ADR 0038 accepted; ADR 0039 (proposed) — the link is the security boundary

0038 accepted: no two modes. One behaviour, two sources of declaration.

0039 fills the gap 0038 named. Proposed rather than measured — it designs a
boundary that does not exist — but what it replaces IS measured, and that is the
argument.

Today adopt.sh asks the operator to paste in the postgres password and the
object store password, the same ones on every node, and they are not discarded
after adoption: wireguard and traefik open a pg connection on every reconcile.
So every node permanently holds a credential to the control plane's database,
and 00-as-is/06 records that nothing rotates it. Compromise of any node is
compromise of the mesh's store, with no way back.

Four properties make the link a boundary rather than a pipe: it is outbound and
node-initiated, so a node has no listening control surface — which the topology
already requires, since most nodes have no forwarded port. A node holds its own
identity and nothing else, so compromise of a node is compromise of that node.
Authority is mutual, because a host that applies whatever the link delivers must
know the mesh from something impersonating it. And what may be pushed is bounded
by FORM — declarations of known shape, never a command to run.

That last property is stated with its limit rather than oversold: it bounds
form, not impact. A compromised control plane can declare harmful state and the
host will apply it faithfully. What it buys is a describable blast radius.

Joining uses a one-time short-lived enrolment token, useless once used and
useless after a while, in place of hand-carried shared secrets.

Named rather than hidden: the first node's identity is self-issued and becomes
the root of trust, which is the one place 0038's "no special first node" does
not fully hold. Rotation becomes possible and is still not designed. And what
may expire is constrained by 0036 — an identity needing refresh would make a
laptop fail for being a laptop.

02-DECISIONS/0038-a-node-joins-by-linking-first.md

@@ -1,5 +1,5 @@
 ---
-status: proposed
+status: accepted
 date: 2026-08-25
 deciders: jochen
 reconstructed: false
@@ -89,8 +89,8 @@ makes it smaller.
 - **The rarely-run path is now the common one.** The first node exercises the same code every
   other node exercises constantly. That is the whole reason for choosing this over two modes.
 - **The link becomes the security boundary.** Everything a node applies arrives through it, so
-  what may be pushed, and how a joining node proves it is entitled to join, is now a question
-  worth its own record. **Not decided here, and it is a gap.**
+  what may be pushed, and how a joining node proves it is entitled to join, is its own
+  question — taken up by [ADR 0039](0039-the-link-is-the-security-boundary.md).
 - **The bundle must be able to raise the substrate alone.** Whether one host can bring up the
   four pinned services with no mesh present is Move 1 of the skeleton and remains unproven.
   This record depends on it and does not establish it.