novox/hq
6
0
Fork 0
Code Issues Pull Requests 5 Releases Wiki Activity

Record the operator's choice for the control node, and the second way an agent reaches root there

Browse Source
This commit is contained in:
jochen
2026-10-09 15:36:36 +02:00
committed by jschoubben
parent a04f1b90a0
commit 7dd83d4435
1 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
02-DECISIONS/0259-an-ask-is-a-message-on-the-bus-any-channel-answers-it-and-the-asker-acts-on-a-warrant.md
+12 -5
View File
@@ -273,7 +273,7 @@ met, and when. It carries no secret.
### 8. Who may say what on the bus: the trusted parties' own accounts
*Revised after the security review of 2026-10-08, and not yet accepted by the operator.* The first version of
*Revised after the security review of 2026-10-08; the revision accepted by the operator the same day.* The first version of
this section rested on the tool runner running as root with a credential only root reads. **On the control
node it runs as the operator's account, its bus credential belongs to that account, and that account may
become root without a password.** Every agent runs as that account. So an agent there could read the runner's
@@ -312,10 +312,17 @@ router issues no approve warrant, and the condition says what to change.
**3. What remains, said plainly.**
- **Root on the router's or the channel's machine defeats all of this.** The self-check raises an urgent
condition while an agent's account can become root there without a person; on the control node today it
can (the operator's account has passwordless sudo, measured on 2026-10-08). The operator chooses one of:
a password for sudo on that machine; agents there under an account of their own without sudo; or the
router and the channels placed on a machine where neither holds.
condition while an agent can become root there without a person; on the control node today it can (the
operator's account has passwordless sudo, measured on 2026-10-08). **The operator chose, on 2026-10-08,
that agents on the control node run under an account of their own without sudo.**
- **An agent reaches root through the mesh's own tools too.** Any machine's tool runner may call any tool
on any machine, and the login shell seat's `execute` runs a command as the account the runner runs as —
on the control node, the operator's account, with passwordless sudo, which the mesh's acting tools rely
on (measured on 2026-10-08). So an agent on any machine can run a root command on the control node
without touching its own account. The self-check therefore counts both ways in: an account an agent
runs as that can become root without a person, **and** a tool an agent may call that runs a command
given to it as an account that can. It fails until both are closed; the second is decided separately
(the login shell's reach, and what an agent's calls are granted).
- **The controller holds the whole JetStream API** today. Narrowing it to the streams and buckets it owns is
planned work of its own; until then the controller is trusted with every record.
- **On the X11 desk an agent can read a code as it is shown or typed** (ADR 0234's accepted risk). The hour