Issue 339: an unmarked file counts as trusted, and the rollback hazard of the trusted field and its fix

2026-10-09 01:42:51 +02:00
parent 5d054b722d
commit 1d9d535912
1 changed files with 16 additions and 9 deletions
@@ -129,16 +129,23 @@ Until the node-engine's follow-up (below) lands, the only trace is that one outc
    The controller now derives the keys a verb may not change from the module's manifest (`TerminalKeys`):
    - `places` and `accesses`;
    - every key under the module's `serves`, and every setting a served value asks for (`${setting:…}`);
-    - every setting a file marked `trusted` asks for. `trusted` is a new manifest field on a file: true for a
-      file that root or a consumer trusts (a logind drop-in, an env file that says which uid a container runs
-      as, a script run as root), false otherwise. The controller takes it out before the declaration, because
-      the node-engine parses strictly.
+    - every setting a file asks for, **unless the file says `"trusted": false`**. An unmarked file counts as
+      trusted (fail closed, the fourth review): a file root or a consumer trusts — a logind drop-in, an env file
+      that says which uid a container runs as, a script run as root — must never be changed through a verb,
+      and saying nothing must not be the unsafe answer. `"trusted": false` is the opt-out, for a file nothing
+      but its own person reads. The controller takes the field out before the declaration.

-    `module check` names every file that asks for a setting without saying `trusted`, counts them in a line the
-    catalogue's merge check can keep, and refuses them from 2026-10-30. On 2026-10-09 that was 5 files in the
-    catalogue and 13 in the media catalogue. Their `trusted` is set in a catalogue change that can land only
-    once a controller that takes the field out of the declaration runs: an older one would pass it to the
-    node-engine, which refuses an unknown field.
+    `module check` lists and counts the unmarked files, so an author can opt out a harmless one. It never
+    refuses them, because counting them as trusted is already the safe reading; the refusal date the third
+    review's fix had is gone. On 2026-10-09 the catalogue had 9 unmarked files and the media catalogue 13.
+    Two are opted out in a catalogue change: the notifier's look and a person's folder names. The other 20
+    stay trusted.
+
+    **A rollback hazard, and its fix.** The node-engine parses a declaration strictly, so a `trusted` it did not
+    know would cost a node its whole declaration. The controller takes it out, but an older controller, or
+    one rolled back to, would pass it on. So the node-engine now accepts `trusted` on a file and does nothing
+    with it (in `mesh-host` #65), and the catalogue change that sets it waits until the controller with this
+    fix is live.
 - **`mesh-host`, a directory used as found is said:**
  - a WARNING line in every apply's log;
  - its module's resource of kind `directory`, stated unhealthy on every look, with its owner, its mode and