From 6bf56ea5c9f2ef612a79ea2c3780826718e80be5 Mon Sep 17 00:00:00 2001 From: jochen Date: Tue, 13 Oct 2026 16:36:26 +0200 Subject: [PATCH 1/3] To-be 46: an ask reads at a glance, and its values are whole where the sender is proven (ADR 0345, issues 383 and 639) The operator would not read the Telegram asks: the ADR 0343 ask was thirty plain lines, a settings proposal a wall of masked values. The design takes ADR 0345: the asker's summary and points are the body, everything else a note the channel shows apart, and an ask's values whole on a proving channel. --- .../46-the-conversation-with-the-operator.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md b/03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md index c1e6ad3b..a6b94b00 100644 --- a/03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md +++ b/03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md @@ -4,6 +4,7 @@ status: in-progress code: [mesh-controller, mesh-tools, mesh-sdk, mesh-catalog] updated: 2026-10-13 decisions: + - "ADR 0345" - "ADR 0344" - "ADR 0332" - "ADR 0308" @@ -186,6 +187,17 @@ An id; the asker (bus principal and machine); the kind with its options or bound priority (urgent or normal); optionally a timeout and a default; optionally a conversation handle; optionally a group, for batching. The words pass the content rule. +*Amended 2026-10-13, ADR 0345 (issues 383 and 639):* **an ask reads at a glance.** Its words are a headline +saying what it changes for the operator; an explanation that is a summary of two or three short sentences on +one line, then at most three points; and Details — who proposed it, a fingerprint, how to read it whole. The +router sends the headline as the title and the explanation alone as the body, and puts everything else in the +message's note: who asked and when with what happens if nobody answers, what each answer does, where else it is +answered, and the Details. A channel shows the note apart (Telegram: collapsed after a blank line; the desk: +after the body). Answered, the message is one line, "You chose Approve at 16:06 on Telegram · ". A +decision that needs the operator carries a brief its ask shows in place of its clauses; a settings proposal is +a summary and a point per key, at most three; an instructions proposal's text and a question's asker are their +Details. + ### Life **open → answered | defaulted | expired | cancelled.** @@ -254,6 +266,7 @@ withdrawn from routing and reported until it passes. A new word is a new version | | `operator-first` | the operator can write unprompted | a simulated message yields a `message` envelope | | trusting | `verified-sender` | the answer came from the operator's own account, through a holder no agent shares | a choice from an identity not on the list is dropped and reported; placement checked | | | `exact-render` | the ask is shown as the router rendered it | rendered text equals the router's, byte for byte | +| | | *Amended 2026-10-13, ADR 0345:* a channel may format the router's words (Telegram: the title bold, a key line in monospace, the note in a collapsed blockquote) and escapes their markup; it never rewords them | the words, formatting and runs of whitespace aside, equal the router's — what a tap on the message is compared by | | | `code-factor` | a typed code reaches the router by request and reply, never judged by the holder | a code never appears in an event; it is deleted from the conversation where the service allows | | | `key-factor` | a security key's assertion over the router's challenge reaches the router | the challenge is the router's; the signature is checked by the router | @@ -354,6 +367,11 @@ is not exempted. - **A refusal is said to the sender** — the `notify` call or the ask is refused naming the offending part, so the asker can rephrase or move the specific into a reference — and raises `channel-refused`. The offending part is never sent to a channel. +- *Amended 2026-10-13, ADR 0345 (issue 383):* **an ask may carry its explanation whole** (`Whole` beside + `Explanation`), its paths and addresses as they are: what the operator approves must be readable where they + approve it. The router shows the whole only on an ask's own message, on a kind declaring `verified-sender` that + was given the ask's answers, and holds it to the secret rule alone; a secret's shape in it refuses the ask as a + whole. The rule above holds for everything else: every condition's words, and every kind that proves nothing. ### References From 327f7bc55ceddabf7f49d1226061115687122691 Mon Sep 17 00:00:00 2001 From: jochen Date: Tue, 13 Oct 2026 17:05:11 +0200 Subject: [PATCH 2/3] To-be 46: every value an approval sets is in the ask's note (ADR 0347, issue 383) --- .../01-to-be/46-the-conversation-with-the-operator.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md b/03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md index a6b94b00..2ba1cca9 100644 --- a/03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md +++ b/03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md @@ -4,6 +4,7 @@ status: in-progress code: [mesh-controller, mesh-tools, mesh-sdk, mesh-catalog] updated: 2026-10-13 decisions: + - "ADR 0347" - "ADR 0345" - "ADR 0344" - "ADR 0332" @@ -198,6 +199,12 @@ decision that needs the operator carries a brief its ask shows in place of its c a summary and a point per key, at most three; an instructions proposal's text and a question's asker are their Details. +*Amended 2026-10-13, ADR 0347 (issue 383):* **every value an approval sets is in the note.** A settings +proposal's Details list every key with its value, one line each and uncut — masked under the content rule, and +whole (`WholeDetails`) where the router shows the whole words — so the operator can always read exactly what +Approve sets; a point cut for the glance says so. A channel that bounds a message's length cuts the body first +and keeps the note whole, saying where it cut. + ### Life **open → answered | defaulted | expired | cancelled.** From de3b61217a4e908e8c1ac7fa8ab7a4736c47da84 Mon Sep 17 00:00:00 2001 From: jochen Date: Tue, 13 Oct 2026 20:35:29 +0200 Subject: [PATCH 3/3] To-be 46: say ADR 0347 as it is decided (the review of #344): no overclaim, and the note is cut last, not never --- .../01-to-be/46-the-conversation-with-the-operator.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md b/03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md index 2ba1cca9..d9b060f1 100644 --- a/03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md +++ b/03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md @@ -200,10 +200,12 @@ a summary and a point per key, at most three; an instructions proposal's text an Details. *Amended 2026-10-13, ADR 0347 (issue 383):* **every value an approval sets is in the note.** A settings -proposal's Details list every key with its value, one line each and uncut — masked under the content rule, and -whole (`WholeDetails`) where the router shows the whole words — so the operator can always read exactly what -Approve sets; a point cut for the glance says so. A channel that bounds a message's length cuts the body first -and keeps the note whole, saying where it cut. +proposal's Details list every key it sets with its value, one line each and never cut, the value masked where the +content rule requires. Their whole form (`WholeDetails`) is shown in their place where the router shows the whole +words, held to the secret rule alone: there the operator reads every value Approve sets, but a value shaped like a +secret, which is withheld and named by its key. A point cut for the glance says so, and no more than the note +holds. A channel that bounds a message's length cuts the body first and says where it cut; it cuts the note only +when the title and the note alone do not fit, and says that too. ### Life