ADR 0259: bind a warrant to the exact ask and act, count the login shell where execute is served (ADR 0268), fail closed where root is not measured, and keep what is trusted out of settings (issue 342)

2026-10-09 15:36:36 +02:00
parent 7e158c739e
commit ba49876e48
1 changed files with 29 additions and 2 deletions
@@ -237,6 +237,13 @@ met, and when. It carries no secret.

 - **The asker acts once per ask id**, keeping that in its own record, and only on a warrant from its own
  `decided` subject.
+- **A warrant authorises one act, as the person was shown it** (added on 2026-10-09, before the code was
+  merged). Every option above `acknowledge` carries the digest of exactly what the asker performs when it is
+  chosen — the verb, the machine and every argument (`binds`); an ask without it is refused at the router.
+  The router puts the digest of the ask as it took it in the warrant. The asker acts only when that digest
+  is the one of the ask it keeps, and only when the act it is about to perform is the one the option bound:
+  an ask published again under the same id, or a record of the act changed after the ask, is refused and
+  nothing is done.
 - **Its record of the act names the warrant**: a hand-act's `by`, `via`, `ask` and `proofs` (ADR 0234 §8),
  a delivery's transition, a silence's why. The hand-act log counts it as a person's decision, not a repair.
 - **The controller only asks and acts.** For a condition that needs the operator it asks with the
@@ -324,6 +331,17 @@ router issues no approve warrant, and the condition says what to change.
  runs as that can become root without a person, **and** a tool an agent may call that runs a command
  given to it as an account that can. It fails until both are closed; the second is decided separately
  (the login shell's reach, and what an agent's calls are granted).
+- **Since 2026-10-09 the second way is closed on the control node**:
+  [ADR 0268](0268-the-login-shells-execute-is-withheld-on-the-control-node-until-a-call-to-it-needs-a-persons-approval.md)
+  withholds `execute` there through its holder's setting. The self-check counts the login shell only where
+  `execute` is served, failing closed: served while the holder's setting for that machine is `serve`, or
+  while the bus hears the verb answered there, or while the bus cannot be asked. The first way closes with
+  ADR 0266 (hq pull request 225, not yet merged): agents on the control node run under an account of their
+  own, without sudo.
+- **What cannot be measured is not a pass** (added on 2026-10-09). A machine where a trusted party runs and
+  the self-check cannot measure who can become root — the sudo module not assigned there, or not answering —
+  raises the same urgent condition, saying it was not measured, so the router approves nothing proven
+  there until it is.
 - **The controller holds the whole JetStream API** today. Narrowing it to the streams and buckets it owns is
  planned work of its own; until then the controller is trusted with every record.
 - **On the X11 desk an agent can read a code as it is shown or typed** (ADR 0234's accepted risk). The hour
@@ -374,7 +392,13 @@ Telegram, or from the mesh MCP server." The asker's words never name a channel.
 - **Harder:** an asker must keep which warrants it acted on; the shared library carries it.
 - **Harder:** the controller composes two new grant rules, and an asking module must use the seat in its
  manifest to be granted anything.
- **The bot token moves** from the messenger's own secret to the `telegram` module's.
+- **The bot token moves** from the messenger's own secret to the `telegram` module's, given at the desk
+  (`give`, §10 step 7). **Nothing the channel or the router trusts is a setting**
+  ([issue 342](../04-ISSUES/342-a-password-is-taken-as-a-setting-and-outranks-the-vaults/00-report.md): a
+  password, token or key is not a setting). The operator's Telegram account is the router's identity list,
+  written by linking alone; no chat id is configured anywhere. The two settings these modules keep — the
+  router's time zone and the desk channel's machines — are the terminal's, as every mergeable file's are
+  since [issue 340](../04-ISSUES/340-an-agent-can-plant-a-hook-in-every-agent-session-on-the-mesh/00-report.md).
 - **Accepted risk:** a linked Telegram account, if taken, can approve (announced, reversible), never
  destroy. Linking before a TOTP factor exists carries the X11 risk in §7.

@@ -402,8 +426,11 @@ Telegram, or from the mesh MCP server." The asker's words never name a channel.
 | While an agent can become root without a person where the router or a verified channel runs, it is said and nothing proven there approves | controller probe test (fails with agents as the operator's account, and with the login shell running as an account with passwordless sudo; passes once neither holds); the sudo module's `sudo_escalation` test; router test refusing approval |
 | A tool call never publishes an intake event or a proof | tool runner test: only a bundle's own channel reaches the seat publish, for its own kind |
 | The asker acts once per warrant and records the warrant | shared library test; controller test reading the hand-act after a warrant |
+| A warrant authorises only the act its option bound, for the ask as it was shown | shared library tests (`TestAWarrantAuthorisesOnlyTheActItsOptionBound`); controller test (`TestAWarrantPerformsOnlyTheActItsOptionBound`); router test (the warrant names the ask's digest) |
+| The self-check counts the login shell only where `execute` is served, and what it cannot measure fails | controller probe tests (`TestTheLoginShellCountsOnlyWhereExecuteIsServed`, the unmeasured case) |
+| The whole flow, before anyone uses it | the lab's proof `asks` (mesh-lab): a real bus with the controller's composed grants, the router and the Telegram channel in runtimes of their own accounts, a fake Telegram API — approve acted once, decline, expiry, a replayed tap, a tap from another account, a forged warrant, an ask under another name, an ask from a module that may not ask |
 | The controller holds no channel code | review; the controller's module imports no channel package |
-| End to end | live drill: a held delivery released from the phone; the hand-act reads "the operator, via telegram, user id verified" |
+| End to end | live drill after rollout (mesh-lab `asks/live-acceptance.md`): a harmless ask approved on the phone, acted once; the hand-act reads "the operator, as telegram identity …", via telegram, user id verified |

 ## References