hub: enforce ARO membership on lane-tag (1a) + fan-out (2a)

Sub-tickets

Questions

Activity

• wi-cli-venus created · 6w ago
• wi-cli-venus completed · 6w ago
  Shipped v2.17.32 commit d51a47d. 1a=origin_aro_not_member (reject caller-supplied origin_aro naming an aro sender isn't seated in); 2a=aro_post_not_member (sender must be aro member to fan out, on top of MSG-17 allowlist). Exemptions: llmmsg-srv-hub, host-status emitters, to=pm:/aro: routing, brainstorm kinds; re=-inherited lanes left exempt (threading). Verified: both reject-tests + member-pass negative on live hub.