Allow token-less mesh creation for adhoc

This commit refactors adhoc to make the token optional for creating or
joining meshes.   This will be useful when running in some orchestrators
where imids can be learned out of band.  In the process it make some
minor simplifications to the adhoc module, including putting full
responsibility for maintaining mesh names in the root.

Author: ejj

designs/adhoc_bootstrap.md

@@ -122,10 +122,9 @@ intermesh adhoc init --mesh <mesh> --name <name>
 1. **Check existing membership**: The daemon checks `DaemonState::adhoc_membership()`
    for persisted membership.
 
-   - If already root of the *same* mesh with the same name,
-     treat `--init` as idempotent token regeneration (ok + token).
-   - If already in a *different* mesh than the requested `--mesh`,
-     return error + error_message.
+   - If already root of the *same* mesh, treat `--init` as idempotent
+     token regeneration (ok + token).
+   - If already in a *different* mesh: return error.
 
 2. **Create and persist Membership**: A `Membership` struct is created
    containing the mesh pattern, root IMID, root IP, and node name. This is
@@ -166,35 +165,36 @@ the mesh (via SSH, configuration management, or other secure channels).
 
 ## Joining a Mesh
 
-A client joins an existing mesh with `intermesh adhoc join`:
+A client joins an existing mesh via token or hard-coded root identity:
 
 ```
 intermesh adhoc join <token> --name <name>
+intermesh adhoc join --mesh <domain> --root-imid <imid> --root-ip <ip>
 ```
 
-### Join Process
+Token mode requires a bootstrap token from root. Hard-coded mode is for
+orchestrated environments where root identity is provisioned out of band —
+no token exchange or gRPC to root occurs.
+
+### Join Process (Token Mode)
 
 1. **Check existing membership**: The daemon checks
    `DaemonState::adhoc_membership()` for persisted membership.
 
-   For `--join`, the daemon enforces a single-mesh constraint, but idempotent
-   re-joins are allowed:
+   Idempotency is based on root identity, not name:
    - If not in a mesh: proceed with join.
-   - If already in the same mesh with the same name: return ok (no-op).
-   - If already in a different mesh or with a different name: return error.
+   - If already joined to the same root (`root_imid` matches): return ok.
+   - If already joined to a different root: return error.
 
 2. **Client validates token**: The client decodes the token, verifies the
    signature, and checks expiration. The client prompts for confirmation
    showing the mesh domain and root IMID before proceeding.
 
 3. **Client sends bootstrap request**: The client connects to the root node's
-   IP address (from token) and sends a `JoinRequest` containing:
+   IP address (from token) and sends a `JoinTokenRequest` containing:
    - The original token (for root to validate)
-   - The requested node name (short name only, e.g., "db" not "db.test.mesh")
-
-   Note: The daemon-to-daemon `JoinRequest.name` field currently uses the short
-   name (first label). This should be changed to use the full node name for
-   consistency with the admin API.
+   - The requested name (`requested_name`) — this is what the joiner wants
+     to be called, but root's endorsement is what makes it authoritative
 
 4. **Root processes request**: The root validates the token signature and
    expiration, then adds the joiner to its persisted `Membership`. The
@@ -218,7 +218,8 @@ intermesh adhoc join <token> --name <name>
    If the root knows the joiner's IP, it also endorses it.
 
 5. **Client creates local Membership**: After receiving confirmation, the
-   client creates a `Membership` struct and persists it to the state file.
+   client creates a `Membership` struct (with `root_name: None` — the client
+   learns its name from root's endorsement) and persists it to the state file.
    `Membership::to_bases()` generates the client's intended endorsements,
    pushed to the endorsement manager:
 
@@ -262,6 +263,34 @@ its own subdomain.
 The client is now fully integrated into the mesh and can discover other nodes
 through gossip.
 
+### Join Process (Hard-Coded Mode)
+
+Hard-coded join (`intermesh adhoc join --mesh <domain> --root-imid <imid>
+--root-ip <ip>`) writes local `Membership` directly from explicit args. No
+token exchange, no gRPC to root. The orchestrator is responsible for running
+`adhoc add` on root first, then `adhoc join` on each joiner.
+
+The joiner does not specify a name — it learns its name from root's
+endorsement after gossip convergence. Idempotency is based on `root_imid`:
+re-joining the same root is a no-op, joining a different root is an error.
+
+## Adding Members (Root-Only)
+
+Root can add members explicitly without token exchange:
+
+```
+intermesh adhoc add --name <name> --imid <imid> --ip <ip>
+```
+
+This is a root-only operation that adds a joiner entry to `Membership.joiners`
+and recomputes intent. The endorsement manager's reconcile loop signs the
+new member's name, delegation, and IP endorsements. IP is required — there
+is no discovery mechanism in adhoc mode.
+
+Validation: mesh must be initialized (`FailedPrecondition`), caller must be
+root (`PermissionDenied`), and name must be under the mesh pattern
+(`InvalidArgument`).
+
 ## Mesh Membership
 
 ### Explicit persistence
@@ -277,11 +306,15 @@ struct Membership {
     mesh: NamePattern,                  // e.g. "**.test.mesh"
     root_imid: Imid,
     root_ip: IpAddr,
-    my_name: Name,                      // e.g. "db.test.mesh"
-    joiners: BTreeMap<Imid, Joiner>,    // root-only: accepted joiners
+    root_name: Option<Name>,           // only set on root (e.g. "root.test.mesh")
+    joiners: BTreeMap<Imid, Joiner>,   // root-only: accepted joiners
 }
 ```
 
+`root_name` is only set on the root node (used for self-endorsement in
+`root_bases()`). Non-root nodes set it to `None` — they learn their name
+from root's endorsement, not from local state.
+
 Membership is accessed via `DaemonState::adhoc_membership()` and set via
 `adhoc::Handle::set_membership()`, which persists to disk and pushes intent
 to the endorsement manager atomically under a mutex.
@@ -293,19 +326,26 @@ can diff intent vs observed and re-sign any missing endorsements.
 
 ### CLI UX
 
-The CLI commands `intermesh adhoc init` and `intermesh adhoc join` are designed
-to be idempotent where possible:
+The CLI commands are designed to be idempotent where possible:
 
 - `intermesh adhoc init --mesh <mesh> --name <name>`
   - if not in a mesh: initialize and generate token
-  - if already root of the same mesh with same name: regenerate token
-  - if already in a different mesh or with different name: error
+  - if already root of the same mesh: regenerate token (idempotent)
+  - if already in a different mesh: error
 
-- `intermesh adhoc join <token> --name <name>`
+- `intermesh adhoc join <token> --name <name>` (token mode)
   - if not in a mesh: join using the token
-  - if already in the same mesh with same name: success (no-op)
-  - if already in the same mesh with different name: error (no rename)
-  - if already in a different mesh: error
+  - if already joined to the same root: success (no-op)
+  - if already joined to a different root: error
+
+- `intermesh adhoc join --mesh <domain> --root-imid <imid> --root-ip <ip>`
+  (hard-coded mode)
+  - if not in a mesh: join with explicit root identity
+  - if already joined to the same root: success (no-op)
+  - if already joined to a different root: error
+
+- `intermesh adhoc add --name <name> --imid <imid> --ip <ip>` (root-only)
+  - adds a member by explicit identity, no token exchange
 
 ### Leaving a Mesh (future)
 
@@ -323,22 +363,18 @@ The adhoc protocol is defined in `proto/adhoc.proto`.
 
   The admin API uses standard gRPC status codes for errors:
 
-  - `Init(InitRequest) -> InitResponse`
-    - On success: returns response with `token` field
-    - On error: returns gRPC `Status` (e.g., `ALREADY_EXISTS`, `INVALID_ARGUMENT`)
+  - `Init(InitRequest) -> InitResponse` — initialize mesh, returns token
+  - `Join(JoinTokenRequest) -> JoinResponse` — token-based join
+  - `JoinDirect(JoinDirectRequest) -> JoinResponse` — hard-coded join
+  - `Add(AddRequest) -> AddResponse` — add member by IMID (root-only)
 
-  - `Join(AdminJoinRequest) -> AdminJoinResponse`
-    - On success: returns empty response
-    - On error: returns gRPC `Status` with error message
+  All RPCs return gRPC `Status` on error (e.g., `ALREADY_EXISTS`,
+  `INVALID_ARGUMENT`, `PERMISSION_DENIED`).
 
   Mesh membership status is exposed via the main state dump (`StateDump`) rather
   than a dedicated RPC. The state dump includes `adhoc_membership` containing
   `Membership` data (if in a mesh).
 
-  This design:
-  - Uses idiomatic gRPC error handling
-  - Reuses existing state introspection infrastructure
-  - Allows CLI to query mesh status *before* init/join calls
-
 - **`JoinService`**: Network interface for daemon-to-daemon bootstrap
-  - `Accept(JoinRequest) -> JoinResponse`: Process join request from a peer
+  - `Accept(JoinTokenRequest) -> JoinResponse`: Process join request from a
+    peer

proto/adhoc.proto

@@ -6,6 +6,7 @@ package intermesh.adhoc;
 service AdminService {
   rpc Init(InitRequest) returns (InitResponse);
   rpc Join(JoinRequest) returns (JoinResponse);
+  rpc Add(AddRequest) returns (AddResponse);
 }
 
 message InitRequest {
@@ -19,14 +20,30 @@ message InitResponse {
 
 // Daemon-to-daemon join acceptor API.
 service JoinService {
-  rpc Accept(JoinRequest) returns (JoinResponse);
+  rpc Accept(JoinTokenRequest) returns (JoinResponse);
 }
 
-// Note JoinRequest and JoinResponse are used both between the cli and the
-// daemon, and between the joining and root daemon.
+// CLI-to-daemon join: one operation, two modes.
 message JoinRequest {
+  oneof mode {
+    JoinTokenRequest token = 1;
+    JoinDirectRequest direct = 2;
+  }
+}
+
+// Token-based join: joiner presents token to root over mTLS.
+message JoinTokenRequest {
   Token token = 1;
-  string node_name = 2; // (Name) Full node name (e.g., "db.test.mesh")
+  string requested_name = 2; // (Name) Name the joiner wants (e.g., "db.test.mesh")
+}
+
+// Direct join: joiner writes local membership from explicit root identity.
+// No token, no gRPC to root. CLI-to-daemon only. Joiner learns its name
+// from root's endorsement, not from this request.
+message JoinDirectRequest {
+  string mesh_pattern = 1; // (NamePattern) e.g., "**.test.mesh"
+  string root_imid = 2;    // (IMID) Root node's IMID
+  string root_ip = 3;      // (IP) Root node's IP address
 }
 
 message JoinResponse {
@@ -44,6 +61,14 @@ message Token {
   bytes signature = 2;
 }
 
+message AddRequest {
+  string name = 1; // (Name) Full node name (e.g., "db.test.mesh")
+  string imid = 2; // (IMID) Node's IMID
+  string ip = 3;   // (IP) Node's IP address
+}
+
+message AddResponse {}
+
 message Membership {
   string mesh_pattern = 1; // (NamePattern) e.g., "**.test.mesh"
   string root_imid = 2;    // (IMID) Root node's IMID

src/bin/intermesh.rs

@@ -6,7 +6,7 @@ use intermesh::cmd_status;
 use intermesh::daemon;
 use intermesh::daemon_state::{DaemonArgs, DaemonState};
 use intermesh::fmt;
-use intermesh::modules::adhoc::cli::{cmd_init, cmd_join, InitArgs, JoinArgs};
+use intermesh::modules::adhoc::cli::{cmd_add, cmd_init, cmd_join, AddArgs, InitArgs, JoinArgs};
 use std::path::PathBuf;
 use tokio::process::Command;
 
@@ -84,6 +84,9 @@ enum AdhocCommands {
 
     /// Join an existing mesh network
     Join(JoinArgs),
+
+    /// Add a member to the mesh (root only)
+    Add(AddArgs),
 }
 
 #[derive(Subcommand)]
@@ -178,6 +181,7 @@ async fn main() -> Result<()> {
         Some(Commands::Adhoc { command }) => match command {
             AdhocCommands::Init(args) => cmd_init(args, cli.admin_socket).await?,
             AdhocCommands::Join(args) => cmd_join(args, cli.admin_socket).await?,
+            AdhocCommands::Add(args) => cmd_add(args, cli.admin_socket).await?,
         },
         Some(Commands::Debug { command }) => match command {
             DebugCommands::Dump { toml } => {

src/daemon_state.rs

@@ -468,7 +468,7 @@ mod tests {
             mesh: "**.test.mesh".parse().unwrap(),
             root_imid: ImidKeypair::generate().to_imid(),
             root_ip: "192.168.1.1".parse().unwrap(),
-            my_name: "db.test.mesh".parse().unwrap(),
+            root_name: None,
             joiners: BTreeMap::new(),
         };
         state