Issue 339: the gate reads a directory used as found as a wait for a person; the trust anchors are the terminal's

2026-10-09 00:55:54 +02:00
parent ab027691e1
commit 5fbd89c062
1 changed files with 27 additions and 7 deletions
@@ -119,20 +119,40 @@ Until the node-engine's follow-up (below) lands, the only trace is that one outc
    `encoding/pem` decodes (label CERTIFICATE, no headers) and `x509.ParseCertificate` parses.
  - Vertical tab, form feed, NEL and the Unicode line and paragraph separators are refused alongside line
    breaks, carriage returns and NUL.
-  - The spool, `/opt`, the container runtimes' data and any `.ssh` are added to the paths no placement or
-    access may name.
+  - The spool, `/opt`, the container runtimes' data (`/var/lib/docker`, `/var/lib/containers`,
+    `/var/lib/containerd`) and any `.ssh` are added to the paths no placement or access may name.
+  - **The mesh's trust anchors are the terminal's too**, refused through every verb route exactly as
+    `places` and `accesses` are:
+    - step-ca's `root`, `roots` and `path`: the root its consumers are handed, and where they fetch the roots
+      and the ACME directory;
+    - the identity provider's `issuer`: the issuer every OIDC consumer checks a login's token against.
+
+    Before this, any caller of the settings verb could replace the internal authority's trust anchor or the
+    issuer. The catalogue was read on 2026-10-09 for every served fact and every setting a file asks for, and
+    these are the ones a consumer trusts. They are named in the controller (`TerminalKeys`), because no manifest
+    field says "this is trusted" yet.
 - **`mesh-host`, a directory used as found is said:**
  - a WARNING line in every apply's log;
  - its module's resource of kind `directory`, stated unhealthy on every look, with its owner, its mode and
    what was declared. The controller raises that as the module's condition, naming the directory.
  - `mesh-host hand-over <dir>`, run by a person at the machine, hands it to the mesh. The next apply gives
-    it the declared owner and mode.
+    it the declared owner and mode. A hand-over names the resource it was for, so it lapses if another
+    declaration later points another resource at the same path.

-  An unhealthy resource holds a walk's gate for its module, so a delivery of a module with a directory
-  used as found waits until someone hands it over. That is intended: such a module may not be able to
-  write its data.
+  **The gate reads it as a wait for a person**, the way it reads a wait for a new login
+  ([ADR 0254](../../02-DECISIONS/0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md)).
+  - The node-engine keeps when it first found the directory (`found_at`) across applies.
+  - A directory found before the send being judged is no fault of that build. The module's gate passes, and
+    its verdict carries the wait: "uses … as found and waits for a person to hand it over". An urgent fix to
+    that module still reaches every machine.
+  - A directory found by that very send was brought by it, so the gate holds the module and, at its bound,
+    puts it back.
 - **`mesh-host`, the guard:** the same paths as the controller are added. The container runtime's data root
-  is read from its configuration. An account's `.ssh` is refused as an access or a mount, and as a
+  is read from its configuration: `data-root` in dockerd's `daemon.json`; `--data-root` (or the older `-g` and
+  `--graph`) on its unit's `ExecStart` and in the unit's drop-ins; and `graphroot` in podman's
+  `storage.conf`. `/var/lib/containerd` is refused as well. Two stores are not read. A containerd configured
+  elsewhere is not a runtime this mesh runs. Podman's rootless stores sit below each account's home, where
+  only that account's directories are placed anyway. An account's `.ssh` is refused as an access or a mount, and as a
  directory anywhere but below its own account's home.

 ### Step 3: what the live layers hold