ADR 0259: an ask is a message on the bus, any channel answers it, and the asker acts on a warrant #211

2026-10-08T13:19:16Z

mesh-admin commented

2026-10-08 13:19:16 +00:00

Accepted by the operator on 2026-10-08, with the word warrant. Do not merge without review.

ADR 0259 (accepted; extends and supersedes in part ADR 0234 §3 and §8):
- the router (the operator-channel holder, the messenger) holds every ask, judges each answer and issues a warrant;
- the asker performs the option with its own grants and records the warrant;
- channels are modules claiming a kind on the channel and intake kinded benches: telegram and desk-channel;
- §3 lists the subjects, streams, buckets and grants, all on the bus;
- the operator's two decisions: §8, telegram runs on the control node under its own account (how this is enforced, and what remains if an agent has root); §7, a new link approves only after one hour, and every link and unlink is announced.
To-be 46 is amended in full: the parts diagram, §3, §4, §6, §10 (the subjects table, the router's checks, the factors as the router's), §11 (telegram's account, linking, desk-channel) and §13 (phase 5a).
ADR 0234 gets a dated pointer at §8.
The glossary: warrant; authorising ask and the domain line now name the router.

Code: branch feat/asks-answered-on-any-channel in mesh-controller, mesh-tools, mesh-sdk and mesh-catalog (PRs follow).

Checks: merge-check.sh passes locally, and words.py passes with the catalogue's list.

Accepted by the operator on 2026-10-08, with the word *warrant*. Do not merge without review. - **ADR 0259** (accepted; extends and supersedes in part ADR 0234 §3 and §8): - the router (the `operator-channel` holder, the messenger) holds every ask, judges each answer and issues a **warrant**; - the asker performs the option with its own grants and records the warrant; - channels are modules claiming a kind on the `channel` and `intake` kinded benches: `telegram` and `desk-channel`; - §3 lists the subjects, streams, buckets and grants, all on the bus; - the operator's two decisions: §8, `telegram` runs on the control node under its own account (how this is enforced, and what remains if an agent has root); §7, a new link approves only after one hour, and every link and unlink is announced. - **To-be 46** is amended in full: the parts diagram, §3, §4, §6, §10 (the subjects table, the router's checks, the factors as the router's), §11 (telegram's account, linking, desk-channel) and §13 (phase 5a). - **ADR 0234** gets a dated pointer at §8. - **The glossary**: *warrant*; *authorising ask* and the domain line now name the router. Code: branch `feat/asks-answered-on-any-channel` in mesh-controller, mesh-tools, mesh-sdk and mesh-catalog (PRs follow). Checks: merge-check.sh passes locally, and words.py passes with the catalogue's list.

mesh-admin commented

2026-10-08 13:19:49 +00:00

Delivery novox/hq@3e84e4cb609a — delivered since 2026-10-09T14:30:55Z

Delivery plan — builds nothing: the change touches no module of the mesh's graph

Transitions

2026-10-09 14:23 (new) → proposed (announced): novox/hq#211's head announced
2026-10-09 14:24 proposed → checked (checked): the verdict names this commit
2026-10-09 14:24 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-09 14:30 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-09 14:30 published → delivered (done): nothing for a walk to move

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/hq@3e84e4cb609a` — **delivered** since 2026-10-09T14:30:55Z **Delivery plan** — builds nothing: the change touches no module of the mesh's graph **Transitions** - 2026-10-09 14:23 (new) → proposed (announced): novox/hq#211's head announced - 2026-10-09 14:24 proposed → checked (checked): the verdict names this commit - 2026-10-09 14:24 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-09 14:30 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-09 14:30 published → delivered (done): nothing for a walk to move The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin changed title from ~~ADR 0259 (proposed): an ask is a message on the bus, any channel answers it, and the asker acts on a warrant~~ to ADR 0259: an ask is a message on the bus, any channel answers it, and the asker acts on a warrant

2026-10-08 14:18:13 +00:00

mesh-admin commented

2026-10-08 15:35:23 +00:00

Revised after the security review of 2026-10-08. The operator has not accepted this revision yet.

§8 is rewritten. The first version assumed the tool runner runs as root with a credential only root can read. That is false on the control node: node-tools.service runs as the operator's account, and that account has passwordless sudo (both measured today). The new rules:
- the router and every channel that verifies its sender get a bus account and a service account of their own, never a runner's;
- the controller refuses to compose warrant, identity or verified-sender traffic into a runner, or into anything that runs as the operator's account;
- only the operator-channel holder answers proofs and puts work on a kind's queue;
- no bus variable reaches a bundle;
- verified-sender is honoured only for a holder placed as above, on a machine where no agent's account can become root without a person. The self-check raises a condition while one can.
§7: unlinking, and relinking within a day of an unlink, is an approve ask answered on the account currently linked. The notice goes to that account first. If it is lost with the phone, the operator unlinks at the control node as root. Links are rate-limited, and only a private channel may show a code.
To-be 46: §11 gets a pointer to the revision, and §13 now says the TOTP seed is the router's.

Code PRs follow once the operator accepts. Do not merge.

**Revised after the security review of 2026-10-08. The operator has not accepted this revision yet.** - **§8 is rewritten.** The first version assumed the tool runner runs as root with a credential only root can read. That is false on the control node: `node-tools.service` runs as the operator's account, and that account has passwordless sudo (both measured today). The new rules: - the router and every channel that verifies its sender get a bus account and a service account of their own, never a runner's; - the controller refuses to compose warrant, identity or verified-sender traffic into a runner, or into anything that runs as the operator's account; - only the operator-channel holder answers proofs and puts work on a kind's queue; - no bus variable reaches a bundle; - `verified-sender` is honoured only for a holder placed as above, on a machine where no agent's account can become root without a person. The self-check raises a condition while one can. - **§7:** unlinking, and relinking within a day of an unlink, is an approve ask answered on the account currently linked. The notice goes to that account first. If it is lost with the phone, the operator unlinks at the control node as root. Links are rate-limited, and only a private channel may show a code. - **To-be 46:** §11 gets a pointer to the revision, and §13 now says the TOTP seed is the router's. Code PRs follow once the operator accepts. Do not merge.

mesh-admin referenced this pull request

2026-10-08 22:13:12 +00:00

ADR 0268: the login shell's execute is withheld on the control-node until a call to it needs a person's approval #235

jschoubben force-pushed decision/asks-answered-on-any-channel from 2f4b6d4235 to 02ec566623

2026-10-09 09:09:27 +00:00

Compare

jschoubben force-pushed decision/asks-answered-on-any-channel from cfbbdd6efb to 5f4599911f

2026-10-09 12:25:45 +00:00

Compare

mesh-admin commented

2026-10-09 13:01:11 +00:00

Rebased on main (glossary's Decided-by line now lists 0259 and 0272). New commit 5f45999 names the confirmation review's N1-router (an early desk unlink bars nothing; root lifts any bar) and N1-give (a trusted party's secret is never given at a desk; announced before kept at the terminal), root-free answered by the serving controller alone, the quiet window and the root-not-free key, a silence never ending an approval, no zero-expiry warrant, and the link bound's residual risk (throwaway accounts can use up an hour's ten links of a kind; denies, never grants). These additions need the operator's acceptance. merge-check.sh passes (with the catalogue's word list).

jschoubben added 15 commits 2026-10-09 14:12:18 +00:00

ADR 0259 (proposed): let any module ask a person and any channel answer, so Telegram is not built into the controller 9f66452fff

Accept ADR 0259 with the operator's two decisions, and amend to-be 46 to it 1714132a08

Name the channel's failure and standing as intake events, and where the router reads each kind's capabilities 1ebbf9007a

Say which defects the channel fixes and which ask is refused, as built 1e51c062f6

Keep an ask's tickets in its own record, where its closing ends them b63d27ded1

Revise ADR 0259 after the security review: the router and verified channels get bus accounts of their own, verified-sender follows placement, and unlinking is asked of the linked account c08b621491

Name the router, not the controller's retired verbs, where the glossary and to-be 46 still did a04f1b90a0

Record the operator's choice for the control node, and the second way an agent reaches root there 7dd83d4435

Say how a module of its own account is served, and how the root probe is checked 7e158c739e

ADR 0259: bind a warrant to the exact ask and act, count the login shell where execute is served (ADR 0268), fail closed where root is not measured, and keep what is trusted out of settings (issue 342) ba49876e48

ADR 0259: the drill as the live acceptance, another account's answer told to the operator, an ask's message never folded de5c89a211