From fccac61e586ddcba45e50b0988073c102ae9392a Mon Sep 17 00:00:00 2001 From: jochen Date: Mon, 31 Aug 2026 21:08:39 +0200 Subject: [PATCH] The board is a web application, not a category MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Supersedes 0032, which decided the right thing and described it wrongly. The decision is unchanged: the account that installed the host owns the mesh, and there is no user model. What was wrong was inventing "a surface that delegates authentication" for the board. It is a web application with a login, in the way every web application has a login. That is a fact about an application, not a property of the mesh. The cost was not cosmetic. It made the identity module look like part of the mesh's authority — something the mesh depends on to know who anybody is — when the mesh knows nothing about people at all and one of the applications running on it happens to have a login. Keeps the line that is worth writing down, and states it more plainly: signing in to an application must not become authority over the mesh. Today it cannot, because the board reads and does not act. The moment it can assign a module, whoever it lets in has mesh authority — and it would arrive as a feature rather than as a decision. So a surface that can change the mesh is a change to who owns the mesh, and is taken as one. Not forbidden; just not something that turns up in a pull request titled "add assign button". --- .../0032-the-local-account-owns-the-mesh.md | 3 +- .../0034-the-local-account-owns-the-mesh.md | 81 +++++++++++++++++++ 02-DECISIONS/README.md | 3 +- 3 files changed, 85 insertions(+), 2 deletions(-) create mode 100644 02-DECISIONS/0034-the-local-account-owns-the-mesh.md diff --git a/02-DECISIONS/0032-the-local-account-owns-the-mesh.md b/02-DECISIONS/0032-the-local-account-owns-the-mesh.md index c288478..81a3ced 100644 --- a/02-DECISIONS/0032-the-local-account-owns-the-mesh.md +++ b/02-DECISIONS/0032-the-local-account-owns-the-mesh.md @@ -1,10 +1,11 @@ --- topic: how we work -status: accepted +status: superseded date: 2026-08-31 deciders: jochen reconstructed: false extends: 02-DECISIONS/0031-the-control-plane-authenticates-nobody.md +superseded-by: 02-DECISIONS/0034-the-local-account-owns-the-mesh.md --- # 32. The local account owns the mesh; a surface delegates to a module diff --git a/02-DECISIONS/0034-the-local-account-owns-the-mesh.md b/02-DECISIONS/0034-the-local-account-owns-the-mesh.md new file mode 100644 index 0000000..5c14d29 --- /dev/null +++ b/02-DECISIONS/0034-the-local-account-owns-the-mesh.md @@ -0,0 +1,81 @@ +--- +topic: how we work +status: accepted +date: 2026-08-31 +deciders: jochen +reconstructed: false +supersedes: 02-DECISIONS/0032-the-local-account-owns-the-mesh.md +--- + +# 34. The local account owns the mesh, and a web application's login is not that + +*Supersedes [ADR 0032](0032-the-local-account-owns-the-mesh.md), which decided the right thing and +described it wrongly. The decision below is unchanged; what it said about the board was an +invention.* + +## Context + +ADR 0032 answered *who owns the mesh* — the account that installed the host — and then framed the +board as **a surface that delegates authentication**, a category it made up for the occasion. It +does not need one. + +**The board is a web application.** It has a login, provided by the identity module, in the way +every web application has a login. That is a fact about an application, not a property of the +mesh, and giving it a name in the mesh's vocabulary implied a relationship that is not there. + +The cost of the invented category was not cosmetic. It made the identity module look like part of +the mesh's own authority — something the mesh *depends on* to know who anybody is — when the truth +is that the mesh knows nothing about people at all, and one of the applications running on it has +a login. + +## Decision + +**The account that installed the host owns the mesh on that node.** Authority is a local login. +There is nothing else to hold, no user model, no roles, and nothing to administer. + +**This follows from what was already decided.** +[ADR 0004](0004-a-node-and-how-it-joins.md) says there is no authorisation between nodes — every +node is the operator's own, so a message from one is a message from them, and *the mesh boundary +is the security boundary.* A user model inside that boundary would guard nothing: anyone it could +stop could read the node's key off the disk. + +**A web application's login is its own business.** The board authenticates its users through the +identity module. So might anything else the mesh runs. **None of that is mesh authority**, and the +mesh does not learn who anybody is from it. + +## The line this draws, which is the reason to write it down + +**Signing in to an application must not, on its own, become authority over the mesh.** + +Today it cannot: the board reads and does not act +([`11-a-board.md`](../03-DESIGN/01-to-be/11-a-board.md) — *not the way to change things*). Looking +at a page tells you what is true and changes nothing. + +**The moment the board can assign a module, whoever it lets in has mesh authority** — and it would +arrive as a feature rather than as a decision. That is the failure this record exists to make +visible, because it is the kind that is only obvious afterwards. + +So: **a surface that can change the mesh is a change to who owns the mesh**, and is taken as one. +Not forbidden — wanting to manage nodes from a browser is reasonable — but not something that +turns up in a pull request titled *add assign button*. + +## Consequences + +**The identity module is not special.** Not substrate ([ADR 0031](0031-the-control-plane-authenticates-nobody.md)), +not part of the mesh's authority, and nothing about the mesh stops working when it is down. Some +applications cannot be logged into, which is what it means for an application's login provider to +be unavailable. + +**Anyone with a shell on a node has full authority there.** Unchanged from ADR 0032, and still the +sentence that decides who gets an account on a machine. The protection is the machine's own login +and the overlay that keeps it unreachable from outside ([ADR 0007](0007-connectivity.md)). + +**A node cannot be operated by somebody without a login on it.** The cost of having no user model. +If that is ever wanted, the paragraph above says what it costs. + +## References + +- [ADR 0032](0032-the-local-account-owns-the-mesh.md) — superseded; same decision, invented category +- [ADR 0004](0004-a-node-and-how-it-joins.md) — the mesh boundary is the security boundary +- [ADR 0031](0031-the-control-plane-authenticates-nobody.md) — the control plane authenticates + nobody diff --git a/02-DECISIONS/README.md b/02-DECISIONS/README.md index 15d55fe..c1e7d5d 100644 --- a/02-DECISIONS/README.md +++ b/02-DECISIONS/README.md @@ -128,6 +128,7 @@ python3 00-META/checks/index.py fail if stale - **0022** — [The constitution absorbs what is already enforced](0022-the-constitution-absorbs-what-is-enforced.md) - **0023** — [The approval is the checkpoint, not the second pair of hands](0023-approval-is-the-checkpoint.md) - **0025** — [The design record is read where it is written, never copied to be found](0025-the-design-record-is-read-not-copied.md) -- **0032** — [The local account owns the mesh; a surface delegates to a module](0032-the-local-account-owns-the-mesh.md) +- **0032** — [The local account owns the mesh; a surface delegates to a module](0032-the-local-account-owns-the-mesh.md) *(superseded)* +- **0034** — [The local account owns the mesh, and a web application's login is not that](0034-the-local-account-owns-the-mesh.md)