norrietaylor · Jun 24, 2026 · Jun 24, 2026 · Jun 24, 2026 · Jun 24, 2026 · Jun 24, 2026
@@ -83,3 +83,21 @@ jobs:
         # these tests the filter matches nothing: a green no-op that still compiles
         # the affected crates' test targets.
         run: cargo test -p minimald -p sandbox2 -p minimald-rpc netns -- --include-ignored --nocapture
+      - name: Run WireGuard mesh netns proof (UC7)
+        env:
+          MINIMALD_NETNS_TEST: "1"
+          GVPROXY_BIN: ${{ runner.temp }}/gvproxy
+        # The UC7 two-namespace mesh proof lives in the `networking-wg`-gated
+        # `mesh_uc7.rs` (feature is minimald-only, cannot span the multi-package
+        # command above). Unlike the sudo-per-command UC6 tests, mesh_uc7 binds
+        # sockets inside the namespaces via in-process `setns`, so the test
+        # *binary* must run as root. Build unprivileged, then run the binary
+        # under the runner's passwordless sudo.
+        run: |
+          set -euo pipefail
+          bin=$(cargo test -p minimald --features networking-wg --test mesh_uc7 \
+                  --no-run --message-format=json \
+                | jq -r 'select(.executable != null and (.target.name? == "mesh_uc7")) | .executable' \
+                | tail -1)
+          echo "mesh_uc7 test binary: $bin"
+          sudo -E "$bin" --include-ignored --nocapture
@@ -85,6 +85,13 @@ jobs:
         # (R4.5 mtls_missing_cert_returns_401_with_no_topology, UC2b
         # mtls_valid_cert_routes_to_backend). Exercise them explicitly.
         run: cargo nextest run -p minimald --features networking-proxy
+      - name: Run WireGuard mesh tests
+        # The WireGuard mesh peer is behind the non-default `networking-wg`
+        # feature, so `--workspace` above does not compile or run its proofs.
+        # Exercise them explicitly (R-WG: two_meshes_handshake_and_relay_a_packet,
+        # rpc get_mesh_status). The `#[ignore]` two-namespace mesh_uc7 proof runs
+        # in the netns lane.
+        run: cargo test -p minimald --features networking-wg
       - name: Run doctests
         run: cargo test --workspace --doc