novox/hq
7
0
Fork 0
Code Issues Pull Requests 3 Releases Wiki Activity

ADR 0259: the drill as the live acceptance, another account's answer told to the operator, an ask's message never folded
mesh/merge-gate pass: the change touches no module of the mesh's graph
Details
mesh/repo-check pass: its merge-check.sh passed
Details
mesh/delivery superseded: a newer head of the same pull request
Details

Browse Source
This commit is contained in:
jschoubben
2026-10-09 11:08:52 +02:00
parent 812a011bfa
commit 02ec566623
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
02-DECISIONS/0259-an-ask-is-a-message-on-the-bus-any-channel-answers-it-and-the-asker-acts-on-a-warrant.md
+6 -1
View File
@@ -252,6 +252,9 @@ met, and when. It carries no secret.
### 7. Who the operator is on a channel: linking
- **An answer from an account that is not the operator's** is refused, and the operator is told on the linked
account which account tried (by name and number); the other account is told nothing (added on 2026-10-09:
a question forwarded, or a phone in other hands, is something the operator must hear of).
- **The router's list is the only list.** It is changed only by linking and unlinking, never by a setting.
- **Linking:** the operator sends the bot `/start`. The channel publishes `link.<kind>` with the sender
and the name the service shows. The router shows a six-digit code on the desk, with that name, valid
@@ -430,7 +433,9 @@ Telegram, or from the mesh MCP server." The asker's words never name a channel.
| The self-check counts the login shell only where `execute` is served, and what it cannot measure fails | controller probe tests (`TestTheLoginShellCountsOnlyWhereExecuteIsServed`, the unmeasured case) |
| The whole flow, before anyone uses it | the lab's proof `asks` (mesh-lab): a real bus with the controller's composed grants, the router and the Telegram channel in runtimes of their own accounts, a fake Telegram API — approve acted once, decline, expiry, a replayed tap, a tap from another account, a forged warrant, an ask under another name, an ask from a module that may not ask |
| The controller holds no channel code | review; the controller's module imports no channel package |
| End to end | live drill after rollout (mesh-lab `asks/live-acceptance.md`): a harmless ask approved on the phone, acted once; the hand-act reads "the operator, as telegram identity …", via telegram, user id verified |
| End to end | live acceptance after rollout (mesh-lab `asks/live-acceptance.sh`): the controller's `drill`, started at its terminal alone, approved on the phone, acted on once and performing nothing; the hand-act reads `warrant drill drill=approve`, by "the operator, as telegram identity …", via "telegram (telegram), user id verified", proofs P1 |
| An answer from another account is refused and the operator is told which account tried | router test (`TestEveryAnswerThatIsNotTheOperatorsIsRefusedAndSaid`); the lab's proof |
| A message carrying an ask's answers is never folded into a digest | router test (`TestAnAsksMessageWithOneAnswerIsNotFoldedIntoADigest`); the lab's proof, where it was found |
## References