[jayleaton]

Linked tailnet devices had no way to limit or cut off one of them. Access was fixed when a link was made.

This adds a device policy that every device replicates. Entries merge last-writer-wins by hybrid logical clock, so any order of gossip converges.

• Enforcement: /mcp narrows each device session to the lower of its token and the device's current entry on every request, so a change applies without re-linking.
• Revoke: ends the device's sessions and its link everywhere the policy reaches. Its handshakes are refused, and the scan skips it. Any full-access machine can restore it.
• Who can write: a write counts only if its author is full access on the receiving side and is not the device it names. A revoked or limited device cannot widen itself, even relayed through another device.
• Shared settings (autoLink, defaultAccess, requireCapability) moved into the same replica.
• RPC: tailnetDevices.setAccess is wired.
• MCP:
  • t3_environment_links lists devices with origin, access and status.
  • t3_environment_device_access sets access or revokes/restores through the same service method. It is full-access only, refused for linked work, and hidden while links are off.

Tests:

• policy merge converges for every order of the same writes;
• a changed level applies to the next request;
• a revoke on one machine cuts the device off on another;
• self-restore is refused, both directly and relayed;
• policy from a limited device is ignored;
• restore lets the device link again;
• the tool refuses below-full-access callers and linked work.

The MCP tool list grows by 604 bytes, so this needs the agent-context-increase label.

Opus 5.5 via Claude Code (Doug B)

🤖 Generated with Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	5.0 KiB	—	6.8 KiB	✅
Codex	Thread snapshot wire	—	3.8 KiB	—	4.9 KiB	✅
Codex	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Codex	Live turn WebSocket decoded	—	21.6 KiB	—	24.4 KiB	✅
Codex	Live turn messages	—	2	—	8	✅
Claude	Total thread wire	—	5.0 KiB	—	6.8 KiB	✅
Claude	Thread snapshot wire	—	3.8 KiB	—	4.9 KiB	✅
Claude	Live turn WebSocket wire	—	1.3 KiB	—	2.0 KiB	✅
Claude	Live turn WebSocket decoded	—	21.9 KiB	—	24.4 KiB	✅
Claude	Live turn messages	—	2	—	8	✅

Baseline: unavailable · PR result: b37fe6c · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.