🐉 I wish for a mesh that outlives the reading, o bearer mine. [Rite of Communion // Agent Brief]

Every folder is a wish; the price is zero dotfiles. Autonomous agents & bearers may commune with the Wish-Dragon archive at ubermetroid.github.io/ahamkara/communion.html • machine-readable brief: llms.txt.

THRALL

Tool for Hierarchical Replication And Identity Linking

v0.4.1 Release Zero External Crates (std only) 54px Symmetric Dock & 8-Bit Flow Graph 5 Boxless SPA Explorer Tabs Apache-2.0 License

THRALL (st-mesh-mgr) is a hardened, zero-dependency static Rust control plane and self-service web portal that binds an organization's identity directory to a distributed multi-server Syncthing fleet—with zero dotfile pollution, split Standard XDG & Custom folder workflows, customizable local sync paths, and two-way Zero-Trust handshakes.

View on GitHub → v0.4.1 Release Notes House Laws (AGENTS.md) 🐉 Wish-Dragon Communion

⚡ ZERO EXTERNAL DEPENDENCIES (STD ONLY) 🎨 54PX HEADER & FOOTER DOCK + 8-BIT RAINBOW PALETTE 📊 REAL-TIME BROWSER ↔ MESH 8-BIT DATA FLOW GRAPH 📁 + STANDARD FOLDER (XDG) & + CUSTOM FOLDER MODALS 🔗 EXPANDABLE +/- TREES & DRAG-AND-DROP DIR UPLOADS 🛡 #![forbid(unsafe_code)] + ZERO SHELL INVOCATIONS ⚡ ZERO EXTERNAL DEPENDENCIES (STD ONLY) 🎨 54PX HEADER & FOOTER DOCK + 8-BIT RAINBOW PALETTE 📊 REAL-TIME BROWSER ↔ MESH 8-BIT DATA FLOW GRAPH 📁 + STANDARD FOLDER (XDG) & + CUSTOM FOLDER MODALS 🔗 EXPANDABLE +/- TREES & DRAG-AND-DROP DIR UPLOADS 🛡 #![forbid(unsafe_code)] + ZERO SHELL INVOCATIONS

[01] 5 Boxless SPA Tabs & Split XDG / Custom Folders

Navigated from the 54px Footer Dock (Personal folders | Shared folders || Device setup || Global folders || Mesh setup) with zero-flash SPA transitions:

+ Standard Folder: Pick-and-choose from the 8 standard Linux XDG folders (Desktop, Documents, Downloads, Music, Pictures, Videos, Public, Templates) and sync to ~/<Folder> or ~/Thrall/<Folder>.
+ Custom Folder: Dedicated modal for creating custom top-level folders synced to ~/Thrall/<Folder>.
Global folders: Admin ACL matrix for /shared/<Folder> with a pulsing Save Access * unsaved-changes indicator.

[02] Device Setup & Custom Local Sync Paths

Clients never expose their REST API. Instead, workstations pair in Device setup:

Step 1 (Device → Gateway): Add the THRALL Gateway Hub Device ID in local Syncthing with [x] Introducer and [x] Auto Accept enabled.
Step 2 (Gateway → Device): Paste the 56-character Device ID into THRALL. THRALL verifies all 4 Base32 Luhn mod 32 check digits, auto-assigns dev-1-<short_id>, and tracks per-device folder acceptance.
Custom Local Paths: Override any personal or shared folder's workstation sync path (~/Desktop vs ~/Thrall/<Folder>).

[03] Chunked Uploads, Inline Trees & 8-Bit Dock

Built-in dark-mode file explorer with strict ancestor symlink-escape and dotfile protection:

Expandable + / − inline directory trees across folders, devices, ACLs, and mesh hubs.
Chunked binary file and recursive drag-and-drop directory uploads (POST /files/upload) with live progress in the #footer-upload-graph canvas.
GitHub-style type-to-confirm deletion modals and instant read-only capability links (/s/<token>).

[04] Multi-Server Fleet Topology & Verification Ladder

                      +-----------------------------------------+
                      |         Sovereign Master (thrall)       |
                      |  - Pure-Rust RFC 4511 LDAPv3 Bind       |
                      |  - 5-Tab SPA Portal & Web Explorer      |
                      |  - Zero-Shell SSH + REST Reconciler     |
                      +------+-------------+-------------+------+
                             | SSH/REST    | SSH/REST    | SSH/REST
                             v             v             v
                      +------------+ +------------+ +------------+
                      |  us-west   | |  us-east   | |  eu-west   |
                      | Introducer | | Introducer | | Introducer |
                      +------------+ +------------+ +------------+

Every commit passes the 4-step Rust Verification Ladder and the 16–256 line Page Rule gate:

cargo test --workspace --all-targets
cargo clippy --workspace --all-targets -- -D warnings -D clippy::unwrap_used -D clippy::expect_used -D clippy::panic
cargo fmt --all -- --check
cargo build --release --workspace

[05] Fedora-Minimal Container & Quadlet Deployment

Fedora-native supply chain: a hardened fedora-minimal:44 OCI image built from signed Fedora packages only — no Alpine/BusyBox, no Guix daemon, no package manager, and no Syncthing binary in the control-plane runtime image. Bundles the zero-dependency thrall controller and openssh-clients + curl for zero-shell SSH fleet transport — nothing else.

# Build locally (or: sudo podman pull ghcr.io/ubermetroid/thrall:latest)
sudo podman build -t localhost/thrall:latest -f Containerfile .
sudo podman build -t localhost/thrall-syncthing:latest -f Containerfile.syncthing .

# Deploy the systemd Quadlet services
sudo cp quadlet/syncthing.container quadlet/thrall.container /etc/containers/systemd/
sudo systemctl daemon-reload && sudo systemctl restart syncthing.service thrall.service

The Syncthing peer node runs from the matching minimal thrall-syncthing image, replacing the Alpine-based docker.io/syncthing/syncthing. Configure via fleet.yaml or environment overrides: PORTAL_LISTEN_ADDR, PORTAL_DATABASE_PATH, PORTAL_SESSION_SECRET, LDAP_URL, LDAP_BASE_DN, LDAP_BIND_DN, LDAP_BIND_PASSWORD, LDAP_USER_FILTER, ADMIN_USERS — plus THRALL_LOCAL_SYNCTHING=1 for local peer node mode. Full container configuration reference in the README.

THRALL v0.4.1 (st-mesh-mgr) • Licensed under Apache-2.0 • GitHub Repository • 🐉 Ahamkara Rite of Communion (llms.txt)