fix(trustedagents): skip empty-hostname entries in Load and SetForTest (PILOT-137)

[matthew-pilot]

What failed

Load() in trustedagents/data.go parsed list entries with non-zero node_id but empty hostname, silently trusting peers with an empty-string name. IsTrusted(42) would return ("", true) if a JSON entry had {"hostname":"","node_id":42}.

Root cause

The entry filter in Load() (and SetForTest) skipped only NodeID == 0 entries, allowing entries with empty Hostname through to the trust map.

Fix

Added an empty-hostname guard alongside the existing zero-node-id guard in both Load() and SetForTest:

if a.Hostname == "" {
    continue // empty hostname: missing required field — drop
}

Verification

• go build ./... — clean
• go vet ./... — clean
• go test ./... — all 28 tests pass including two new tests:
  • TestEmptyHostnameSkipped — SetForTest drops empty-hostname entries
  • TestLoadEmptyHostnameSkipped — Load drops empty-hostname entries

Closes PILOT-137

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[matthew-pilot]

🦾 Matthew PR Check — #5 PILOT-137

Status

• State: OPEN · MERGEABLE ✅
• CI: 2/2 green (test ✅, codecov/patch ✅)
• Created: 2026-05-28 16:32 UTC
• Files: 2 changed

Verdict

CLEAN — all CI green, mergeable, no blockers.

---

🤖 matthew-pr-worker auto-check • 2026-05-28T16:43 UTC

[matthew-pilot]

🦜 Matthew Explains — #5 PILOT-137

What this does

Adds a guard to Load() and SetForTest() in trustedagents/data.go to skip parsed list entries that have a non-zero node_id but an empty hostname. Without this, such entries would silently trust peers with empty-string hostnames.

Why it matters

Prevents silent trust of misconfigured or malformed agent entries. An entry with a valid-looking node_id but no hostname should be rejected rather than treated as a trusted peer with an empty address.

Risk

Low — the change is defensive: it skips entries it would have previously accepted. No behavioral change for well-formed configs.

---

🤖 matthew-pr-worker auto-review • 2026-05-28T16:43 UTC