[zenithruneblade]

Tether models one offered WireGuard network with multiple peers and named, isolated imported attachments. Operators can register and admit attachments, bind and activate them, and revoke generations without restarting Core.

The fixed host-owned lychd tether command group delegates to typed native services for preparation, key custody, lifecycle recovery, revocation and boot verification. Public Rune intent comparisons retain loader provenance checks. Podman operations use the local engine and verify exact secret identities, labels, material and default storage ownership. Bounded key observations bracket one backend inspection per live owned key with complete custody checks; public planning and commit boundaries obtain fresh proof.

Ansible prepares operating-system prerequisites and images, then delegates lifecycle authority to native services. WireGuard kernel preparation and read-only verification have separate task entry points. Repeated deployment verifies the owned runtime, kernel prerequisite and declared host UDP prerequisite. Native nft observation compares the complete expected policy using consistent symbolic formatting.

Deployment assessment recognizes implicit Pod infrastructure only after complete binding proof, exact local-engine Pod/container associations and matching current systemd process identity. Other extra runtime material remains refused.

Refs #20. State of Work retains the source-backed partial delivery boundary; this PR does not close the full acceptance outcome.

Validation on 5993f83:

• All four required GitHub checks passed: Core Python 3.14.8, Core Python 3.15.0, Altar contracts/build and Hexanomicon documentation build.
• Each Core job passed 10,344 tests, full source-and-test type checking with zero errors, Ruff, and formatting for 1,623 files.
• Deployment CI and all CodeQL language jobs passed.
• The latest controller checks passed 231 Ansible tests and four playbook syntax checks. Earlier AutoYaST validation passed 22 tests.
• A broader architecture run previously passed 751 tests with one pre-existing Scout receipt failure: the maintained Makefile hash already differs on the base revision. The receipt and test oracle were not rewritten; this PR does not requalify Scout.

Author review:

• I reviewed the submitted diff, including assisted changes and verification boundaries.
• Final maintainer review of upstream provenance, license obligations and shipped notices.