Module mesh 

qualia-cli mesh-probe — a two-machine SocialWebNet reachability probe.

This is the manual, cross-host counterpart to the in-process loopback tests: it stands up a real userspace-WireGuard tunnel between two separate machines over a real network, so a human can confirm handshake + data (and NAT traversal) end-to-end. Only one AI instrument writes this; a person runs the two halves.

Zero key-copying: keys derive from a shared passphrase + role

WireGuard is mutually authenticated — each side must know the other’s static public key. To keep the manual procedure to one shared secret, both halves derive both keypairs deterministically from a passphrase and a role tag:

  secret(role) = SHA-256("qualia-mesh-probe:v1:" || role || ":" || passphrase)

The listen side is role a; the connect side is role b. Each computes its own secret and the peer’s public key from the same passphrase, so nothing but the passphrase (and the listener’s address) needs to be shared.

The passphrase mode is for testing reachability, not production peering — production keys come from NodeIdentity / the connection-identifier exchange, never a shared phrase.

Procedure

On the machine that will listen (say its public IP is A_IP):

  qualia-cli mesh-probe listen --pass "our-test-2026" --port 51820

On the other machine:

  qualia-cli mesh-probe connect --pass "our-test-2026" --peer A_IP:51820 --message "hello"

The listener prints each decrypted inner packet; the connector reports handshake + send. For a machine behind NAT, forward/allow UDP 51820 to the listener (or run the listener on the public-IP side).

Enums

MeshAction

Functions

derive_secret 🔒

Derive a deterministic 32-byte WireGuard secret from (role, passphrase).

hex_lower 🔒

run

run_connect 🔒

run_listen 🔒