F26-YG: Yes
Rationale
The pinned Yggdrasil link handler decodes peer metadata, checks the configured key pin and nonempty incoming AllowedPublicKeys policy, then calls the routing engine HandleConn. Metadata decoding verifies an Ed25519 signature with the claimed key. Failed peer admission therefore prevents that connection from injecting traffic into onward overlay forwarding.
Assessment method
Primary source admission ordering and selected-role comparison; no execution
Source context
Pinned Yggdrasil link.go/version.go; documented native key-pin and AllowedPublicKeys settings
Outstanding qualification
Credit the private pinned-peer configuration, with a nonempty allowlist on incoming listeners and no multicast/local bypass. Empty AllowedPublicKeys permits incoming peers. This is adjacency admission, not a final-source allowlist; an accepted neighbor can route traffic from others. TLS/TCP setup, metadata checking and incoming underlay bytes are already spent. No per-destination bandwidth reservation, full implementation test or F16 change follows.
Public sources
- https://raw.githubusercontent.com/yggdrasil-network/yggdrasil-go/422836eeb21a99790caa286aa63d493bbc4766d7/src/core/link.go
- https://raw.githubusercontent.com/yggdrasil-network/yggdrasil-go/422836eeb21a99790caa286aa63d493bbc4766d7/src/core/version.go
- https://yggdrasil-network.github.io/configurationref.html
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round448.html
- round448-sources.json