Design 38 WP4: what the review of mesh-catalog #239 found — the credential goes, iptables is declared, escalation is an unchecked machine fact

2026-10-03 13:00:35 +02:00
parent 89a202f12e
commit 55443b67e6
1 changed files with 7 additions and 1 deletions
@@ -201,7 +201,13 @@ broker per node. Two things the package did not say, settled in the module: the
 run through `sudo` without a prompt where the runtime is not root, since the operator's account may
 escalate as the operator would; and a bundle has no environment of its own, so the tool reads the
 filter from the path the manifest's `filtering` names rather than from a variable the container used
-to carry.
+to carry, a test holding the two together. Three things a review of the change found: the module's
 own bus credential and state directory went with the container, since nothing reads them once the
 runtime speaks with the node's (the shell module of WP5 declares neither); the `iptables` package the
 image used to carry is now declared on the host; and that the operator's account may escalate without
 a prompt is a fact about the machine the mesh neither declares nor checks — true on all four today,
 and when it is not, the tool names it by how it failed, which is the only check there is until a
 record says where the fact belongs.
 ## WP5 — The shell, on a server first