From 7ac5194bcbdc06c66c956b6d069afd7eee592ab8 Mon Sep 17 00:00:00 2001 From: jochen Date: Fri, 16 Oct 2026 11:06:32 +0200 Subject: [PATCH] Design 41 WP9: mesh-files runs as the operator account with sudo where needed, and replaces node-reads (ADR 0394) --- .../41-the-shell-and-the-accounts-environment.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/03-DESIGN/01-to-be/41-the-shell-and-the-accounts-environment.md b/03-DESIGN/01-to-be/41-the-shell-and-the-accounts-environment.md index 9681c8a6..4c542a86 100644 --- a/03-DESIGN/01-to-be/41-the-shell-and-the-accounts-environment.md +++ b/03-DESIGN/01-to-be/41-the-shell-and-the-accounts-environment.md @@ -382,19 +382,22 @@ project folders, downloads, logs, scratch. stat, read, search, write, copy, move, delete, make a folder, change mode, change owner, and the trash's list and restore. Each says what it replaces (ADR 0245): `ls`, `stat`, `cat`, `grep`, `cp`, `mv`, `rm`, `mkdir`, `chmod`, `chown`, and `ssh cp` for a copy between nodes. -- **It may touch every file.** It runs with full rights and keeps each file's owner and modes as well as it - can: a copy or a move keeps them, a new file takes its folder's owner. Which files to touch is the caller's - responsibility; this first version judges no permission. +- **It may touch every file.** It declares no account of its own: the tool runner starts it as the node's + operator account, which has sudo without a password, and it uses `sudo -n` only where that account's own rights + do not reach. It keeps each file's owner and modes as well as it can: a copy or a move keeps them, a new file + takes its folder's owner. Which files to touch is the caller's responsibility; it judges no permission. - **Nothing is lost at once.** A file deleted or overwritten goes to the node's trash with who asked and why, is restorable for 7 days, and is emptied after. - **A path a module owns is refused**, naming the module and its tool, unless the call says `override` with a reason; an override is recorded and said to the operator. +- **It replaces `node-reads`.** Its reads keep WP8's bounds, content rule and kernel reads; `node-reads` and + `mesh-reads` are removed in the delivery that brings it. - **No Approve is asked**; every act is recorded with its caller. Read and search never return the content of a known credential file or a secret place (the mesh never prints a token); copying or moving one is allowed. **Proof.** The module's tests: each verb against a temporary tree keeps owner and modes, a new file takes its folder's owner, a delete is restorable from the trash and gone after 7 days, an owned path is refused and an -override recorded, a credential file's content is never returned. Live: the operator's `~/.claude` on shanks is listed, and a file copied from one node to another +override recorded, a credential file's content is never returned. Live: the operator's `~/.claude` on a workstation is listed, a file in `/etc` is read through sudo, and a file copied from one node to another arrives with its owner and modes.