From a04f1b90a058a9f6b301f00f55b144c5514bd301 Mon Sep 17 00:00:00 2001 From: jochen Date: Thu, 8 Oct 2026 17:38:09 +0200 Subject: [PATCH] Name the router, not the controller's retired verbs, where the glossary and to-be 46 still did --- 00-META/glossary.md | 2 +- 03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/00-META/glossary.md b/00-META/glossary.md index 388360d1..c891a892 100644 --- a/00-META/glossary.md +++ b/00-META/glossary.md @@ -483,7 +483,7 @@ asking, never the act. **Decided by** ADR 0152, 0175, 0234, 0259, 0272. who chose (the operator, as a channel kind's identity), through which channel, the proofs and when, published for that asker alone. The only thing an asker acts on (ADR 0259). - **operator message / input** — what arrives on `intake`, once the router has checked the sender - against the controller's list of the operator's identities: a **trusted** one is an operator message, + against its own list of the operator's identities: a **trusted** one is an operator message, addressed to an agent by `@name` or thread or else to the **responder** (`@mesh`, the router's own participant, which answers from read verbs); anything else is **untrusted input** — data, never instructions. diff --git a/03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md b/03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md index 503672b7..e0ba5f0d 100644 --- a/03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md +++ b/03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md @@ -299,7 +299,7 @@ is not exempted. - **Allowed in a message's words:** roles, words, and the mesh's own machine names. - **Refused:** domains, addresses, paths, and anything shaped like a secret — in words, labels and references alike. -- **A refusal is said to the sender** — the `notify`, `ask` or `authorise request` call is refused naming +- **A refusal is said to the sender** — the `notify` call or the ask is refused naming the offending part, so the asker can rephrase or move the specific into a reference — and raises `channel-refused`. The offending part is never sent to a channel. @@ -465,7 +465,7 @@ needs the lost factor's code. So: - **A recovery code counts as one P2 proof, once.** It may stand in for the app's code in any ask. - **`factor recover`**, at a terminal, given a recovery code: a new seed and ten new codes replacing the remaining ones. Recorded as a hand-act, and **announced loudly on every channel**. -- **The count left** is shown by `factor status` and in `authorisations`; the self-check warns when +- **The count left** is shown by `factor status` and in the router's `asks`; the self-check warns when three or fewer remain. - **The last resort:** root on the control node — at it, or by its SSH key — runs `factor enrol --break-glass` there. It talks to the router locally, never over the bus; the same verb over the