Being an MCP client was enough to join a provider's overlay, so a single
admission anywhere reached every provider that opened one. Attachment now
requires both that the role speaks as a client and that the provider
lists it in mcp.allowed_consumers.
consumer.kind accepts a list so one overlay can carry both its
service-flag consumers and its MCP clients, which is what the vector
store needs.
n8n (192.168.106.16/28) and svc-runner (192.168.106.0/28) sat inside mailu's 192.168.106.0/24, so co-deploying either with mailu aborted with "Pool overlaps with other one on this address space". Reassign both to free /24s (218, 219). The overlap test read meta/server.yml, which has no networks key, so it passed vacuously; point it at meta/networks.yml so it actually gates duplicate/overlapping subnets.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
evangelostsak
kevinveenbirkenbach
