novox/hq
13
0
Fork 0
Code Issues Pull Requests 1 Releases Wiki Activity

Cite ADR 0399 and 0400 in design 29: the account's forge key lives in ~/.ssh (issue 955)
mesh/merge-gate out of date: judged against trunk f9c240a957b8, the trunk is now f795356ae1d6; judged again on a recheck or when it is merged
Details
mesh/repo-check out of date: judged against trunk f9c240a957b8, the trunk is now f795356ae1d6; judged again on a recheck or when it is merged
Details
mesh/delivery-group group feat/agents-write-git-ssh checking: 0 of 2 member(s) ready
Details
mesh/delivery superseded: a newer head of the same pull request
Details

Browse Source
This commit is contained in:
nox
2026-10-16 22:37:15 +02:00
parent f9c240a957
commit fa5fd9fc69
1 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md
+15 -1
View File
@@ -5,7 +5,7 @@ code:
- mesh-controller internal/inventory - mesh-controller internal/inventory
- mesh-controller internal/catalogue - mesh-controller internal/catalogue
- mesh-controller cmd/mesh-controller - mesh-controller cmd/mesh-controller
updated: 2026-10-02 updated: 2026-10-16
decisions: decisions:
- "ADR 0181" - "ADR 0181"
- "ADR 0182" - "ADR 0182"
@@ -14,6 +14,8 @@ decisions:
- "ADR 0051" - "ADR 0051"
- "ADR 0113" - "ADR 0113"
- "ADR 0117" - "ADR 0117"
- "ADR 0399"
- "ADR 0400"
--- ---
# 29 — A node has operator accounts, and the mesh owns what lives under a home # 29 — A node has operator accounts, and the mesh owns what lives under a home
@@ -220,6 +222,17 @@ each need a decision before the modules that replace the generators can be writt
The modules §2 calls *a family* — the shell, the terminal, the desktop, everything under a home that is not `~/.ssh` — are designed in [37 — The operator's machine](37-the-operators-machine.md), under ADR 0173 to ADR 0177. This document keeps `~/.ssh`, the CA and the roster files. Two things it listed as not built are decided there: user-scoped services (ADR 0177) and the one-off steps a hook used to run (declared state, or a seat's verb). The modules §2 calls *a family* — the shell, the terminal, the desktop, everything under a home that is not `~/.ssh` — are designed in [37 — The operator's machine](37-the-operators-machine.md), under ADR 0173 to ADR 0177. This document keeps `~/.ssh`, the CA and the roster files. Two things it listed as not built are decided there: user-scoped services (ADR 0177) and the one-off steps a hook used to run (declared state, or a seat's verb).
## The forge over SSH — 2026-10-16
`~/.ssh` gains the account's own key for the forge. ADR 0399 decides that each machine's account has an SSH
key made on the machine, that the forge registers its public half on the machine's agent user, and that
`ssh-client` writes the forge's SSH key into `known_hosts`, ssh's configuration entry for the forge and git's
rule that rewrites the forge's `https://` address to its SSH address. ADR 0400 decides how the public half
travels: `ssh-client` writes it to its own state, keyed by node and account, and the forge's provider reads it
there, since a manifest's contribution cannot carry a value made at run time. The forge's SSH address is its
machine's name on the mesh, where its SSH port is open; the key's file is `~/.ssh/mesh_ed25519`, beside the
operator's own keys, which stay theirs (§3). Built under issue 955.
## References ## References
- The gap was found generating `~/.ssh/config` from the *HAL* registry (`hal/terminal`'s - The gap was found generating `~/.ssh/config` from the *HAL* registry (`hal/terminal`'s
@@ -236,3 +249,4 @@ The modules §2 calls *a family* — the shell, the terminal, the desktop, every
- ADR 0117, - ADR 0117,
ADR 0118 — ADR 0118 —
the never-sever-the-channel rule and the found-vs-owned semantics, applied here to `~/.ssh`. the never-sever-the-channel rule and the found-vs-owned semantics, applied here to `~/.ssh`.
- ADR 0399, ADR 0400 — git over SSH with a key made on each machine, and how its public half reaches the forge.