novox/mesh-catalog
13
0
Fork 0
Code Issues Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Run the router as its own account, ask unlinking of the linked account, and take no approval where an agent can become root (hq ADR 0259 §7, §8)

Browse Source
This commit is contained in:
jochen
2026-10-09 17:08:17 +02:00
committed by jschoubben
parent c2c75ceb3b
commit debb897c21
20 changed files with 937 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/messenger/README.md
+15 -3
View File
@@ -36,9 +36,21 @@ channel's client and no channel's secret.
linked an hour or more. The ask is then closed by compare-and-set — a second answer loses — and the
warrant published to the asker alone. A warrant the bus did not take is published again every minute.
- **An ask never defaults**: at its expiry it ends `expired` and its asker does what it said it would.
- **Linking** (`/start` to the bot): a six-digit code is shown on the desk for ten minutes, the operator
sends it to the bot, and the account is linked; it acknowledges at once and approves after an hour.
Every link and unlink is said on every channel. `messenger_unlink` unlinks.
- **Linking** (`/start` to the bot): a six-digit code is shown, with the account's name and number, on a
channel whose words stay private (the desk) for ten minutes; the operator sends it to the bot, and the
account is linked. It acknowledges at once and approves after an hour. At most three links are asked of a
kind in an hour. Every link and unlink is said on every channel.
- **Unlinking is asked of the account that is linked** (`messenger_unlink` asks it): an approve question put
to that account alone. Its approval unlinks it, told to it first, by name, then everywhere. **A link within
a day of an unlink waits for the replaced account's approval**, asked of it by name.
- **When that account is lost with its phone**, root at the router's machine leaves a file in this module's
state directory — `unlink.<kind>`, or `allow-link.<kind>` for a link that waits — and the router does it,
announced as done at the machine. A file not made by root is refused and said.
- **A channel proving its sender says only to the linked account**: none linked, it is not ready, and asks
for approval are not offered on it. While the controller says an agent can become root without a person
where the router or the channel runs (`agent-root`), no approval is offered or taken there.
- **The router runs as its own account `messenger`, on a bus account of its own**, never carried by the
machine's runtime (ADR 0259 §8): its state and its bus credential are that account's.
## What is sent, and when