From 37bc302d7d3a4f1ecc07ab640fbdbcf333d86a97 Mon Sep 17 00:00:00 2001 From: jochen Date: Fri, 9 Oct 2026 13:56:04 +0200 Subject: [PATCH] ADR 0272's note: what the login-session rule does not do, and the class=user record --- ...-terminal-only-where-no-agent-runs-as-its-operator.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/02-DECISIONS/0272-the-operator-reaches-the-controller-with-mesh-cli-on-every-node-and-a-node-is-the-terminal-only-where-no-agent-runs-as-its-operator.md b/02-DECISIONS/0272-the-operator-reaches-the-controller-with-mesh-cli-on-every-node-and-a-node-is-the-terminal-only-where-no-agent-runs-as-its-operator.md index 1ae3e71a..403b8084 100644 --- a/02-DECISIONS/0272-the-operator-reaches-the-controller-with-mesh-cli-on-every-node-and-a-node-is-the-terminal-only-where-no-agent-runs-as-its-operator.md +++ b/02-DECISIONS/0272-the-operator-reaches-the-controller-with-mesh-cli-on-every-node-and-a-node-is-the-terminal-only-where-no-agent-runs-as-its-operator.md @@ -200,8 +200,13 @@ fails if one changes alone: if the operator's account lost its passwordless `sud > 2. **Only a login session is the terminal.** §4 said the control-node's operator account; the tool runner and > the account's user units run as that account too, and are not a person at a terminal. The node-engine reads the > asking process's cgroup and sends its login session's scope (`session-.scope` under the account's own -> `user-.slice`), or nothing; the controller makes a line from no login session an ordinary call. Built in -> mesh-host and mesh-controller on 2026-10-09, each with a test that fails without it. +> `user-.slice`, which logind's own record must say is this account's, of class `user`), read the moment +> the connection is accepted, or nothing; the controller makes a line from no login session an ordinary call. +> Built in mesh-host and mesh-controller on 2026-10-09, each with a test that fails without it. **What it does +> not do:** a login session includes every process started in it, agents started from the operator's shell +> among them, and any process of the account can reach one (a `tmux` server, a line in `~/.zshrc`). So the rule +> keeps services from being the terminal, not processes of the same account; on the control-node the agents' +> boundary is ADR 0266's account of their own. > 3. **An ordinary line is reads and settings.** §4 is exact as it stands: an ordinary line is the generic verb's > reading forms, or a `settings` line composed as the settings verb composes it — nothing else runs.