Issue 344: record the known gaps in the agent's boundary, accepted for now by the operator

2026-10-09 12:03:36 +02:00
parent d81ae38970
commit 7d4678c5fb
1 changed files with 73 additions and 0 deletions
@@ -0,0 +1,73 @@
+---
+status: open
+opened: 2026-10-09
+located-in: []
+fixed-by:
+amended-design:
+---
+
+# 344. Known gaps in the agent's boundary, accepted for now
+
+## Symptom
+
+Three reviews on 2026-10-09 checked whether an agent can become root or approve in the operator's name. They
+covered ADR 0266 (agents on the control-node run under an account of their own), the root routes found beside it,
+and ADR 0259 (the operator's answers on any channel). Most findings are being fixed in the pull requests those
+records name. The gaps below are **not** being fixed now.
+
+The operator decided on 2026-10-09: *"that's not too big of an issue, i kind of trust you to not do weird stuff all
+of a sudden. We can improve security later on, you should note down the known gaps though."* This issue is that
+note. Each gap says what is open, why it matters, and what would close it.
+
+## The gaps
+
+1. **On every machine but the control-node, agents run as the operator, with passwordless sudo.** ADR 0266 gives
+   agents an account of their own on the control-node only. On the laptop, the workstation and the home server, an
+   agent session holds everything the operator's account holds, root included.
+   *Closes with:* a follow-up decision that extends ADR 0266 to every node where agents run.
+
+2. **Tools that run a caller's command as the operator remain on those machines.** These are the login shell's
+   `execute` (withheld on the control-node by [ADR 0268](../../02-DECISIONS/0268-the-login-shells-execute-is-withheld-on-the-control-node-until-a-call-to-it-needs-a-persons-approval.md)),
+   the launcher's `run` and the terminal emulator's `open`. Through any of them, an agent reaches root on that
+   machine.
+   *Closes with:* `execute: withhold` mesh-wide once the operator's command exists (issue 343), and the
+   approval mark of [research 039](../../01-RESEARCH/039-a-tool-that-needs-a-persons-approval/00-overview.md)
+   for the other two.
+
+3. **The operator's chat client runs on a machine where agents run as the operator.** An agent there can focus the
+   desktop client and tap Approve. Telegram then authenticates the tap as the operator, and the router issues a
+   genuine warrant. The client's data directory was also found readable by every account (directories 755, files
+   644), so another account could copy the logged-in session.
+   *Closes with:* gap 1 on that machine; no agent access to the operator's display; the client's data kept 0700.
+
+4. **One X display gives its clients no isolation.** Any program with access to the operator's display can read
+   other windows and send them input.
+   *Closes with:* agents' accounts get no access to the operator's display (no X authority cookie).
+
+5. **The acts a warrant authorises can still be called directly, as verbs.** Release, stop, a plan's go and stop, a
+   service restart and silencing a condition all remain open to any agent through a tool runner. So "the mesh does
+   this only on approval" does not hold yet.
+   *Closes with:* the approval mark of research 039, which withholds those verbs from agents.
+
+6. **The tool runner on the control-node runs as the operator** and can read the forge administrator's password
+   file. A future tool that reads a path the caller chooses could leak it.
+   *Closes with:* the tool runner under an account of its own; secrets read only by the module that owns them.
+
+7. **The forge's tools still use a site administrator's token.** The tools' own guards refuse admin and
+   protection-weakening calls. The account itself could do more, because the forge puts protection edits under the
+   repository scope.
+   *Closes with:* a non-administrator forge account for the tools, with write access through a team.
+
+8. **The controller's credential can rewrite the router's record** (identities, asks, the hour after a link). The
+   router itself enforces the hour, but its record is only as safe as the controller.
+   *Closes with:* the router's state in a bucket only the router may write.
+
+9. **The root search's two bounds disagree.** The node-engine's search for programs that run as root stops itself
+   after two minutes, while the record allows it fifteen. On a large disk the verdict stays "not judged".
+   *Closes with:* one bound, settled in the node-engine with ADR 0266.
+
+## Why it is an issue
+
+Each gap is a known way around a rule the mesh states. A gap that is written down can be weighed and closed. A
+gap that is forgotten turns into a belief that the rule holds. This issue stays open until every gap above is
+closed or decided against in writing.