jschoubben
0 Followers · 0 Following
  • Joined on 2020-06-18
Repositories
4
 Projects Packages Public Activity Starred Repositories
jschoubben pushed to feat/the-agent-runs-as-its-own-account at novox/mesh-catalog 2026-10-08 19:56:42 +00:00
5718f8a75c Test that a sealed grant hides its words, not two letters
jschoubben pushed to feat/the-agent-account-is-declared at novox/mesh-catalog 2026-10-08 19:56:42 +00:00
4f4e1ec5b0 Refuse the agent-home gap reached through a module's own directory or a literal home
a17b86cf93 Refuse an archive or a file written into under the agent's home
7f14d96872 sudo: give every command run through sudo a terminal of its own
c595e19afb claude-code: declare the account agents run as and the command that starts it
5718f8a75c Test that a sealed grant hides its words, not two letters
Compare 5 commits »
9b00d2ddf7 Pin the node-engine at the head that refuses a placement at the machine's own
1d5a523a53 Keep places and accesses at the terminal, and refuse a line break in any setting
e003f0e37b Pin the node-engine at the head that judges an opened file's kind and links
87075fee68 Let the generic command verb only read, and keep keys and tokens at the terminal
8f76123cbe Pin the node-engine at the commit that refuses a system account as the agents'
0694f17934 Refuse a node's accounts through any verb, and a stale or service-account agent verdict
Compare 10 commits »
jschoubben pushed to feat/an-agent-account-never-becomes-root at novox/mesh-host 2026-10-08 19:53:18 +00:00
9a85dffc11 Search for setuid programs in the background, and judge each polkit rule alone
jschoubben pushed to replays/335-a-passed-gate-is-kept at novox/mesh-lab 2026-10-08 19:52:21 +00:00
06fa70d081 Register R335, so a passed gate failed by later reports fails before a core merge
5981f0ae85 Merge pull request 'Register R327: a verb that only reads opens no bus connection of its own (hq issue 327)' (#71) from fix/327-a-verb-reads-on-the-serving-connection into main
c9582ce041 Prove R327 against the merge of its fix
e99c2b22cb Prove R327 against the fix rebased on the dead-letter merge
617f95f2bf Prove R327 against the fix as reviewed
Compare 9 commits »
jschoubben pushed to feat/an-agent-account-never-becomes-root at novox/mesh-host 2026-10-08 19:50:25 +00:00
b1cb9542cc Refuse a placement at the machine's own directories, and use a found directory as found
bbbaf943e8 Issue 335: resolved by mesh-controller#165 (8170fc5) with replay R335
jschoubben pushed to replays/335-a-passed-gate-is-kept at novox/mesh-lab 2026-10-08 19:48:47 +00:00
4928774650 Point R335 at the merge of its fix, mesh-controller 8170fc5
jschoubben pushed to feat/the-agent-account-is-declared at novox/mesh-catalog 2026-10-08 19:46:20 +00:00
824ad11210 Refuse the agent-home gap reached through a module's own directory or a literal home
6c297214ad Issue 337: the store's reader could read the controller's signing key and every secret the store holds
fb07d552a0 Name the licences store's sealed tables as they are called, so a statement naming one is refused
4f44bf1eb5 Give the store's reader only the columns a module declares readable, never a secret, so a query cannot read the controller's signing key (hq issue 337)
jschoubben pushed to fix/shares-review-followups at novox/mesh-catalog 2026-10-08 19:39:39 +00:00
7996d75e57 Make nfs-server reconcile the kernel's exports with its file, so a failed reload or a withdrawn grant is not left exported while the module says it is healthy; warn on a stale or unknown backup list
c9582ce041 Prove R327 against the merge of its fix
e99c2b22cb Prove R327 against the fix rebased on the dead-letter merge
617f95f2bf Prove R327 against the fix as reviewed
06e86ccd05 Register R327: a verb that only reads opens no bus connection of its own (hq issue 327)
386e306642 Merge pull request 'Register R330: a message a consumer gave up on is kept (hq issue 330)' (#70) from fix/330-a-message-given-up-on-is-kept into main
Compare 7 commits »
cfa06b68bc ADR 0266: record the command allow list, the judge's final lists, and the store gap
10d8a9be9b Pin the node-engine at the head that judges an opened file's kind and links
jschoubben pushed to fix/shares-review-followups at novox/mesh-catalog 2026-10-08 19:23:24 +00:00
68b158d523 Let SIGTERM cancel a running pass and bound nfs-server's clean-up at 10 s, so a hanging command cannot keep the export file past the stop timeout