From 4e0dd1b0d34c37656b01a8746e53edd8cc6972ca Mon Sep 17 00:00:00 2001 From: mesh-tools Date: Sat, 17 Oct 2026 16:23:05 +0000 Subject: [PATCH] Say in design 29 how a folder a module owns treats files it did not write (issue 1024, ADR 0422) Design 29 is ADR 0422's home: it now says what `unknown` and `knows` mean on a directory under a home, that the found class no longer holds in ~/.ssh (ADR 0415, 0417), and lists ADR 0412, 0415, 0416, 0417 and 0422 among its decisions. --- .../29-a-node-has-operator-accounts.md | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md b/03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md index 698f41d1..10e233ab 100644 --- a/03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md +++ b/03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md @@ -5,7 +5,7 @@ code: - mesh-controller internal/inventory - mesh-controller internal/catalogue - mesh-controller cmd/mesh-controller -updated: 2026-10-16 +updated: 2026-10-17 decisions: - "ADR 0181" - "ADR 0182" @@ -16,6 +16,11 @@ decisions: - "ADR 0117" - "ADR 0399" - "ADR 0400" + - "ADR 0412" + - "ADR 0415" + - "ADR 0416" + - "ADR 0417" + - "ADR 0422" --- # 29 — A node has operator accounts, and the mesh owns what lives under a home @@ -58,6 +63,15 @@ These are a **family**, not one module: an `ssh-client` module, a shell module, module, each a *universal-tier* consumer of the account fact — assigned wherever a person logs in, which is every node, unlike the graphical stack that a capability gates. +**A folder a module owns says how it treats a file it did not write** (ADR 0416, ADR 0422). Declaring a +directory under a home owns it (ADR 0182 §1), and the owner alone writes there and reacts to every file +that enters it, never losing what the file held. The manifest says how, on the directory itself: +`unknown` is `move-out` (the node-engine moves every path the manifest does not declare and `knows` does +not name into `~/.local/state/mesh-moved//`, with a list), `module` (the module's own process +reacts, as ssh-client does in `~/.ssh`) or `program` (everything in it is the program's, as in a +service's data directory). `move-out` is only for a folder under a home, the home of the account the +assignment runs for (ADR 0412 §5). A folder many modules write in is not declared at all. + ## 3. The whole of `~/.ssh` is the mesh's — with one boundary drawn inside it The predecessor owned a single file (`~/.ssh/config`) and left the rest alone; it drifted, because @@ -84,6 +98,9 @@ ADR 0117 draws for the uplink and the sshd module draws for the firewall: **the mesh must never be able to arrange the one failure that severs its own way back in.** The carve-out is not a convenience; it is that rule, in `~/.ssh`. +Since ADR 0415 and ADR 0417 the found class no longer holds in `~/.ssh`: ssh-client moves out what it +does not know into a kept folder, and never moves a key or `authorized_keys`, which keeps this boundary. + ## 4. Keys are the mesh's to generate — through a CA, and existing keys are adopted, not replaced Key *generation* is the mesh's, not each node's improvising its own. The clean form is an **SSH