2026-09-05 10:27:11 +00:00
2 changed files with 36 additions and 1 deletions
@@ -83,6 +83,16 @@ Four layers. Naming them honestly is worth more than the word on the tin:
 | **modules are how anything is built and delivered** | this *is* the CI/CD, not something beside it ([ADR 0010](0010-delivery.md)) |
 | **agents are hired onto nodes and do the work** | the layer the other three exist to carry |

+**The fourth row is where the value is, and the first three are what make it possible.** An agent
+hired onto one node can reach any other — a shell, a service, a file — because the private network
+makes every node reachable and `identity` decides which agents may reach which. **That is the
+capability being built**: not machines that can be configured centrally, which is ordinary, but a
+set of machines an agent can work across as though they were one.
+
+The credential belongs to the **agent**, never to the node it is sitting on
+([ADR 0006](0006-the-substrate-and-the-control-plane.md)), which is the same rule as *nodes and
+agents are decoupled* below, applied to access.
+
 **This is not a mesh in the peer-to-peer sense and will not become one.** The word describes what
 machines can reach, not how they are governed:

@@ -49,7 +49,32 @@ It is three questions wearing one name, and only two of them are the mesh's:
 |---|---|
 | **humans** | their key, on the nodes they are allowed on |
 | **agents** | the same, with a lifetime — and revocation that has to actually work |
-| **node to node** | **not a mesh function.** The host has no inbound control surface by decision ([ADR 0004](0004-a-node-and-how-it-joins.md)); nodes SSHing to each other would be a second control path arriving through the back door |
+| **an agent reaching another node** | **this is the point of the mesh, not an exception to it** — see below |
+
+**There is no such thing as node-to-node SSH here, and that is a clarification rather than a
+restriction.** The actor is always an **agent**; a node is only where it happens to be running —
+[ADR 0001](0001-mesh-brokers-nodes-host-agents-think.md): *a node is a place where an agent can
+run, that is the entire relationship.* An agent hired onto one node reaching another to do work is
+the capability the whole arrangement exists to provide.
+
+**The credential is the agent's, never the node's.** It lives in the agent's own credential
+directory ([ADR 0001](0001-mesh-brokers-nodes-host-agents-think.md)), so a node's
+`authorized_keys` lists **agents** and never nodes. Three things follow, and they are why this
+shape is better rather than merely allowed:
+
+- [ADR 0004](0004-a-node-and-how-it-joins.md)'s *a node holds its own identity and nothing else*
+  stays true — no node holds a key that reaches another node;
+- a compromised node costs the credentials of the agents that were on it, not a way into
+  everything;
+- **who may reach what is a mesh-wide fact**, which is exactly why it is `identity`'s and not
+  something arranged locally.
+
+**And it does not conflict with the host having no inbound control surface.** That rule is about
+how a node's *declared state* changes: over the broker, never by being dialled. An agent with a
+shell is not the mesh reconfiguring a machine — it is what a person with a terminal has always
+been, and this design already depends on it working
+([ADR 0007](0007-connectivity.md): the overlay is *the way back in*). What such a session can leave
+behind is drift, and drift is what reconciliation is for.

 **Where the record lives is deliberately open.** Contexts integrate through it, which makes it
 load-bearing, and putting it in the substrate risks recreating the circularity the tiers just