verify_record derives its CA set from self.roots (the root-node pubkey entries) while verify_cert/ingest_record use the separately-configured ca_public (bin/yipd/src/membership.rs:220 vs :240). These only agree if the operator also places the CA's Ed25519 key as a root entry (as every test fixture does). The natural reading of 'root set = bootstrap nodes' lists node keys — then verify_record fails closed and mesh registration/roaming silently never verifies. Fail-closed (availability, not a break) but no load-time check and no test can catch a divergence (fixtures make them equal). Fix: assert the CA key is among the roots at load; document the relationship.
See docs/2026-07-25-project-review-and-roadmap.md for the full review synthesis.
verify_record derives its CA set from self.roots (the root-node pubkey entries) while verify_cert/ingest_record use the separately-configured ca_public (bin/yipd/src/membership.rs:220 vs :240). These only agree if the operator also places the CA's Ed25519 key as a root entry (as every test fixture does). The natural reading of 'root set = bootstrap nodes' lists node keys — then verify_record fails closed and mesh registration/roaming silently never verifies. Fail-closed (availability, not a break) but no load-time check and no test can catch a divergence (fixtures make them equal). Fix: assert the CA key is among the roots at load; document the relationship.
See docs/2026-07-25-project-review-and-roadmap.md for the full review synthesis.