@serfab/cadre-host 0.9.0 → 0.10.0

package/src/auth/__tests__/trust-circle-integration.test.ts

@@ -1,147 +1,152 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { generateKeyPair } from '@libp2p/crypto/keys';
-import { peerIdFromPrivateKey } from '@libp2p/peer-id';
-import { CadreNode, ed25519KeyPairFromLibp2p } from '@serfab/cadre-core';
-
-import { TrustCircleService } from '../trust-circle.js';
-import { TrustCircleStore } from '../trust-circle-store.js';
-
-/**
- * End-to-end integration test: stand up a real host CadreNode with a real
- * Quereus control DB and exercise the full TrustCircleService issue → redeem
- * → list → remove cycle. The "phone" peerId is derived from a fresh Ed25519
- * key (no second libp2p node) since the test only validates host-side state.
- *
- * This replaces the mock CadreNodeLike in trust-circle.test.ts with the real
- * CadreNode to validate that:
- *  - `acceptPhone` (called from redeemInvite with a sparse reconstructed
- *    invite) actually inserts a CadrePeer row;
- *  - `list()` picks up the new peer via the canonical CadrePeer query;
- *  - `removeMember` deletes the row from CadrePeer via the
- *    DELETE-with-context syntax that cadre-core trusts from
- *    `quereus/docs/sql.md`.
- */
-describe('TrustCircleService — real CadreNode integration', () => {
-  let tmpRoot: string;
-  let host: CadreNode;
-  let store: TrustCircleStore;
-  let service: TrustCircleService;
-  let hostOwnerPrivateKey: string;
-  let hostOwnerPublicKey: string;
-
-  beforeEach(async () => {
-    tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-tc-int-'));
-
-    // Own-owner host: the node's libp2p identity key IS its owner key
-    // (the cadre-cli `--owner` shape), so registerSelf can owner-sign the
-    // INSERT of its own CadrePeer row.
-    const hostKey = await generateKeyPair('Ed25519');
-    const owner = ed25519KeyPairFromLibp2p(hostKey);
-    hostOwnerPrivateKey = owner.privateKeyB64;
-    hostOwnerPublicKey = owner.publicKeyB64;
-
-    const baseId = Math.random().toString(36).slice(2);
-
-    host = new CadreNode({
-      controlNetwork: { partyId: `host-${baseId}`, bootstrapNodes: [] },
-      privateKey: hostKey,
-      profile: 'transaction'
-    });
-
-    await host.start();
-
-    const db = host.getControlDatabase();
-    expect(db).not.toBeNull();
-    await db!.insertOwnerKey(hostOwnerPublicKey);
-
-    host.initializeSeedBootstrap(hostOwnerPrivateKey);
-
-    // The owner writes its own CadrePeer row up-front (the implement ticket's
-    // CLI change). After this the host's own peerId is a member, so it shows up
-    // alongside any redeemed peers in the trust-circle listing.
-    await host.registerSelf();
-
-    store = new TrustCircleStore(tmpRoot);
-    service = new TrustCircleService({ cadreNode: host, store });
-  }, 60_000);
-
-  afterEach(async () => {
-    try { await host.stop(); } catch { /* ignore */ }
-    try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
-  });
-
-  it('issues → redeems → lists against the real control DB (listMembers path)', async () => {
-    // Derive a shape-valid peerId from a fresh Ed25519 key — same pattern as
-    // packages/cadre-core/test/seed-bootstrap.spec.ts. The AuthorizedInsert
-    // constraint only checks the signature over digest(PeerId,…); peerId
-    // *liveness* doesn't matter for the host-side CRUD path under test.
-    const phoneKey = await generateKeyPair('Ed25519');
-    const phonePeerId = peerIdFromPrivateKey(phoneKey).toString();
-
-    // Issue
-    const issued = await service.issueInvite({ label: "Mom's phone" });
-    expect(issued.token).toBeTruthy();
-    expect(issued.encodedInvite).toBeTruthy();
-
-    // Redeem — this calls host.acceptPhone() with the sparse reconstructed
-    // invite, which in turn calls authorizePeer and inserts CadrePeer.
-    const redeemed = await service.redeemInvite({
-      token: issued.token,
-      peerId: phonePeerId
-    });
-    expect(redeemed).toEqual({ peerId: phonePeerId, label: "Mom's phone" });
-
-    // Verify directly against the control DB: the row is there.
-    expect(await isInCadrePeer(host, phonePeerId)).toBe(true);
-
-    // List — exercises the CadreNode.listMembers() path. CadrePeer now carries
-    // the host's own self-registered row in addition to the redeemed phone.
-    const snap = await service.list();
-    expect(snap.members).toHaveLength(2);
-    const phoneMember = snap.members.find((m) => m.peerId === phonePeerId);
-    expect(phoneMember).toBeDefined();
-    expect(phoneMember!.label).toBe("Mom's phone");
-    // The host's own peerId is present too (unlabeled → bare peerId as label).
-    expect(snap.members.some((m) => m.peerId === host.peerId!.toString())).toBe(true);
-    expect(snap.pending).toHaveLength(0);
-  }, 90_000);
-
-  // The signed `CadrePeer` DELETE previously threw a Quereus deferred-constraint
-  // error ("No row context found for column PeerId") inside cadre-core's
-  // removePeer. That upstream bug is fixed (`quereus-cadrepeer-delete-no-row-context`,
-  // landed), so the full issue → redeem → remove cycle is now exercised here.
-  it('removes a member from CadrePeer', async () => {
-    const phoneKey = await generateKeyPair('Ed25519');
-    const phonePeerId = peerIdFromPrivateKey(phoneKey).toString();
-
-    const issued = await service.issueInvite({ label: "Mom's phone" });
-    await service.redeemInvite({ token: issued.token, peerId: phonePeerId });
-    expect(await isInCadrePeer(host, phonePeerId)).toBe(true);
-
-    await service.removeMember(phonePeerId);
-
-    expect(await isInCadrePeer(host, phonePeerId)).toBe(false);
-    expect(store.getMember(phonePeerId)).toBeUndefined();
-    const afterRemove = await service.list();
-    // The phone is gone; the host's own self-registered row remains.
-    expect(afterRemove.members.map((m) => m.peerId)).not.toContain(phonePeerId);
-    expect(afterRemove.members).toHaveLength(1);
-    expect(afterRemove.members[0]!.peerId).toBe(host.peerId!.toString());
-  }, 90_000);
-});
-
-async function isInCadrePeer(node: CadreNode, peerId: string): Promise<boolean> {
-  const db = node.getControlDatabase();
-  if (!db) return false;
-  const inner = db.getDatabase();
-  for await (const row of inner.eval(
-    'select PeerId from CadreControl.CadrePeer where PeerId = ?',
-    [peerId]
-  )) {
-    if (row.PeerId === peerId) return true;
-  }
-  return false;
-}
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { generateKeyPair } from '@libp2p/crypto/keys';
+import { peerIdFromPrivateKey } from '@libp2p/peer-id';
+import { CadreNode, ed25519KeyPairFromLibp2p } from '@serfab/cadre-core';
+
+import { ensureSelfLabel } from '../self-label.js';
+import { TrustCircleService } from '../trust-circle.js';
+import { TrustCircleStore } from '../trust-circle-store.js';
+
+/**
+ * End-to-end integration test: stand up a real host CadreNode with a real
+ * Quereus control DB and exercise the full TrustCircleService issue → redeem
+ * → list → remove cycle. The "phone" peerId is derived from a fresh Ed25519
+ * key (no second libp2p node) since the test only validates host-side state.
+ *
+ * This replaces the mock CadreNodeLike in trust-circle.test.ts with the real
+ * CadreNode to validate that:
+ *  - `acceptPhone` (called from redeemInvite with a sparse reconstructed
+ *    invite) actually inserts a CadrePeer row;
+ *  - `list()` picks up the new peer via the canonical CadrePeer query;
+ *  - `removeMember` deletes the row from CadrePeer via the
+ *    DELETE-with-context syntax that cadre-core trusts from
+ *    `quereus/docs/sql.md`.
+ */
+describe('TrustCircleService — real CadreNode integration', () => {
+  let tmpRoot: string;
+  let host: CadreNode;
+  let store: TrustCircleStore;
+  let service: TrustCircleService;
+  let hostOwnerPrivateKey: string;
+  let hostOwnerPublicKey: string;
+
+  beforeEach(async () => {
+    tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-tc-int-'));
+
+    // Own-owner host: the node's libp2p identity key IS its owner key
+    // (the cadre-cli `--owner` shape), so registerSelf can owner-sign the
+    // INSERT of its own CadrePeer row.
+    const hostKey = await generateKeyPair('Ed25519');
+    const owner = ed25519KeyPairFromLibp2p(hostKey);
+    hostOwnerPrivateKey = owner.privateKeyB64;
+    hostOwnerPublicKey = owner.publicKeyB64;
+
+    const baseId = Math.random().toString(36).slice(2);
+
+    host = new CadreNode({
+      controlNetwork: { partyId: `host-${baseId}`, bootstrapNodes: [] },
+      privateKey: hostKey,
+      profile: 'transaction'
+    });
+
+    await host.start();
+
+    const db = host.getControlDatabase();
+    expect(db).not.toBeNull();
+    await db!.insertOwnerKey(hostOwnerPublicKey);
+
+    host.initializeSeedBootstrap(hostOwnerPrivateKey);
+
+    // The owner writes its own CadrePeer row up-front (the implement ticket's
+    // CLI change). After this the host's own peerId is a member, so it shows up
+    // alongside any redeemed peers in the trust-circle listing.
+    await host.registerSelf();
+
+    store = new TrustCircleStore(tmpRoot);
+    // Same self-labelling call bin/host.ts makes at startup, wired to the real
+    // node's peer ID instead of an OwnerNodeClient (this test constructs
+    // TrustCircleService directly against a CadreNode, so no client is in play).
+    await ensureSelfLabel({ store, getPeerId: async () => host.peerId!.toString() });
+    service = new TrustCircleService({ cadreNode: host, store });
+  }, 60_000);
+
+  afterEach(async () => {
+    try { await host.stop(); } catch { /* ignore */ }
+    try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
+  });
+
+  it('issues → redeems → lists against the real control DB (listMembers path)', async () => {
+    // Derive a shape-valid peerId from a fresh Ed25519 key — same pattern as
+    // packages/cadre-core/test/seed-bootstrap.spec.ts. The AuthorizedInsert
+    // constraint only checks the signature over digest(PeerId,…); peerId
+    // *liveness* doesn't matter for the host-side CRUD path under test.
+    const phoneKey = await generateKeyPair('Ed25519');
+    const phonePeerId = peerIdFromPrivateKey(phoneKey).toString();
+
+    // Issue
+    const issued = await service.issueInvite({ label: "Mom's phone" });
+    expect(issued.token).toBeTruthy();
+    expect(issued.encodedInvite).toBeTruthy();
+
+    // Redeem — this calls host.acceptPhone() with the sparse reconstructed
+    // invite, which in turn calls authorizePeer and inserts CadrePeer.
+    const redeemed = await service.redeemInvite({
+      token: issued.token,
+      peerId: phonePeerId
+    });
+    expect(redeemed).toEqual({ peerId: phonePeerId, label: "Mom's phone" });
+
+    // Verify directly against the control DB: the row is there.
+    expect(await isInCadrePeer(host, phonePeerId)).toBe(true);
+
+    // List — exercises the CadreNode.listMembers() path. CadrePeer now carries
+    // the host's own self-registered row in addition to the redeemed phone.
+    const snap = await service.list();
+    expect(snap.members).toHaveLength(2);
+    const phoneMember = snap.members.find((m) => m.peerId === phonePeerId);
+    expect(phoneMember).toBeDefined();
+    expect(phoneMember!.label).toBe("Mom's phone");
+    // The host's own peerId is present too (unlabeled → bare peerId as label).
+    expect(snap.members.some((m) => m.peerId === host.peerId!.toString())).toBe(true);
+    expect(snap.pending).toHaveLength(0);
+  }, 90_000);
+
+  // The signed `CadrePeer` DELETE previously threw a Quereus deferred-constraint
+  // error ("No row context found for column PeerId") inside cadre-core's
+  // removePeer. That upstream bug is fixed (`quereus-cadrepeer-delete-no-row-context`,
+  // landed), so the full issue → redeem → remove cycle is now exercised here.
+  it('removes a member from CadrePeer', async () => {
+    const phoneKey = await generateKeyPair('Ed25519');
+    const phonePeerId = peerIdFromPrivateKey(phoneKey).toString();
+
+    const issued = await service.issueInvite({ label: "Mom's phone" });
+    await service.redeemInvite({ token: issued.token, peerId: phonePeerId });
+    expect(await isInCadrePeer(host, phonePeerId)).toBe(true);
+
+    await service.removeMember(phonePeerId);
+
+    expect(await isInCadrePeer(host, phonePeerId)).toBe(false);
+    expect(store.getMember(phonePeerId)).toBeUndefined();
+    const afterRemove = await service.list();
+    // The phone is gone; the host's own self-registered row remains.
+    expect(afterRemove.members.map((m) => m.peerId)).not.toContain(phonePeerId);
+    expect(afterRemove.members).toHaveLength(1);
+    expect(afterRemove.members[0]!.peerId).toBe(host.peerId!.toString());
+  }, 90_000);
+});
+
+async function isInCadrePeer(node: CadreNode, peerId: string): Promise<boolean> {
+  const db = node.getControlDatabase();
+  if (!db) return false;
+  const inner = db.getDatabase();
+  for await (const row of inner.eval(
+    'select PeerId from CadreControl.CadrePeer where PeerId = ?',
+    [peerId]
+  )) {
+    if (row.PeerId === peerId) return true;
+  }
+  return false;
+}

package/src/auth/__tests__/trust-circle.test.ts

@@ -17,7 +17,15 @@ import { OwnerNodeUnavailableError } from '../../owner/owner-node-client.js';
  * real libp2p control network or admin channel.
  */
 class MockCadreNode implements CadreNodeLike {
+  /** CadrePeer rows — the real (authorized) membership test. */
   readonly authorizedPeers = new Set<string>();
+  /**
+   * Addressable-only rows — peers that published an address record without
+   * ever being vouched for. Models the "stranger writes its own row" bug:
+   * present in `listMembers`/`isMember` (addressable), absent from
+   * `listAuthorizedMembers`/`isAuthorizedMember` (authorized).
+   */
+  readonly unauthorizedAddressablePeers = new Set<string>();
   readonly issuedInvites: Array<{ token?: string; expiresIn?: number }> = [];
   readonly accepted: Array<{ phonePeerId: string; token?: string }> = [];
   readonly removed: string[] = [];
@@ -48,6 +56,7 @@ class MockCadreNode implements CadreNodeLike {
   async removePeer(peerId: string) {
     this.removed.push(peerId);
     this.authorizedPeers.delete(peerId);
+    this.unauthorizedAddressablePeers.delete(peerId);
   }
 
   encodeInvite(invite: CadreInvite): string {
@@ -56,10 +65,21 @@ class MockCadreNode implements CadreNodeLike {
 
   async listMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
     if (!this.nodeAvailable) throw new OwnerNodeUnavailableError('node down');
-    return [...this.authorizedPeers].map((peerId) => ({ peerId, multiaddr: null }));
+    return [...this.authorizedPeers, ...this.unauthorizedAddressablePeers]
+      .map((peerId) => ({ peerId, multiaddr: null }));
   }
 
   async isMember(peerId: string): Promise<boolean> {
+    if (!this.nodeAvailable) throw new OwnerNodeUnavailableError('node down');
+    return this.authorizedPeers.has(peerId) || this.unauthorizedAddressablePeers.has(peerId);
+  }
+
+  async listAuthorizedMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
+    if (!this.nodeAvailable) throw new OwnerNodeUnavailableError('node down');
+    return [...this.authorizedPeers].map((peerId) => ({ peerId, multiaddr: null }));
+  }
+
+  async isAuthorizedMember(peerId: string): Promise<boolean> {
     if (!this.nodeAvailable) throw new OwnerNodeUnavailableError('node down');
     return this.authorizedPeers.has(peerId);
   }
@@ -373,6 +393,30 @@ describe('TrustCircleService.list', () => {
     const entry = snap.members.find(m => m.peerId === 'unlabeled-peer');
     expect(entry?.label).toBe('unlabeled-peer');
   });
+
+  it('excludes addressable-only peers nobody authorized', async () => {
+    cadreNode.authorizedPeers.add('invited-peer');
+    cadreNode.unauthorizedAddressablePeers.add('stranger-peer');
+
+    const snap = await service.list();
+
+    expect(snap.members.map(m => m.peerId)).toContain('invited-peer');
+    expect(snap.members.map(m => m.peerId)).not.toContain('stranger-peer');
+  });
+
+  it('keeps the self row even though the authorized set excludes self', async () => {
+    store.addMember({ peerId: 'self-peer', label: 'This device', addedAt: 't', self: true });
+    // Self is addressable (would show under listMembers) but never authorized.
+
+    const snap = await service.list();
+
+    const self = snap.members.find(m => m.peerId === 'self-peer');
+    expect(self).toBeDefined();
+    expect(self?.self).toBe(true);
+    expect(self?.label).toBe('This device');
+    // Not pruned as an orphan label despite being absent from the authorized set.
+    expect(store.getMember('self-peer')).toBeDefined();
+  });
 });
 
 describe('createTrustCircleHandlers', () => {

package/src/auth/index.ts

@@ -5,6 +5,8 @@
 export { TrustCircleService, createTrustCircleHandlers, DEFAULT_INVITE_TTL_MS } from './trust-circle.js';
 export type { TrustCircleServiceOptions, CadreNodeLike } from './trust-circle.js';
 export { TrustCircleStore } from './trust-circle-store.js';
+export { ensureSelfLabel, SELF_LABEL } from './self-label.js';
+export type { EnsureSelfLabelOptions } from './self-label.js';
 export { parseDuration } from './duration.js';
 export {
   TrustCircleError,

package/src/auth/self-label.ts

@@ -0,0 +1,74 @@
+/**
+ * Self-labelling for the trust-circle listing.
+ *
+ * `TrustCircleService.list()` shows the cadre's *authorized* membership, which
+ * deliberately excludes the node's own self-published row — a node's own
+ * address record isn't something an owner key vouched for. To keep the owner's
+ * own device visible in the listing, cadre-host records a local
+ * `self: true` label for it and `list()` splices that row back in.
+ *
+ * Writing that label is this module's job. Kept out of `bin/host.ts` so it is
+ * unit-testable without standing up the CLI.
+ */
+
+import debug from 'debug';
+
+import type { TrustCircleStore } from './trust-circle-store.js';
+
+const log = debug('cadre:host:trust-circle-self');
+
+/** Label written for the owner's own device when none exists yet. */
+export const SELF_LABEL = 'This device';
+
+export interface EnsureSelfLabelOptions {
+  /** Local labels store to write into. */
+  store: TrustCircleStore;
+  /** Resolves the owner node's peer ID; '' when the node isn't ready yet. */
+  getPeerId: () => Promise<string>;
+  /** Clock override for tests. */
+  now?: () => Date;
+}
+
+/**
+ * Record the owner node's own peer ID as a `self: true` local label.
+ *
+ * Idempotent: an existing row for that peer ID is left alone, so an admin's
+ * rename survives restarts. Stale `self` rows (a different peer ID — the node
+ * identity was replaced) are dropped, since `list()` splices every `self` row
+ * in unconditionally and would otherwise show a device that no longer exists.
+ *
+ * Returns the peer ID that is now labelled, or `undefined` when the node
+ * wasn't ready. Throws whatever `getPeerId` throws — callers treat a failure
+ * as best-effort (the next start heals it).
+ */
+export async function ensureSelfLabel(opts: EnsureSelfLabelOptions): Promise<string | undefined> {
+  const { store, getPeerId } = opts;
+  const now = opts.now ?? (() => new Date());
+
+  const peerId = await getPeerId();
+  if (!peerId) {
+    log('owner node not ready — no self label written');
+    return undefined;
+  }
+
+  for (const member of store.listMembers()) {
+    if (member.self && member.peerId !== peerId) {
+      log('dropping stale self label for %s (current identity is %s)', member.peerId, peerId);
+      store.removeMember(member.peerId);
+    }
+  }
+
+  const existing = store.getMember(peerId);
+  if (!existing) {
+    store.addMember({ peerId, label: SELF_LABEL, addedAt: now().toISOString(), self: true });
+    log('labelled own device %s as "%s"', peerId, SELF_LABEL);
+  } else if (!existing.self) {
+    // Row predates self-labelling (or was written by a redemption). Stamp the
+    // flag, keeping the label: without it `list()` prunes the row, since the
+    // authorized set never contains self.
+    store.addMember({ ...existing, self: true });
+    log('stamped existing label for own device %s as self', peerId);
+  }
+
+  return peerId;
+}

package/src/auth/trust-circle.ts

@@ -42,10 +42,22 @@ export interface CadreNodeLike {
   acceptPhone(options: { phonePeerId: string; token?: string }, issuedInvite?: CadreInvite): Promise<void>;
   removePeer(peerId: string): Promise<void>;
   encodeInvite(invite: CadreInvite): string;
-  /** Enumerate the cadre's `CadrePeer` membership (over the admin channel). */
+  /**
+   * Enumerate the cadre's *addressable* peers (over the admin channel) —
+   * anyone with an address record, including devices no owner vouched for.
+   * Used only for {@link removeMember}, where "the row exists" is the point.
+   */
   listMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>>;
-  /** Probe whether a peer is a `CadrePeer` member (over the admin channel). */
+  /** Probe whether a peer is *addressable* (over the admin channel). See {@link listMembers}. */
   isMember(peerId: string): Promise<boolean>;
+  /**
+   * Enumerate the cadre's *authorized* membership (over the admin channel) —
+   * devices an owner key vouched for. Excludes the node's own self-published
+   * row. This is the real membership test the trust-circle listing shows.
+   */
+  listAuthorizedMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>>;
+  /** Probe whether a peer is *authorized*. See {@link listAuthorizedMembers}. */
+  isAuthorizedMember(peerId: string): Promise<boolean>;
 }
 
 /**
@@ -212,6 +224,13 @@ export class TrustCircleService {
   /**
    * Remove an authorised member. Deletes the CadrePeer row and the local
    * label. Throws not_found when the peer is in neither place.
+   *
+   * NOTE: no special case for the host's own peer ID — the local UI hides the
+   * Remove button on the `self` row, but `DELETE /auth/members/<ownPeerId>`
+   * (or `cadre-host trust revoke <ownPeerId>`) will delete the node's own
+   * `CadrePeer` row. cadre-core re-registers self on node start, so a restart
+   * heals it. If that stops being true, or the removal path grows a
+   * non-loopback caller, guard `self` rows here.
    */
   async removeMember(peerId: string): Promise<void> {
     const inLocal = this.store.getMember(peerId);
@@ -240,10 +259,15 @@ export class TrustCircleService {
   }
 
   /**
-   * UI snapshot. Joins the canonical CadrePeer list (fetched over the admin
+   * UI snapshot. Joins the *authorized* membership (fetched over the admin
    * channel) with local labels; prunes any orphan labels (peer is no longer
-   * authorised). When the owner node is unreachable, degrades to the
-   * local labels file so listing keeps working while the node is down.
+   * authorised). Addressable-but-unauthorized peers — devices that merely
+   * published an address record without an owner voucher — are deliberately
+   * excluded; this is the listing an operator uses to decide who belongs.
+   * The node's own self-published row is spliced back in from the local
+   * label, since the authorized set excludes self by design. When the owner
+   * node is unreachable, degrades to the local labels file so listing keeps
+   * working while the node is down.
    */
   async list(): Promise<TrustCircleSnapshot> {
     const labels = new Map<string, Omit<TrustCircleMember, 'peerId'>>();
@@ -256,17 +280,17 @@ export class TrustCircleService {
     // Consult the control DB over the admin channel. A node-unavailable error
     // is non-fatal — fall back to the local labels rather than 503-ing a
     // read-only listing.
-    let controlMembers: Array<{ peerId: string }> | null;
+    let authorizedMembers: Array<{ peerId: string }> | null;
     try {
-      controlMembers = await this.cadreNode.listMembers();
+      authorizedMembers = await this.cadreNode.listAuthorizedMembers();
     } catch (err) {
       if (!(err instanceof OwnerNodeUnavailableError)) throw err;
-      controlMembers = null;
+      authorizedMembers = null;
     }
 
-    if (controlMembers) {
+    if (authorizedMembers) {
       const seenPeerIds = new Set<string>();
-      for (const { peerId } of controlMembers) {
+      for (const { peerId } of authorizedMembers) {
         seenPeerIds.add(peerId);
         const label = labels.get(peerId);
         members.push({
@@ -276,9 +300,17 @@ export class TrustCircleService {
           ...(label?.self ? { self: true } : {}),
         });
       }
-      // Prune labels for peers that no longer exist in CadrePeer. Only when we
-      // successfully consulted the node — otherwise a transient outage would
-      // wipe labels.
+      // The authorized set excludes the node's own self-published row —
+      // splice it back in from the local label rather than dropping it.
+      for (const [peerId, row] of labels) {
+        if (row.self && !seenPeerIds.has(peerId)) {
+          seenPeerIds.add(peerId);
+          members.push({ peerId, ...row });
+        }
+      }
+      // Prune labels for peers that are neither authorized nor self. Only
+      // when we successfully consulted the node — otherwise a transient
+      // outage would wipe labels.
       for (const peerId of labels.keys()) {
         if (!seenPeerIds.has(peerId)) {
           this.store.removeMember(peerId);