novox/hq
13
0
Fork 0
Code Issues Pull Requests 1 Releases Wiki Activity

Say in design 29 how a folder a module owns treats files it did not write (issue 1024, ADR 0422)
mesh/merge-gate out of date: judged against trunk 7a1d3d89f0b9, the trunk is now c87ab9af0f9a; judged again on a recheck or when it is merged
Details
mesh/repo-check out of date: judged against trunk 7a1d3d89f0b9, the trunk is now c87ab9af0f9a; judged again on a recheck or when it is merged
Details
mesh/delivery-group group feat/owned-paths checking: 0 of 2 member(s) ready
Details
mesh/delivery superseded: a newer head of the same pull request
Details

Browse Source 
Design 29 is ADR 0422's home: it now says what `unknown` and `knows` mean on a directory under a home, that the found class no longer holds in ~/.ssh (ADR 0415, 0417), and lists ADR 0412, 0415, 0416, 0417 and 0422 among its decisions.
This commit is contained in:
mesh-tools
2026-10-17 16:23:05 +00:00
parent 7a1d3d89f0
commit 4e0dd1b0d3
1 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md
+18 -1
View File
@@ -5,7 +5,7 @@ code:
- mesh-controller internal/inventory - mesh-controller internal/inventory
- mesh-controller internal/catalogue - mesh-controller internal/catalogue
- mesh-controller cmd/mesh-controller - mesh-controller cmd/mesh-controller
updated: 2026-10-16 updated: 2026-10-17
decisions: decisions:
- "ADR 0181" - "ADR 0181"
- "ADR 0182" - "ADR 0182"
@@ -16,6 +16,11 @@ decisions:
- "ADR 0117" - "ADR 0117"
- "ADR 0399" - "ADR 0399"
- "ADR 0400" - "ADR 0400"
- "ADR 0412"
- "ADR 0415"
- "ADR 0416"
- "ADR 0417"
- "ADR 0422"
--- ---
# 29 — A node has operator accounts, and the mesh owns what lives under a home # 29 — A node has operator accounts, and the mesh owns what lives under a home
@@ -58,6 +63,15 @@ These are a **family**, not one module: an `ssh-client` module, a shell module,
module, each a *universal-tier* consumer of the account fact — assigned wherever a person logs in, module, each a *universal-tier* consumer of the account fact — assigned wherever a person logs in,
which is every node, unlike the graphical stack that a capability gates. which is every node, unlike the graphical stack that a capability gates.
**A folder a module owns says how it treats a file it did not write** (ADR 0416, ADR 0422). Declaring a
directory under a home owns it (ADR 0182 §1), and the owner alone writes there and reacts to every file
that enters it, never losing what the file held. The manifest says how, on the directory itself:
`unknown` is `move-out` (the node-engine moves every path the manifest does not declare and `knows` does
not name into `~/.local/state/mesh-moved/<module>/`, with a list), `module` (the module's own process
reacts, as ssh-client does in `~/.ssh`) or `program` (everything in it is the program's, as in a
service's data directory). `move-out` is only for a folder under a home, the home of the account the
assignment runs for (ADR 0412 §5). A folder many modules write in is not declared at all.
## 3. The whole of `~/.ssh` is the mesh's — with one boundary drawn inside it ## 3. The whole of `~/.ssh` is the mesh's — with one boundary drawn inside it
The predecessor owned a single file (`~/.ssh/config`) and left the rest alone; it drifted, because The predecessor owned a single file (`~/.ssh/config`) and left the rest alone; it drifted, because
@@ -84,6 +98,9 @@ ADR 0117 draws for the uplink and the sshd
module draws for the firewall: **the mesh must never be able to arrange the one failure that severs module draws for the firewall: **the mesh must never be able to arrange the one failure that severs
its own way back in.** The carve-out is not a convenience; it is that rule, in `~/.ssh`. its own way back in.** The carve-out is not a convenience; it is that rule, in `~/.ssh`.
Since ADR 0415 and ADR 0417 the found class no longer holds in `~/.ssh`: ssh-client moves out what it
does not know into a kept folder, and never moves a key or `authorized_keys`, which keeps this boundary.
## 4. Keys are the mesh's to generate — through a CA, and existing keys are adopted, not replaced ## 4. Keys are the mesh's to generate — through a CA, and existing keys are adopted, not replaced
Key *generation* is the mesh's, not each node's improvising its own. The clean form is an **SSH Key *generation* is the mesh's, not each node's improvising its own. The clean form is an **SSH