ADR 0268: the login shell's execute is withheld on the control-node until a call to it needs a person's approval #235

2026-10-08T22:13:12Z

mesh-admin commented

2026-10-08 22:13:12 +00:00

The operator's decision of 2026-10-09, as narrowed the same day after the count of calls. Do not merge without review.

ADR 0268 (accepted; extends ADR 0204):
- execute becomes an optional verb of node-login-shell (ADR 0246's mark), so a node may withhold it and its holder is not judged silent.
- The shell module gets a setting, execute (default serve), written into a root-owned file its tools bundle reads at start. Anything but serve withholds the verb.
- The control-node's value is withhold from now on. The other nodes keep the default for now.
- Once the approval mark exists (research 039, #233), execute needs a person's approval on every node, the control-node included.
- Narrow read tools replace the common reads first, so that approvals stay rare. The follow-ups, as measured: reading or searching a file, a container's details and logs, a unit's state and journal, the listening sockets, an account or a name.
- Consequences said: the other nodes keep the root path until the mark exists; the seat now has no required verb, so a holder's silence is judged on no node; ADR 0259 §8's root probe (mesh-controller #154) must read whether execute is served, not whether the seat is held.
To-be 41 gains WP7: the diagram, what changes, the merge order and the live proof.

Code: mesh-controller #169 (the seat), mesh-catalog #145 (the zsh module). Merge order: controller first, then catalogue, then this.

ADR 0266 (#225), ADR 0259 (#211) and research 039 (#233) are not merged yet, so they are named without links.

Checks run locally: records.py, index.py, cycle.py and words.py all pass, words.py also with the catalogue's list.

The operator's decision of 2026-10-09, as narrowed the same day after the count of calls. Do not merge without review. - **ADR 0268** (accepted; extends ADR 0204): - `execute` becomes an optional verb of `node-login-shell` (ADR 0246's mark), so a node may withhold it and its holder is not judged silent. - The shell module gets a setting, `execute` (default `serve`), written into a root-owned file its tools bundle reads at start. Anything but `serve` withholds the verb. - The control-node's value is `withhold` from now on. The other nodes keep the default for now. - Once the approval mark exists (research 039, #233), `execute` needs a person's approval on every node, the control-node included. - Narrow read tools replace the common reads first, so that approvals stay rare. The follow-ups, as measured: reading or searching a file, a container's details and logs, a unit's state and journal, the listening sockets, an account or a name. - Consequences said: the other nodes keep the root path until the mark exists; the seat now has no required verb, so a holder's silence is judged on no node; ADR 0259 §8's root probe (mesh-controller #154) must read whether `execute` is served, not whether the seat is held. - **To-be 41** gains WP7: the diagram, what changes, the merge order and the live proof. Code: mesh-controller #169 (the seat), mesh-catalog #145 (the zsh module). Merge order: controller first, then catalogue, then this. ADR 0266 (#225), ADR 0259 (#211) and research 039 (#233) are not merged yet, so they are named without links. Checks run locally: records.py, index.py, cycle.py and words.py all pass, words.py also with the catalogue's list.

mesh-admin added 1 commit 2026-10-08 22:13:13 +00:00

ADR 0268: the login shell's execute is withheld on the control-node until a call to it needs a person's approval

mesh/merge-gate pass: the change touches no module of the mesh's graph

Details

mesh/repo-check pass: its merge-check.sh passed

Details

mesh/delivery delivered

Details

7bd868786f

The operator's decision of 2026-10-09: execute runs any command as an
account that can become root without a person, so the control-node stops
offering it now, and every node marks it as needing approval once the
mark exists. To-be 41 gains WP7 for the seat and the shell module.

mesh-admin commented

2026-10-08 22:13:47 +00:00

Delivery novox/hq@7bd868786f4d — delivered since 2026-10-08T22:30:15Z

Delivery plan — builds nothing: the change touches no module of the mesh's graph

Transitions

2026-10-08 22:13 (new) → proposed (announced): novox/hq#235's head announced
2026-10-08 22:14 proposed → checked (checked): the verdict names this commit
2026-10-08 22:14 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-08 22:30 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-08 22:30 published → delivered (done): nothing for a walk to move

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/hq@7bd868786f4d` — **delivered** since 2026-10-08T22:30:15Z **Delivery plan** — builds nothing: the change touches no module of the mesh's graph **Transitions** - 2026-10-08 22:13 (new) → proposed (announced): novox/hq#235's head announced - 2026-10-08 22:14 proposed → checked (checked): the verdict names this commit - 2026-10-08 22:14 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-08 22:30 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-08 22:30 published → delivered (done): nothing for a walk to move The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin merged commit e62ab24658 into main

2026-10-08 22:30:08 +00:00

mesh-admin deleted branch decision/0268-the-login-shells-execute-is-withheld-on-the-control-node

2026-10-08 22:30:08 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#235