8 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	c5dee506d2	messenger: move to mesh-sdk go/v0.1.10, the tag of mesh-sdk #12's merge	2026-10-09 16:24:14 +02:00
jschoubben	4a56294633	messenger: an early desk unlink bars nothing, root lifts any bar, no root-free ask inside the work, no button without its effect (the confirmation review of 2026-10-09) ... N1-router: another account's /start offered the desk an unlink of the operator's account in its first hour, and a desk click, which a program on the desk machine can forge, unlinked it and barred it for a day, again and again. An unlink at the desk in the first hour now bars nothing: any account, the operator's too, links again at once with a code from the desk; the day's bar stays for an account removed by its own approval or by root, and root's allow-link lifts any bar. The words say which. Lows: the controller's root-free word is asked before the work is taken (it waited up to 10 s inside it) and the answer is judged with that fresh word; inside the work only a recent word is read, and a failed ask drops the old one. An answer whose effect the content rule withholds is not offered. mesh-sdk moves to 16984aa. Each test failed before its fix.	2026-10-09 14:03:41 +02:00
jschoubben	5287224b5b	messenger: approve only on the controller's recent word that root is free, and close the review's gaps (hq ADR 0259) ... The review of 2026-10-09: the router read the absence of an agent-root condition as a pass, and its minute hung on a break-glass file, taking the work it already held. An approval now rests on the controller's verb root-free, asked live for the router's machine and the channel's, failing closed on every other answer, and a stale word on the kinds promises no verified sender. Break-glass runs in the minute, says on every channel what root did, and ends the router's own open questions. An ask offering an approval is answered only where it could be approved; a message says who asks, what each answer does and what expiry does. The router's own asks bind the account they are about; a link is checked against one per kind as it is made; an unlinked account does not come back by a code within a day; a fresh link is unlinked from the desk; no link begins while the desk cannot show its code, and a code is marked secret on every path. Links are bounded per account in the router's state; a warrant's message id cannot be foreseen. Moves to mesh-sdk 76902998 (canonical digests).	2026-10-09 14:03:41 +02:00
jschoubben	8b375658ca	messenger: name the ask's digest in every warrant, and bind the router's own asks to their act (hq ADR 0259 §6) ... A warrant now carries the digest of the ask exactly as the router took it, so its asker acts only for the ask the person was shown, with what each option binds. The router refuses an ask whose approving option binds nothing (the SDK's Check). Its own unlink and relink asks bind the act they perform, and it performs that act only on a warrant for that ask. mesh-sdk moves to d4077b4.	2026-10-09 14:03:41 +02:00
jochen	9a91fb966f	Show a link's code as a message no channel keeps	2026-10-09 14:03:41 +02:00
jochen	ec9b62e01a	Run the router as its own account, ask unlinking of the linked account, and take no approval where an agent can become root (hq ADR 0259 §7, §8)	2026-10-09 14:03:41 +02:00
jochen	336a5e87eb	Make the messenger the router: it holds every ask, judges each answer and issues the warrant its asker acts on, and keeps no channel's client (hq ADR 0259)	2026-10-09 14:03:41 +02:00
jochen	0ae7933d54	Tell the operator what the mesh finds wrong, and watch the watcher (hq to-be 45 phase 1) ... The mesh noticed 48 core failures in six days and told nobody (ADR 0227). messenger holds the operator-channel seat: it consumes the controller's condition events and sends them to Telegram and the desktop notifier, deduplicated by key, reminded once, edited on clear, capped at 20 an hour with the rest folded, and refusing anything carrying an address, a path or a secret. mesh-watcher, on a machine other than the control node, sends to Telegram directly when the self-check heartbeat or the bus goes silent.	2026-10-06 09:35:55 +02:00