novox/mesh-catalog
6
0
Fork 0
Code Issues Pull Requests 5 Actions Packages Projects Releases Wiki Activity
1,230 Commits 14 Branches 0 Tags
33ee89794e073b7007cf12699660306349ec4ee5
Commit Graph
4 Commits
Author SHA1 Message Date
jochen b382045721 Merge remote-tracking branch 'origin/main' into feat/the-agent-account-is-declared
mesh/merge-gate pass: builds claude-code, claude-licence-manager, restic, sudo → ace, g14, novox, shanks; no bus step; every machine composes with the chan…
Details
mesh/repo-check pass: THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; it…
Details
mesh/delivery superseded: a newer head of the same pull request
Details
2026-10-09 23:37:04 +02:00
jochen debb897c21 Run the router as its own account, ask unlinking of the linked account, and take no approval where an agent can become root (hq ADR 0259 §7, §8) 2026-10-09 17:08:17 +02:00
jochen 9afea75f93 sudo: give every command run through sudo a terminal of its own 
An agent the operator starts as the agent account through sudo (hq ADR 0266)
would otherwise share the operator's terminal and could push keystrokes into
their shell after it ends. sudo still runs without a terminal for the mesh's
own tools, so nothing they do changes.
 2026-10-09 10:14:25 +02:00
jochen f015aba34a sudo: declare the operator account's passwordless escalation as a module 
Three modules' tools act through `sudo -n` and nothing declared that the
account may; each machine said so in a hand-set line in /etc/sudoers. The
module owns the package and /etc/sudoers.d/10-mesh-operator (0440), checked
by visudo in its manifest test, and serves sudo_rules, sudo_check and
sudo_drop_ins from a Go bundle. lab stops declaring the sudo package, which
would collide with this module on the node that runs both (hq ADR 0207,
to-be 42 Phase 1).
 2026-10-04 12:50:20 +02:00