1707 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
mesh-admin	eec84794e3	Merge pull request 'ADR 0259: an ask is a message on the bus, any channel answers it, and the asker acts on a warrant' (#211) from decision/asks-answered-on-any-channel into main	2026-10-09 14:30:48 +00:00
jschoubben	3e84e4cb60	ADR 0259: accepted as revised on 2026-10-09	2026-10-09 16:23:44 +02:00
jschoubben	32107428c4	ADR 0259: a rehearsal, not a drill; the announcement at the terminal checked; the operator's steps with nox, and the standard-input gap said	2026-10-09 15:38:41 +02:00
jschoubben	ec9bab5ee8	ADR 0259: name the confirmation review's N1 findings and their fixes — an early desk unlink bars nothing, a trusted party's secret is never given at a desk — and root-free answered by the serving controller alone, a silence never ending an approval, the link bound's residual risk	2026-10-09 15:36:36 +02:00
jschoubben	69c6ff73e6	ADR 0259: after the review of 2026-10-09 — root-free as a positive measure, warrants under ids nobody can guess, canonical digests, the code shown to a person or not at all, unlinking bound to the account and possible in the first hour, break-glass named, give as built; the operator's desktop client and the controller's write to the router's state stated as known gaps (issue 344)	2026-10-09 15:36:36 +02:00
jschoubben	8273faa4f0	ADR 0259: an ask the controller could not deliver is a condition of its own	2026-10-09 15:36:36 +02:00
jschoubben	de5c89a211	ADR 0259: the drill as the live acceptance, another account's answer told to the operator, an ask's message never folded	2026-10-09 15:36:36 +02:00
jschoubben	ba49876e48	ADR 0259: bind a warrant to the exact ask and act, count the login shell where execute is served (ADR 0268), fail closed where root is not measured, and keep what is trusted out of settings (issue 342)	2026-10-09 15:36:36 +02:00
jochen	7e158c739e	Say how a module of its own account is served, and how the root probe is checked	2026-10-09 15:36:36 +02:00
jochen	7dd83d4435	Record the operator's choice for the control node, and the second way an agent reaches root there	2026-10-09 15:36:36 +02:00
jochen	a04f1b90a0	Name the router, not the controller's retired verbs, where the glossary and to-be 46 still did	2026-10-09 15:36:36 +02:00
jochen	c08b621491	Revise ADR 0259 after the security review: the router and verified channels get bus accounts of their own, verified-sender follows placement, and unlinking is asked of the linked account	2026-10-09 15:36:36 +02:00
jochen	b63d27ded1	Keep an ask's tickets in its own record, where its closing ends them	2026-10-09 15:36:36 +02:00
jochen	1e51c062f6	Say which defects the channel fixes and which ask is refused, as built	2026-10-09 15:36:36 +02:00
jochen	1ebbf9007a	Name the channel's failure and standing as intake events, and where the router reads each kind's capabilities	2026-10-09 15:36:36 +02:00
jochen	1714132a08	Accept ADR 0259 with the operator's two decisions, and amend to-be 46 to it	2026-10-09 15:36:36 +02:00
jochen	9f66452fff	ADR 0259 (proposed): let any module ask a person and any channel answer, so Telegram is not built into the controller	2026-10-09 15:36:36 +02:00
mesh-admin	80b02dc9a0	Merge pull request 'Issue 348: a resolver that stopped answering ran on unnoticed, and builds sent after it were blamed' (#249) from issues/348-the-resolver-stopped-answering-and-nothing-restarted-it into main	2026-10-09 13:25:22 +00:00
jschoubben	fbd00a16ca	Issues 348 and 349: the review's answers — gaps, parts, D2 unchanged, the newest merge in any state	2026-10-09 15:05:42 +02:00
jschoubben	17b64270b0	Issue 348: the manifest test takes either binding until the catalogue merges	2026-10-09 14:22:17 +02:00
jschoubben	3acc1ec219	Issue 349: a merge acted on late superseded the merge after it, and built the older commit ... Plans of a branch superseded each other by when they were made; the catch-up's late plan of an older merge took over a newer one, once a security fix to the forge's module. Recorded with the fix in review.	2026-10-09 14:12:42 +02:00
jschoubben	582be67f05	Issue 348: a resolver that stopped answering ran on unnoticed, and builds sent after it were blamed ... Records the 2026-10-09 outage on the control node: what was measured (the unit ran, the private address refused; a restarted node-engine's undecided statement cleared the network condition and its reopening dated the fault after the send), what the reproduction showed of bind-dynamic, what is still guessed, and the fixes in review.	2026-10-09 14:12:42 +02:00
mesh-admin	fce1bbb432	Merge pull request 'ADR 0272: progressive insight — the terminal's mark, the login session, ordinary lines are reads and settings' (#248) from insight/0272-the-terminals-mark-and-the-login-session into main	2026-10-09 12:02:53 +00:00
mesh-admin	3b99661b27	Merge pull request 'Issue 344: the known gaps in the agent's boundary, accepted for now' (#244) from issues/344-known-gaps-in-the-agents-boundary into main	2026-10-09 11:59:23 +00:00
jochen	37bc302d7d	ADR 0272's note: what the login-session rule does not do, and the class=user record	2026-10-09 13:56:04 +02:00
jochen	57cfdb5cf9	Issue 344: gaps 12 and 13 closed by mesh-catalog #153 and mesh-controller #177	2026-10-09 13:49:54 +02:00
jochen	cd70eb7f6a	ADR 0272: progressive insight — the terminal's mark, the login session, ordinary lines are reads and settings	2026-10-09 13:42:17 +02:00
mesh-admin	6ea93e824a	Merge pull request 'Issue 347: a pull request opened after its push is never checked, and nothing says so' (#247) from issues/347-a-pull-request-opened-after-its-push-is-never-checked into main	2026-10-09 11:38:40 +00:00
mesh-admin	54d974f178	Merge pull request 'ADR 0272 (accepted) and issue 343: the controller's terminal has no command; mesh-cli on every node' (#243) from decision/0272-mesh-cli-the-operators-command into main	2026-10-09 11:38:36 +00:00
jochen	fc449617be	Issue 347: a base requiring only mesh/repo-check counts, and the delivery's owner says it ... The confirmation review: hq requires only mesh/repo-check, so a watcher that looked for mesh/merge-gate alone would never have said this repository's own unchecked pull request. And the delivery domain's own condition, a delivery held past its bound, says it rather than a provider standing.	2026-10-09 13:16:27 +02:00
jochen	4b5793144d	ADR 0272: §4 as built after the confirmation review, ADR 0266 linked now it is merged ... An ordinary line meets the generic verb's reading forms and never a terminal-only command (node account and node agent-account by ADR 0266, token, operator, a secret's export); a terminal line drops ADR 0266's served mark, so it reads as the terminal. How it is checked says the withholding tests search base64 too and fail when what they guard goes, and the control-node refusal is tested through the acts.	2026-10-09 13:15:59 +02:00
jochen	3bdd4e8040	Merge remote-tracking branch 'origin/main' into decision/0272-mesh-cli-the-operators-command	2026-10-09 13:15:36 +02:00
jochen	d3cb9fedf4	ADR 0272 accepted (the operator, 2026-10-09)	2026-10-09 13:02:45 +02:00
jochen	d7c97d02fa	Issue 344: name the node-engine's repository as code	2026-10-09 12:56:54 +02:00
jochen	bac7feca77	ADR 0272: the review's answers — every line a call, the socket grants nothing, the terminal does not follow assign, each claim and how it is checked ... - §3: the node-engine vouches and decides nothing; deadline first, other namespaces refused, each account bounded and answered busy; the subject is the machine's own in the writers table. - §4: phase 1 refuses the agent account (phase 2 answers it); an ordinary settings line takes the settings verb's path; the controller's module is assigned at the terminal only, so the terminal does not follow assign; 'no wider than today' holds only while its two measured facts hold. - §5: every line is a call, followed to its answer; 'nothing ran' only of a line nobody took, otherwise 'not known' with the call; the answer is its asker's alone. - §7: after the four merge, the operator assigns mesh-cli to every node. - How it is checked: each claim with its test or measurement, the MESH_VERB refusal in mesh-cli named a courtesy, and the sudo and agent-account facts read on the control-node today.	2026-10-09 12:56:44 +02:00
jochen	3143f5c698	Issue 344: gap 9 narrowed by mesh-host #61; the tools' sudo and the forge's rule precedence	2026-10-09 12:56:41 +02:00
mesh-admin	2700ef7096	Merge pull request 'ADR 0266 and issue 333: on the control node, agents run under an account of their own' (#225) from decision/0266-agents-run-under-an-account-of-their-own into main	2026-10-09 10:56:11 +00:00
jochen	2ba0d68306	Issue 347: a pull request opened after its push is never checked, and nothing says so ... The forge's announcer reads only repositories whose update time moved; a pull request opened after its push does not move it. Located in the forge module, with the fix (mesh-catalog) and how it is checked.	2026-10-09 12:55:26 +02:00
mesh-admin	6a7cf421a9	Merge pull request 'Issue 346: a setting a verb may set is pasted raw into its file, so an untrusted file is an injection point' (#246) from issues/346-a-setting-a-verb-may-set-is-pasted-raw-into-its-file into main	2026-10-09 10:51:03 +00:00
mesh-admin	2ed56a80b8	Merge pull request 'Issue 345: a calendar reminder shows transparent and empty, and the mesh had no tool to look at it' (#245) from issues/345-a-reminder-window-shows-transparent-and-empty into main	2026-10-09 10:50:55 +00:00
jschoubben	0ff6bd2267	Issue 346: user-dirs.dirs is trusted again for now (mesh-catalog #158), the stop-gap before the fix	2026-10-09 12:40:26 +02:00
jschoubben	79f31ca113	Issue 346: a setting a verb may set is pasted raw into its file, so an untrusted file is an injection point ... Found in the review of the picom settings: a backend of xrender"; write-pid-path = "… adds an option of the caller's. The two files marked trusted false on main are judged (user-dirs.dirs open, dunstrc not), and typed settings validated at the verb and quoted at render are proposed; until then nothing new goes trusted false.	2026-10-09 12:35:30 +02:00
jochen	cb907d5810	ADR 0266: an agent can merge its own pull request, and the restart condition's quiet counts on the controller's clock ... The record said a merge needs a person; the forge requires no approval and the merge tool merges once the checks pass, so nothing enforces the operator's yes. What still remains now says so, and that the restart fix counts from when the controller first saw the search pending. Item 10 and routes A and B describe the follow-ups of the review of 2026-10-09.	2026-10-09 12:27:13 +02:00
jschoubben	a4e132e47b	Issue 345: picom is the first suspect, the graphics stack, and compositing off as the first test ... The operator reports picom leaving a chat window stale after a workspace switch before, never recorded. The diagnosis now names the graphics stack, puts picom first among the candidates, and makes the first step at the next empty reminder turning compositing off, which loses nothing; a Betterbird restart comes after, refused while a message is being written unless the operator says yes.	2026-10-09 12:25:42 +02:00
jochen	11d261e582	Issue 344: the screen is readable through the display server's tools	2026-10-09 12:19:54 +02:00
jochen	41060224e6	ADR 0272: the agent account's judgement comes from the engine's statement, never from the request	2026-10-09 12:13:03 +02:00
jochen	e143f6b193	Issue 343: name the node-engine's repository as an identifier	2026-10-09 12:12:34 +02:00
jochen	57bb4dab74	Issue 343: phase 1 of ADR 0272 is open as four pull requests	2026-10-09 12:12:23 +02:00
jochen	322f3aec36	ADR 0272: a path in a line is read where the controller runs	2026-10-09 12:11:25 +02:00
jochen	e8f0f43f1b	Issue 344: an agent can merge its own pull request	2026-10-09 12:09:17 +02:00