Run the router as its own account, ask unlinking of the linked account, and take no approval where an agent can become root (hq ADR 0259 §7, §8)

modules/sudo/cmd/sudo-tools/main.go

@@ -44,6 +44,26 @@ func tools(m *Machine) []stdio.Tool {
 			Input: schema(map[string]any{}),
 			Run:   func(map[string]any) (any, error) { return m.CheckEscalation() },
 		},
+		{
+			Name: "sudo_escalation",
+			Description: "Can these accounts become root on this machine without a person: a sudo rule running every " +
+				"command as root with no password, or a group that is root by another name (docker, disk). Each " +
+				"account with yes or no and why. Asked by the self-check where the router or a channel proving its " +
+				"sender runs (novox/hq ADR 0259).",
+			Input: schema(map[string]any{"accounts": map[string]any{"type": "array", "items": map[string]any{"type": "string"},
+				"description": "the accounts to judge"}}),
+			Run: func(a map[string]any) (any, error) {
+				var accounts []string
+				if list, ok := a["accounts"].([]any); ok {
+					for _, x := range list {
+						if s, ok := x.(string); ok {
+							accounts = append(accounts, s)
+						}
+					}
+				}
+				return m.Escalations(accounts)
+			},
+		},
 		{
 			Name: "sudo_drop_ins",
 			Description: "The files of /etc/sudoers.d with owner, mode and size, whether sudo reads each (a name with a dot " +