Say how a module of its own account is served, and how the root probe is checked

2026-10-09 15:36:36 +02:00
parent 7dd83d4435
commit 7e158c739e
2 changed files with 10 additions and 8 deletions
@@ -286,8 +286,9 @@ The revision rests on three rules.

 - The **router** (`operator-channel`'s holder) and **every channel that declares `verified-sender`** run as
  their own process, as their own service account (`messenger`, `telegram`), with a bus account of their
-  own: an own secret `broker`, owned by that account, mode 0600. They are not carried by the tool runner.
-  Their tools are served by their own process on their own tool subjects.
+  own: an own secret `broker`, owned by that account, mode 0600. The manifest says so with `runs-as`; the
+  controller composes for such a module a runtime of its own — the machine's runtime program, run as that
+  account, serving that module alone on that credential — and the machine's runtime never carries it.
 - **The controller refuses to compose** into any runner's user, or into any principal whose process runs as
  the node's operator account:
  - publishing on a by-caller event of `operator-channel` (a warrant);
@@ -345,7 +346,7 @@ router issues no approve warrant, and the condition says what to change.
   caller-named and per-kind grants; `proof` subjects; the asker's read of its own prefix.
 2. **The tool runner (mesh-tools)** carries a bundle's seat traffic: publishing an accept or an event
   with its own name or kind, taking a held seat's work, asking and answering a proof, a compare-and-set
-   on its state, and starting a bundle as its own account.
+   on its state, and serving one module alone when it runs on that module's own account.
 3. **The shared library (mesh-sdk):** an asker's client (ask, cancel, read its state, take its warrants)
   and a channel's (take show, edit and send for a kind; publish a choice or a link; send a proof).
 4. **The messenger** becomes the router of this record: asks, tokens, identities, judging, warrants,
@@ -397,7 +398,8 @@ Telegram, or from the mesh MCP server." The asker's words never name a channel.
 | `verified-sender` reaches the router only from a holder with its own account on a machine no agent can become root on | controller test stripping the capability; self-check probe raising the condition |
 | Unlinking and a relink within a day are approve asks answered on the linked account; the notice reaches it first | router tests, with a fake channel that honours the addressee |
 | No bus variable reaches a bundle | tool runner test over a bundle's environment |
-| The `telegram` bundle runs as its own account, never root or the operator's | tool runner tests: a bundle naming `MESH_RUN_AS` is started as that account; root and the operator's account refused; the manifest's owners checked by the catalogue's manifest test |
+| A module of its own account is served by a runtime of its own, as that account, on its own bus credential, and never by the machine's | controller composition test (`runs-as`); registration refuses root, an account the module does not make, secrets it does not own, no broker; the tool runner test that such a runtime serves that module alone |
+| While an agent can become root without a person where the router or a verified channel runs, it is said and nothing proven there approves | controller probe test (fails with agents as the operator's account, and with the login shell running as an account with passwordless sudo; passes once neither holds); the sudo module's `sudo_escalation` test; router test refusing approval |
 | A tool call never publishes an intake event or a proof | tool runner test: only a bundle's own channel reaches the seat publish, for its own kind |
 | The asker acts once per warrant and records the warrant | shared library test; controller test reading the hand-act after a warrant |
 | The controller holds no channel code | review; the controller's module imports no channel package |