_status` — shapes `tailscale status --json` into the canonical
`GET /api/mesh/status` contract (Contract 6).
- Fail-closed shared-mesh-token bearer resolution for `GET /api/mesh/peers`; the
node-admittance security model this crate anchors — `enforce_remote_auth` stays in
Core and consults `is_insecure_auth_token_placeholder` here.
- `ensure_funnel` / `funnel_url` — the Funnel primitives P6 (webhook ingress)
consumes for a public URL.
The mesh is **opt-in** — `RYU_MESH_ENABLED` (env, wins when set) OR the
`mesh-enabled` pref that Core seeds into `set_pref_enabled` (the desktop's Gateway →
Integrations toggle writes it through `POST /api/mesh/config`). When off,
`query_status` returns the all-default object (HTTP 200) **without** touching the
host, so a build that never installs a host still runs the default (mesh-disabled)
install correctly.
## Consumed as
Compiled-into-Core crate; served over Core's `/api/mesh/*` routes.
Deps: anyhow, async-trait, serde/serde_json, tracing. Dev: tokio.