Cite ADR 0399 and 0400 in design 29: the account's forge key lives in ~/.ssh (issue 955)

03-DESIGN/01-to-be/29-a-node-has-operator-accounts.md

@@ -5,7 +5,7 @@ code:
   - mesh-controller internal/inventory
   - mesh-controller internal/catalogue
   - mesh-controller cmd/mesh-controller
-updated: 2026-10-02
+updated: 2026-10-16
 decisions:
   - "ADR 0181"
   - "ADR 0182"
@@ -14,6 +14,8 @@ decisions:
   - "ADR 0051"
   - "ADR 0113"
   - "ADR 0117"
+  - "ADR 0399"
+  - "ADR 0400"
 ---
 
 # 29 — A node has operator accounts, and the mesh owns what lives under a home
@@ -220,6 +222,17 @@ each need a decision before the modules that replace the generators can be writt
 
 The modules §2 calls *a family* — the shell, the terminal, the desktop, everything under a home that is not `~/.ssh` — are designed in [37 — The operator's machine](37-the-operators-machine.md), under ADR 0173 to ADR 0177. This document keeps `~/.ssh`, the CA and the roster files. Two things it listed as not built are decided there: user-scoped services (ADR 0177) and the one-off steps a hook used to run (declared state, or a seat's verb).
 
+## The forge over SSH — 2026-10-16
+
+`~/.ssh` gains the account's own key for the forge. ADR 0399 decides that each machine's account has an SSH
+key made on the machine, that the forge registers its public half on the machine's agent user, and that
+`ssh-client` writes the forge's SSH key into `known_hosts`, ssh's configuration entry for the forge and git's
+rule that rewrites the forge's `https://` address to its SSH address. ADR 0400 decides how the public half
+travels: `ssh-client` writes it to its own state, keyed by node and account, and the forge's provider reads it
+there, since a manifest's contribution cannot carry a value made at run time. The forge's SSH address is its
+machine's name on the mesh, where its SSH port is open; the key's file is `~/.ssh/mesh_ed25519`, beside the
+operator's own keys, which stay theirs (§3). Built under issue 955.
+
 ## References
 
 - The gap was found generating `~/.ssh/config` from the *HAL* registry (`hal/terminal`'s
@@ -236,3 +249,4 @@ The modules §2 calls *a family* — the shell, the terminal, the desktop, every
 - ADR 0117,
   ADR 0118 —
   the never-sever-the-channel rule and the found-vs-owned semantics, applied here to `~/.ssh`.
+- ADR 0399, ADR 0400 — git over SSH with a key made on each machine, and how its public half reaches the forge.