We appear to be affected by the "cluster bridging" issue.  I know nothing about the implementation details or capabilities of lashup, so this is rife with assumptions - apologies in advance.

A group cleanup mechanism sounds important/required, yes.  But isn't unintended bridging fundamentally caused by the absence of a group communication authentication mechanism, whereby received communications can be authenticated as originating from a current member of the cluster?

Seems like encryption or signing of group communications with a cluster-scoped secret would eliminate the possibility of unintended bridging.  Does this capability already exist?  Would this approach make sense?

cbuben You are right. The current implementation implicitly relies on reachability to establish a group membership and there is no notion of explicit group membership which leads to "cluster bridging" (I liked this name) issue. Authentication would be one way of solving it. Another way would be a notion of cluster identity which is known to each member of the group.

I vote cluster identity, as a minimum. We already have a cluster cryptographic ID - we could continue to utilize this.

Cluster authentication would be ideal, maybe as a second part of this request.