From 00c436dd1580a25b21306820b208d52e1ddf94cb Mon Sep 17 00:00:00 2001 From: jochen Date: Thu, 12 Nov 2026 09:36:39 +0100 Subject: [PATCH] Design 39 bus-and-switch: C2, the manager replaces a key pair it cannot read Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ --- 03-DESIGN/01-to-be/39-milestones/bus-and-switch.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md b/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md index 5b5f6ab6..f5423e43 100644 --- a/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md +++ b/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md @@ -541,3 +541,8 @@ written; they are cited as "design 39 bus-and-switch B*n*". the service part (the carry-over at start, the usage timer, the switch rule, the conditions) and serves the tools part beside it, so every kept entry, log and secret of §1 to §20 is issued to its own account, never to the tool runner's. The tools act only through the running service: no tool keeps a second copy of what the service does (P1, P7). +- **C2** (review of C1: the key-pair file the manager wrote in its state directory under the tool runner's account, + which the node-engine does not hand to the new owner): when the manager cannot read the key pair it finds, it makes a + new one in its place and says so in its journal; every use passes the public key per ask, so nothing depends on the + old pair (P3, P7). The node-engine handing a program-written directory's contents to a new owner (every module that + moves to `runs-as`) is noted on its issue, not built here.