6 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	ad8f13eaee	messenger: approve only on the controller's recent word that root is free, and close the review's gaps (hq ADR 0259) ... The review of 2026-10-09: the router read the absence of an agent-root condition as a pass, and its minute hung on a break-glass file, taking the work it already held. An approval now rests on the controller's verb root-free, asked live for the router's machine and the channel's, failing closed on every other answer, and a stale word on the kinds promises no verified sender. Break-glass runs in the minute, says on every channel what root did, and ends the router's own open questions. An ask offering an approval is answered only where it could be approved; a message says who asks, what each answer does and what expiry does. The router's own asks bind the account they are about; a link is checked against one per kind as it is made; an unlinked account does not come back by a code within a day; a fresh link is unlinked from the desk; no link begins while the desk cannot show its code, and a code is marked secret on every path. Links are bounded per account in the router's state; a warrant's message id cannot be foreseen. Moves to mesh-sdk 76902998 (canonical digests).	2026-10-09 12:11:23 +02:00
jschoubben	9e4f7fbe50	messenger: name the ask's digest in every warrant, and bind the router's own asks to their act (hq ADR 0259 §6) ... A warrant now carries the digest of the ask exactly as the router took it, so its asker acts only for the ask the person was shown, with what each option binds. The router refuses an ask whose approving option binds nothing (the SDK's Check). Its own unlink and relink asks bind the act they perform, and it performs that act only on a warrant for that ask. mesh-sdk moves to d4077b4.	2026-10-09 10:17:15 +02:00
jochen	775eb04a09	Show a link's code as a message no channel keeps	2026-10-09 10:16:17 +02:00
jochen	ac9de9b9cd	Run the router as its own account, ask unlinking of the linked account, and take no approval where an agent can become root (hq ADR 0259 §7, §8)	2026-10-09 10:16:17 +02:00
jochen	0cb000f358	Make the messenger the router: it holds every ask, judges each answer and issues the warrant its asker acts on, and keeps no channel's client (hq ADR 0259)	2026-10-09 10:16:17 +02:00
jochen	0ae7933d54	Tell the operator what the mesh finds wrong, and watch the watcher (hq to-be 45 phase 1) ... The mesh noticed 48 core failures in six days and told nobody (ADR 0227). messenger holds the operator-channel seat: it consumes the controller's condition events and sends them to Telegram and the desktop notifier, deduplicated by key, reminded once, edited on clear, capped at 20 an hour with the rest folded, and refusing anything carrying an address, a path or a secret. mesh-watcher, on a machine other than the control node, sends to Telegram directly when the self-check heartbeat or the bus goes silent.	2026-10-06 09:35:55 +02:00