ADR 0272 (accepted) and issue 343: the controller's terminal has no command; mesh-cli on every node #243

Merged

mesh-admin merged 10 commits from decision/0272-mesh-cli-the-operators-command into main 2026-10-09 11:38:36 +00:00

Conversation 2 Commits 10 Files Changed 4

+479 -1

mesh-admin commented 2026-10-09 09:59:48 +00:00

Contributor

Copy Link

Copy Source

What this is. Issue 343 records the gap: the records say some changes are made "at the controller's terminal", and on the control-node mesh-controller is not a command (zsh: command not found, 2026-10-09). ADR 0272 decides the fix. Status: accepted by the operator on 2026-10-09.

The decision, short.

• mesh-cli is a module assigned to every node; its Go bundle is unpacked into /usr/local/bin by an archive resource (no link, no copy). nox is its alias in interactive zsh (ADR 0204 shell contribution); scripts, sudo and docs say mesh-cli.
• mesh-cli <command line> holds no credential: it asks the node-engine over a local socket. The socket grants nothing; the controller judges. The node-engine reads the account from the kernel (SO_PEERCRED), refuses other namespaces, bounds each account, and asks the controller on mesh.control.<node>.cli (the machine's own subject in the writers table).
• The controller runs the line as the terminal only for the operator account on the control-node (the one node its module is assigned to; assigning that module is terminal-only, so the terminal does not follow assign). The operator account elsewhere is an ordinary call: settings lines take the settings verb's path; everything else only the generic verb's reading forms, never a terminal-only command (ADR 0266). Every other account, root and in phase 1 the agent account, is refused.
• Every line is a call, followed by the engine to its answer; "nothing ran" only of a request never asked, otherwise "not known" with the call. The answer is its asker's alone (never on the bus, never in calls).
• The local protocol is in mesh-sdk go/cli; the bus request is each side's own link code with field-name tests.

Trust today, measured. On 2026-10-09 the operator account on the control-node has passwordless sudo (sudo_rules: passwordless_all: true) and no agent account is named there, so agents running as that account could already be the terminal; mesh-cli is no wider. ADR 0266's agent account removes that.

Glossary. mesh-cli (module and command), nox (its alias), controller's terminal.

Has code. Phase 1 is built: mesh-sdk #14, mesh-host #69, mesh-controller #176, mesh-catalog #156. Merge order: #14 (merge commit, tag go/v0.1.9), pins moved to the tag, #69, #176, #156, then the operator assigns mesh-cli to every node at the terminal. This record can merge before or after them.

Checks. merge-check.sh passes locally (records, index, cycle, words with the catalogue's copy compared); the mesh's verdicts are on this PR.

**What this is.** Issue 343 records the gap: the records say some changes are made "at the controller's terminal", and on the control-node `mesh-controller` is not a command (`zsh: command not found`, 2026-10-09). ADR 0272 decides the fix. **Status: accepted** by the operator on 2026-10-09. **The decision, short.** - `mesh-cli` is a module assigned to every node; its Go bundle is unpacked into `/usr/local/bin` by an `archive` resource (no link, no copy). `nox` is its alias in interactive zsh (ADR 0204 shell contribution); scripts, `sudo` and docs say `mesh-cli`. - `mesh-cli <command line>` holds no credential: it asks the node-engine over a local socket. **The socket grants nothing; the controller judges.** The node-engine reads the account from the kernel (`SO_PEERCRED`), refuses other namespaces, bounds each account, and asks the controller on `mesh.control.<node>.cli` (the machine's own subject in the writers table). - The controller runs the line **as the terminal** only for the operator account on the control-node (the one node its module is assigned to; assigning that module is terminal-only, so the terminal does not follow `assign`). The operator account elsewhere is an **ordinary call**: settings lines take the settings verb's path; everything else only the generic verb's reading forms, never a terminal-only command (ADR 0266). Every other account, root and in phase 1 the agent account, is refused. - **Every line is a call**, followed by the engine to its answer; "nothing ran" only of a request never asked, otherwise "not known" with the call. The answer is its asker's alone (never on the bus, never in `calls`). - The local protocol is in mesh-sdk `go/cli`; the bus request is each side's own link code with field-name tests. **Trust today, measured.** On 2026-10-09 the operator account on the control-node has passwordless sudo (`sudo_rules`: `passwordless_all: true`) and no agent account is named there, so agents running as that account could already be the terminal; mesh-cli is no wider. ADR 0266's agent account removes that. **Glossary.** `mesh-cli` (module and command), `nox` (its alias), `controller's terminal`. **Has code.** Phase 1 is built: mesh-sdk #14, mesh-host #69, mesh-controller #176, mesh-catalog #156. Merge order: #14 (merge commit, tag `go/v0.1.9`), pins moved to the tag, #69, #176, #156, then the operator assigns `mesh-cli` to every node at the terminal. This record can merge before or after them. **Checks.** `merge-check.sh` passes locally (records, index, cycle, words with the catalogue's copy compared); the mesh's verdicts are on this PR.

mesh-admin added 1 commit 2026-10-09 09:59:48 +00:00

ADR 0272 (proposed) and issue 343: the controller's terminal has no command ... 95d78f7011

The records send the operator to "the controller's terminal", and on the
control-node `mesh-controller` is not a command: the controller is a mesh
process with its own account and environment, and nothing puts anything on
PATH. The record proposes mesh-cli, a module on every node whose program
asks the node-engine over a local socket; the node-engine vouches for the
account from the kernel and asks the controller on its node's own subject;
the controller runs the line as the terminal only for the operator's account
where no agent can be that account. The glossary gains mesh-cli, nox (its
zsh alias) and the controller's terminal.

mesh-admin commented 2026-10-09 10:00:13 +00:00

Author

Contributor

Copy Link

Copy Source

Delivery novox/hq@4b5793144ddc — delivered since 2026-10-09T11:39:01Z

Delivery plan — builds nothing: the change touches no module of the mesh's graph

Transitions

• 2026-10-09 11:16 (new) → proposed (announced): novox/hq#243's head announced
• 2026-10-09 11:16 proposed → checked (checked): the verdict names this commit
• 2026-10-09 11:16 checked → rejected (refused): the gate failed or could not run, or the repository's own check failed
• 2026-10-09 11:22 rejected → proposed (recheck): the check could not run: the build agent on novox could not clone hq (exit 128) — not a verdict on the change
• 2026-10-09 11:23 proposed → checked (checked): the verdict names this commit
• 2026-10-09 11:23 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-09 11:39 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-09 11:39 published → delivered (done): nothing for a walk to move

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/hq@4b5793144ddc` — **delivered** since 2026-10-09T11:39:01Z **Delivery plan** — builds nothing: the change touches no module of the mesh's graph **Transitions** - 2026-10-09 11:16 (new) → proposed (announced): novox/hq#243's head announced - 2026-10-09 11:16 proposed → checked (checked): the verdict names this commit - 2026-10-09 11:16 checked → rejected (refused): the gate failed or could not run, or the repository's own check failed - 2026-10-09 11:22 rejected → proposed (recheck): the check could not run: the build agent on novox could not clone hq (exit 128) — not a verdict on the change - 2026-10-09 11:23 proposed → checked (checked): the verdict names this commit - 2026-10-09 11:23 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-09 11:39 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-09 11:39 published → delivered (done): nothing for a walk to move The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

jschoubben added 1 commit 2026-10-09 10:01:46 +00:00

ADR 0272: say how the socket keeps ADR 0004, answer the operator and agent accounts only, and keep the bus request out of the SDK (ADR 0039) 1ad9959b16

jschoubben added 1 commit 2026-10-09 10:11:27 +00:00

ADR 0272: a path in a line is read where the controller runs 322f3aec36

jschoubben added 1 commit 2026-10-09 10:12:27 +00:00

Issue 343: phase 1 of ADR 0272 is open as four pull requests 57bb4dab74

jschoubben added 1 commit 2026-10-09 10:12:37 +00:00

Issue 343: name the node-engine's repository as an identifier e143f6b193

jschoubben added 1 commit 2026-10-09 10:13:06 +00:00

ADR 0272: the agent account's judgement comes from the engine's statement, never from the request 41060224e6

jschoubben added 1 commit 2026-10-09 10:56:45 +00:00

ADR 0272: the review's answers — every line a call, the socket grants nothing, the terminal does not follow assign, each claim and how it is checked ... bac7feca77

- §3: the node-engine vouches and decides nothing; deadline first, other
  namespaces refused, each account bounded and answered busy; the subject
  is the machine's own in the writers table.
- §4: phase 1 refuses the agent account (phase 2 answers it); an ordinary
  settings line takes the settings verb's path; the controller's module is
  assigned at the terminal only, so the terminal does not follow assign;
  'no wider than today' holds only while its two measured facts hold.
- §5: every line is a call, followed to its answer; 'nothing ran' only of
  a line nobody took, otherwise 'not known' with the call; the answer is
  its asker's alone.
- §7: after the four merge, the operator assigns mesh-cli to every node.
- How it is checked: each claim with its test or measurement, the
  MESH_VERB refusal in mesh-cli named a courtesy, and the sudo and
  agent-account facts read on the control-node today.

jschoubben added 1 commit 2026-10-09 11:02:48 +00:00

ADR 0272 accepted (the operator, 2026-10-09) d3cb9fedf4

mesh-admin changed title from ADR 0272 (proposed) and issue 343: the controller's terminal has no command; mesh-cli on every node to ADR 0272 (accepted) and issue 343: the controller's terminal has no command; mesh-cli on every node 2026-10-09 11:03:02 +00:00

jschoubben added 2 commits 2026-10-09 11:16:01 +00:00

Merge remote-tracking branch 'origin/main' into decision/0272-mesh-cli-the-operators-command 3bdd4e8040

ADR 0272: §4 as built after the confirmation review, ADR 0266 linked now it is merged ... 4b5793144d

An ordinary line meets the generic verb's reading forms and never a
terminal-only command (node account and node agent-account by ADR 0266,
token, operator, a secret's export); a terminal line drops ADR 0266's
served mark, so it reads as the terminal. How it is checked says the
withholding tests search base64 too and fail when what they guard goes,
and the control-node refusal is tested through the acts.

mesh-admin commented 2026-10-09 11:16:22 +00:00

Author

Contributor

Copy Link

Copy Source

Merge check at 4b579314

• mesh/merge-gate: ERROR — the check could not run: cannot clone http://novox.internal:20000/novox/hq.git: git -c credential.helper= -c credential.helper=store --file=/var/lib/build-agent/workspace/git-credentials clone --quiet http://novox.internal:20000/novox/hq.git hq: exit status 128
• mesh/repo-check: ERROR — the check could not run: cannot clone http://novox.internal:20000/novox/hq.git: git -c credential.helper= -c credential.helper=store --file=/var/lib/build-agent/workspace/git-credentials clone --quiet http://novox.internal:20000/novox/hq.git hq: exit status 128

Run by the build seat on novox as build-1791544571694173272 (builds --log build-1791544571694173272).

**Merge check** at `4b579314` - `mesh/merge-gate`: **ERROR** — the check could not run: cannot clone http://novox.internal:20000/novox/hq.git: git -c credential.helper= -c credential.helper=store --file=/var/lib/build-agent/workspace/git-credentials clone --quiet http://novox.internal:20000/novox/hq.git hq: exit status 128 - `mesh/repo-check`: **ERROR** — the check could not run: cannot clone http://novox.internal:20000/novox/hq.git: git -c credential.helper= -c credential.helper=store --file=/var/lib/build-agent/workspace/git-credentials clone --quiet http://novox.internal:20000/novox/hq.git hq: exit status 128 Run by the build seat on novox as `build-1791544571694173272` (`builds --log build-1791544571694173272`).

mesh-admin merged commit 54d974f178 into main 2026-10-09 11:38:36 +00:00

mesh-admin deleted branch decision/0272-mesh-cli-the-operators-command 2026-10-09 11:38:37 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Assignees

Clear assignees

jschoubben miel.truyen

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#243