1624 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
jochen	2953b8a8f4	Issue 340: an agent can plant a hook in every agent session on the mesh ... Record the hole the review traced, why the module cannot tell who called, which kinds run or are obeyed in a session and which stay registrable, the fix in the controller and the module, what is registered today, and that it must land before ADR 0266's agent account is switched on.	2026-10-09 02:30:11 +02:00
mesh-admin	4b6642de5e	Merge pull request 'Issue 339: the merge order against mesh-host #61, used-as-found as a behaviour change, the review's follow-ups' (#236) from issues/339-review-follow-ups into main	2026-10-08 23:55:39 +00:00
jochen	1d9d535912	Issue 339: an unmarked file counts as trusted, and the rollback hazard of the trusted field and its fix	2026-10-09 01:42:51 +02:00
mesh-admin	5b0b550157	Merge pull request 'Issue 319: why no walk opened, and four held deliveries closed with stop' (#237) from issues/319-diagnosis-held-deliveries-closed into main	2026-10-08 23:39:02 +00:00
jochen	a93ecf90ea	Issue 319: record why no walk opened, and the four held deliveries closed with stop ... A new module counts as something to move, so its delivery is held; a later walk reaches only the delivery whose merge is its commit. Four covered deliveries were stopped before this issue was found, and their merged pull requests now say error.	2026-10-09 01:38:02 +02:00
jochen	5d054b722d	Issue 339: the terminal's settings are derived from what a module serves and which files it trusts; a found directory is its own condition the gate never reads as a fault	2026-10-09 01:24:14 +02:00
jochen	5fbd89c062	Issue 339: the gate reads a directory used as found as a wait for a person; the trust anchors are the terminal's	2026-10-09 00:55:54 +02:00
mesh-admin	e62ab24658	Merge pull request 'ADR 0268: the login shell's execute is withheld on the control-node until a call to it needs a person's approval' (#235) from decision/0268-the-login-shells-execute-is-withheld-on-the-control-node into main	2026-10-08 22:30:08 +00:00
mesh-admin	ef2a38474f	Merge pull request 'Research 039: a tool or verb that needs a person's approval' (#233) from research/039-a-tool-that-needs-a-persons-approval into main	2026-10-08 22:30:03 +00:00
jochen	ab027691e1	Issue 339: name the merge order against mesh-host #61, record used-as-found as a behaviour change, and the review's follow-ups	2026-10-09 00:28:55 +02:00
mesh-admin	0f02ac47d4	Merge pull request 'Issue 339: any caller of the settings verb could have the node-engine hand a system directory to an account' (#234) from issues/339-a-verb-can-place-a-directory-at-the-machines-own into main	2026-10-08 22:21:03 +00:00
jochen	7bd868786f	ADR 0268: the login shell's execute is withheld on the control-node until a call to it needs a person's approval ... The operator's decision of 2026-10-09: execute runs any command as an account that can become root without a person, so the control-node stops offering it now, and every node marks it as needing approval once the mark exists. To-be 41 gains WP7 for the seat and the shell module.	2026-10-09 00:12:53 +02:00
jochen	ccb54450ea	Research 039: the login shell's execute is the first case, and narrow read tools must come first or approvals become noise	2026-10-09 00:01:47 +02:00
jochen	ac3a67ebab	Issue 339: any caller of the settings verb could have the node-engine hand a system directory to an account ... Located in the controller (places and accesses taken through every verb, no line-break check) and the node-engine (a found directory chowned as root, through a link too, and any path mounted). ADR 0266's boundary depends on the fix.	2026-10-09 00:00:04 +02:00
jochen	c31a76cac5	Research 039: a tool or verb that needs a person's approval, so an agent may ask but cannot act alone	2026-10-08 23:59:45 +02:00
mesh-admin	e2de8811a3	Merge pull request 'ADR 0267: an artifact is rebuilt only when its build source changes, and a module moves only along build dependencies on artifacts' (#232) from decision/0267-a-module-moves-when-its-build-source-changes into main	2026-10-08 21:13:14 +00:00
jochen	d2fe9bc870	Accept ADR 0267: the operator's word of 2026-10-08 ... Set its status to accepted and state the notes on ADR 0162, 0238 and 0236 as decided.	2026-10-08 23:11:35 +02:00
jochen	7d3f4407a7	ADR 0267 (proposed): an artifact is rebuilt only when its build source changes ... A merge to a shared repository moved every module that read it, in a gated tier each (issue 338). The operator's rule maps a change onto the artifacts whose build source it touches and adds only modules with a build dependency on a changed artifact; sharing a repository is no dependency. Supersedes in part ADR 0162 decision 1 (the packages kind) and ADR 0238 decision 3 (whole repository and context reads); adds build source to the glossary.	2026-10-08 23:05:51 +02:00
mesh-admin	d0be529194	Merge pull request 'Issue 337: the store's reader can read the controller's signing key (critical)' (#230) from issues/337-the-stores-reader-can-read-the-controllers-signing-key into main	2026-10-08 20:16:30 +00:00
jochen	7f78016f07	Issue 337: say that only what is gone is reported revoked, and that a grant the reader passed on is taken back with CASCADE	2026-10-08 22:11:16 +02:00
jochen	b17839a7db	Issue 337 after review: say control-node, drop the store's operational settings, and match the fix's revoke-by-grantor and read-back ... Adds what the fix cannot see (definer functions and views; the name check as a backstop) and, as a follow-up, that the reader's read-only session is a default a statement can turn off, so the missing write grants are the guard.	2026-10-08 22:02:30 +02:00
mesh-admin	4955a663d3	Merge pull request 'Issue 335: a build that passed its gate was failed and put back by the first machine's later reports' (#227) from issues/335-a-passed-gate-was-failed-by-later-reports into main	2026-10-08 19:51:27 +00:00
jochen	bbbaf943e8	Issue 335: resolved by mesh-controller#165 (8170fc5) with replay R335	2026-10-08 21:49:00 +02:00
jochen	6c297214ad	Issue 337: the store's reader could read the controller's signing key and every secret the store holds ... Opened and diagnosed: pg_read_all_data on the login the store seat's query runs as. Says what the store can and cannot tell about whether the key was read, why it should be rotated once the fix is taken, and that no rotation mechanism exists yet. The fix is mesh-catalog PR 143.	2026-10-08 21:46:01 +02:00
mesh-admin	a1c85c6de5	Merge pull request 'Design 52: until it is adopted, the workstation's fstab line still mounts at boot (review follow-up)' (#229) from fix/shares-review-followups into main	2026-10-08 19:37:03 +00:00
mesh-admin	ebffbaa17e	Merge pull request 'ADR 0264 and issue 330: a message a consumer gives up on is kept until a person delivers it again or drops it' (#223) from fix/330-a-message-given-up-on-is-kept into main	2026-10-08 19:26:57 +00:00
jochen	4dd52cace6	Design 52: say the workstation's fstab line still mounts at boot until it is adopted, and can hold the boot 30 s	2026-10-08 21:14:34 +02:00
jochen	6fdaeb79ba	Issue 334 and ADR 0264: an ask a seat gave up on can only be dropped for now ... The review refused a grant over every seat's queue, and a copy published again left the original stuck in it.	2026-10-08 21:08:12 +02:00
jochen	b0986e2ae0	Issue 330: name the installer's user list among its fixes	2026-10-08 21:08:12 +02:00
jochen	d1e0e121d6	ADR 0264 and issue 330: keep what a consumer gives up on until a person acts ... Design 25 promised a dead-letter stream nothing built; a message a consumer gave up on was lost after a week, silently once its condition cleared.	2026-10-08 21:08:12 +02:00
jochen	f346efb938	Issue 335: leave fixed-by for the merge, and call the put-back refusal a guard	2026-10-08 20:49:40 +02:00
mesh-admin	4eb8be9e66	Merge pull request 'ADR 0263 (accepted), research 038, design 52: a share is a provision, a node mounts it on demand' (#221) from feat/mounts-module into main	2026-10-08 18:39:59 +00:00
jochen	b409537dbc	Issue 335: a build that passed its gate was failed and put back by the first machine's later reports ... Recorded so the gate's verdict is known to be final, and the replay R335 holds it.	2026-10-08 20:27:36 +02:00
jochen	d05c9d7ca4	Name the safe order of taking shares into use without the retired word	2026-10-08 20:22:05 +02:00
jochen	bffd0f90d0	ADR 0263 and design 52 after review: what each export promises, per-node grants, refusals, not-built checks, and a read-only-first rollout	2026-10-08 20:21:48 +02:00
mesh-admin	0811b21be1	Merge pull request 'ADR 0265 and issue 327: a verb that reads is answered on the serving controller's own connection, and every connection says what it is' (#224) from fix/327-a-verb-reads-on-the-serving-connection into main	2026-10-08 18:21:28 +00:00
jochen	0a38d9b21d	ADR 0265: a panicking verb answers, and refused logins are not a reconnect loop	2026-10-08 20:04:19 +02:00
jochen	c3a0f7a595	ADR 0265 and issue 327: answer read verbs on the serving connection and name every connection ... Hundreds of short connections an hour, all named mesh-controller, hid any client reconnecting in a loop.	2026-10-08 20:04:19 +02:00
mesh-admin	8665027873	Merge pull request 'ADR 0262: a left-out module's data is backed up as this controller reads it, and an unplaceable line is listed' (#226) from fix/0262-backup-as-read into main	2026-10-08 16:41:31 +00:00
jochen	f30b2a3ae0	ADR 0262: note how a left-out module's data is backed up, as the controller now does it ... The record said its data is still copied; the shipped follow-up backs it up as this controller reads it and lists an unplaceable line rather than failing the machine.	2026-10-08 18:38:09 +02:00
jochen	f4b79ba7c2	Design 52 says how the modules were built: the server's bucket carries each share's path, two root processes, settings default to none	2026-10-08 18:37:15 +02:00
jochen	34899385ec	Accept ADR 0263 with the operator's choices: one share per folder so backups are never exported, mesh machines only	2026-10-08 18:23:23 +02:00
mesh-admin	79bd9911e6	Merge pull request 'ADR 0262: a preference has a default in its manifest, and the operator's own value has none' (#216) from feat/setting-defaults into main	2026-10-08 16:18:53 +00:00
jochen	6a9bc3f4b3	ADR 0262: say what a left-out module loses, and how far an entry's unknown key is read ... The record claimed a left-out module kept what the machine holds for it and that an entry's unknown key was read like a top-level one; neither is true of the merged controller.	2026-10-08 17:55:38 +02:00
jochen	f09c9befdf	ADR 0262: a module with a field the controller does not know is left out and raised, never read silently ... Dropping an unknown key would run a module without something its manifest says. Also name the check by what a key is about, narrow the listing to one machine, and say how to roll back below this record.	2026-10-08 17:55:04 +02:00
jochen	de7aca4fa6	ADR 0262: one listing of every preference, and research 037 surveying the literals to convert ... The operator asked for one place that lists every module's preferences and each machine's value, and for a list of the values the catalogues hard-code that should become preferences.	2026-10-08 17:55:04 +02:00
jochen	0e5a5e2085	ADR 0262: record the lenient read of stored manifests and the marked defaults layer ... A stored manifest read strictly would fail the whole catalogue after a controller rollback, and a node called default would lose its layer. Also scope the default, retire tunable, and list the new checks.	2026-10-08 17:55:04 +02:00
jochen	417db4d837	ADR 0262: let a preference carry a default so a running module can gain a setting ... A ${setting:} nothing set failed composition, and settings refused a key no file asked for yet, so no order of changes could add a setting to a running module. A manifest may now default a preference; the operator's own value still has none.	2026-10-08 17:55:04 +02:00
mesh-admin	acc82aa5e4	Merge pull request 'Issue 332: the service manager could neither clear a failed unit nor say what wants it' (#222) from issues/332-the-service-manager-cannot-clear-or-explain-a-failed-unit into main	2026-10-08 15:52:54 +00:00
jochen	fd6c452e61	Issue 332: add unlink-dangling and the glob refusal from the review ... disable cannot remove a link whose unit file is gone, so the verb that finds it needed one that removes it.	2026-10-08 17:40:00 +02:00