diff --git a/03-DESIGN/01-to-be/41-the-shell-and-the-accounts-environment.md b/03-DESIGN/01-to-be/41-the-shell-and-the-accounts-environment.md index aa92b0b8..5a2556ad 100644 --- a/03-DESIGN/01-to-be/41-the-shell-and-the-accounts-environment.md +++ b/03-DESIGN/01-to-be/41-the-shell-and-the-accounts-environment.md @@ -344,7 +344,8 @@ out, the control-node's value is set to `withhold` and zsh is pushed to it. Then *`mesh-sdk`, `mesh-catalog`, `mesh-controller`. ADR 0310, extending ADR 0268; tracked by issue 418.* **Replaced by WP9.** ADR 0394 supersedes ADR 0310: `node-files` takes over every read below, with the same -bounds, content rule and refusal of secret places, and `node-reads` is removed in the delivery that brings it. +bounds, content rule and refusal of secret places; once `node-files` is held on every node, the next delivery +removes `node-reads` and `mesh-reads`. ADR 0268 §5 has narrow read tools take the common reads over from `execute`, so that an approval is asked for an act and not for a read, and ADR 0286 §44 sets the approval mark on `execute` only once those reads have a tool on @@ -393,8 +394,9 @@ project folders, downloads, logs, scratch. restorable for 7 days, and is emptied after. - **A path a module owns is refused**, naming the module and its tool, unless the call says `override` with a reason; an override is recorded and said to the operator. -- **It replaces `node-reads`.** Its reads keep WP8's bounds, content rule and kernel reads; `node-reads` and - `mesh-reads` are removed in the delivery that brings it. +- **It replaces `node-reads`.** Its reads keep WP8's bounds, content rule and kernel reads. Every node is + assigned `mesh-reads`, so `node-reads` and `mesh-reads` are removed by the next delivery, once `mesh-files` + holds `node-files` on every node. - **No Approve is asked**; every act is recorded with its caller. Read and search never return the content of a known credential file or a secret place (the mesh never prints a token); copying or moving one is allowed.