jochen 17b0ac9f6c claude-code: declare the account agents run as and the command that starts it ...

The control node is to run its agents under an account that cannot become root
(hq ADR 0266). Declare it as a user the node-engine judges root: never, put the
agent's directory in its home, and place claude-agent so the operator starts a
session there through their own sudo. Where no agent account is named, both
name the operator's account, as before.

2026-10-09 10:14:25 +02:00

..

adwaita

adwaita: the theme as a module, dark by default, for GTK, Qt, the portal and the cursor (hq ADR 0208)

2026-10-04 13:21:47 +02:00

artifact-store-tools

Count a platform manifest as its index's, and list the unrecorded copies of upstream images

2026-10-08 14:11:02 +02:00

asus-zephyrus-g14

Say the laptop's scripts unparsed where the build seat has no bash

2026-10-08 16:20:45 +02:00

audit-logger

audit-logger, model-usage: retry a failed write and never lose the event (hq issue 276)

2026-10-06 18:36:16 +02:00

avahi

avahi: the discovery daemon declared, and why it hears nothing reported

2026-10-04 12:50:20 +02:00

baserow

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

blueman

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

bluetooth

Add nextcloud-client and blueman: the two tray apps get an owner and tools, each with one start

2026-10-05 11:47:38 +02:00

build-agent

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

ca-trust

ca-trust: a machine trusts the mesh's authority because a module put its root there

2026-09-29 15:07:40 +02:00

claude-code

claude-code: declare the account agents run as and the command that starts it

2026-10-09 10:14:25 +02:00

claude-licence-manager

Test that a sealed grant hides its words, not two letters

2026-10-09 10:14:18 +02:00

clipmenu

i3: other modules' lines are contributions to node-display-session (hq ADR 0212)

2026-10-05 10:11:27 +02:00

confluence

The seven say what the runtime loads from their tools bundle (hq ADR 0192)

2026-10-03 15:58:19 +02:00

cups

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

dbus

dbus: hold node-message-bus, and never restart the bus live (hq ADR 0215)

2026-10-05 11:50:52 +02:00

de-spiegel

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

disk-load

Add disk-load: no tool said a machine's iowait, disk load or who does the I/O (hq issue 312)

2026-10-08 10:47:41 +02:00

distribution

Move the artifact store's tools into a module beside it, as the controller requires

2026-10-08 12:04:33 +02:00

dmenu

dmenu: the package, which makes the notifier's menu work, and a menu tool (hq to-be 42 phase 2.7)

2026-10-04 13:02:23 +02:00

dnsmasq

Say which modules wait for a person's push, and announce the files a merge deleted (hq ADR 0236)

2026-10-06 18:39:13 +02:00

docker

docker: remove images no container or declaration uses, keeping the previous of each line (hq ADR 0251)

2026-10-08 11:56:43 +02:00

docker-compose

docker-compose: the package, and its projects as tools (hq to-be 42 phase 2.9)

2026-10-04 13:02:23 +02:00

dunst

Say that nothing trusts dunst's and xdg's settings, so a verb may still change them

2026-10-09 01:42:23 +02:00

fail2ban

fail2ban: its tools in Go

2026-10-05 12:01:25 +02:00

feh

i3: other modules' lines are contributions to node-display-session (hq ADR 0212)

2026-10-05 10:11:27 +02:00

flatpak

flatpak: the package, Flathub with it, and the installations as tools (hq to-be 42 phase 2.9)

2026-10-04 13:02:23 +02:00

fonts

fonts: the five decided faces as packages, and what the generic families mean (hq to-be 42 phase 2.1)

2026-10-04 13:02:23 +02:00

forticlient

forticlient: hand the client's resolver file to the machine's own resolver (hq ADR 0247)

2026-10-07 21:35:50 +02:00

gitea

The forge module's tool list test names the statuses and contains tools

2026-10-09 03:23:19 +02:00

gitlab

The seven say what the runtime loads from their tools bundle (hq ADR 0192)

2026-10-03 15:58:19 +02:00

gnome-keyring

gnome-keyring: the secret service as a module, claiming node-secret-service (hq ADR 0208, ADR 0102)

2026-10-04 13:15:39 +02:00

grafana

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

hello-web

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

home-assistant

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

hostname

Rename hosts to hostname, which also writes /etc/hostname (hq ADR 0223)

2026-10-05 23:43:14 +02:00

i3

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

i3status-rust

Keep the value a watch hands over at once, watch a dead watch again, and let the path lists grow only in the open (hq ADR 0260)

2026-10-08 16:12:37 +02:00

icecast

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

influxdb

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

invoicing

minio declares the bucket it derives; its consumers stop transcribing it (hq ADR 0188)

2026-10-04 02:34:06 +02:00

jira

The seven say what the runtime loads from their tools bundle (hq ADR 0192)

2026-10-03 15:58:19 +02:00

keycloak

Keep secrets off command lines the runtime records (hq issue 282)

2026-10-07 01:37:21 +02:00

lab

Hold what the tools say to the glossary's retired words (hq ADR 0244)

2026-10-07 20:02:09 +02:00

lemurs

lemurs, clipmenu: X keeps its resources, and an image in the clipboard is never read as text

2026-10-04 16:34:02 +02:00

letta

Mark the OpenAI keys letta and supabase hold as issued outside the mesh

2026-10-06 12:13:57 +02:00

local-model-consumer

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

localization

localization: locale, time zone and console keymap as one module

2026-10-04 12:50:20 +02:00

logrotate

logrotate: rotation on every machine, its base configuration owned

2026-10-04 12:50:20 +02:00

mailu

Name the hq issue by its number: 294 was taken on an open branch, this is 295

2026-10-07 19:28:54 +02:00

marrytts

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

matrix

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

memory-pressure

Phase 3: asus-zephyrus-g14 and memory-pressure, with Go tools and long-running code

2026-10-04 15:42:56 +02:00

mesh-catalog

audit-logger, model-usage: retry a failed write and never lose the event (hq issue 276)

2026-10-06 18:36:16 +02:00

mesh-delivery

Cover a held merge only when the forge says a later delivered merge contains it (review of #150)

2026-10-09 02:57:18 +02:00

mesh-vault

audit-logger, model-usage: retry a failed write and never lose the event (hq issue 276)

2026-10-06 18:36:16 +02:00

mesh-watcher

messenger: never say history as news — read the open conditions first, coalesce bursts

2026-10-06 12:03:19 +02:00

messenger

Load the records the live build kept, remind every quiet warning, silence only its own condition

2026-10-08 14:53:11 +02:00

minio

The derived-value record is ADR 0202 (was 0201)

2026-10-08 01:42:16 +02:00

model-usage

audit-logger, model-usage: retry a failed write and never lose the event (hq issue 276)

2026-10-06 18:36:16 +02:00

mongodb

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

mosquitto

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

mounts

Say that the modules' own checks are the only line before root, since sudo grants the account everything

2026-10-08 20:21:28 +02:00

mssql

Say which modules wait for a person's push, and announce the files a merge deleted (hq ADR 0236)

2026-10-06 18:39:13 +02:00

n8n

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

nats

Read the tested nats release from the server itself

2026-10-08 18:07:29 +02:00

netcheck

netcheck: one module, a Go tools bundle and a TypeScript one (hq ADR 0188, 0193)

2026-10-04 00:34:31 +02:00

networkmanager

Serve the uplink seat's verbs from both of its holders (hq ADR 0241)

2026-10-07 19:19:52 +02:00

nextcloud

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

nextcloud-client

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

nfs-server

Let nfs-server's tests see their folders as the library owner's, so the root refusal is tested and not tripped when the build seat runs them as root

2026-10-08 21:05:52 +02:00

nftables

Hold what the tools say to the glossary's retired words (hq ADR 0244)

2026-10-07 20:02:09 +02:00

nm-applet

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

node-env

node-env: the account's environment as one module's two files

2026-10-04 03:59:50 +02:00

nodered

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

ollama

Bound the holder's measuring; dump the database platform (hq ADR 0233)

2026-10-06 17:00:23 +02:00

only-office

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

openai-consumer

openai-consumer: its apply is a scheduled process (hq ADR 0198)

2026-10-04 00:52:31 +02:00

openrazer

Declare the operator's account in the openrazer group (hq ADR 0252, issue 247)

2026-10-08 12:04:08 +02:00

pacman

pacman: the package manager's configuration, mirrors and cache as a module

2026-10-04 12:50:20 +02:00

photos-eef

The photo clients publish the endpoint they declare (hq issue 227)

2026-10-04 12:25:28 +02:00

photos-filip

The photo clients publish the endpoint they declare (hq issue 227)

2026-10-04 12:25:28 +02:00

picom

picom: the compositor as a module, claiming node-compositor (hq ADR 0208)

2026-10-04 13:15:39 +02:00

polychromatic

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

postgres

Report as revoked only what the read-back shows gone, and take back what the reader passed on (review of hq issue 337)

2026-10-08 22:11:06 +02:00

power

Follow bar values so a dead watch speaks, date them by their reading, and widen the path check (hq ADR 0260)

2026-10-08 16:12:37 +02:00

powerlevel10k

powerlevel10k: the prompt as a pinned archive of the module's own, loaded from a slot

2026-10-04 04:04:10 +02:00

records

records: list the decision records by topic when asked, since hq stores no list (hq ADR 0248)

2026-10-07 23:38:13 +02:00

redis

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

restic

restic: restore away from a directory another account owns

2026-10-09 10:14:18 +02:00

rofi

i3: other modules' lines are contributions to node-display-session (hq ADR 0212)

2026-10-05 10:11:27 +02:00

route-adapter

Fold public-acme into route-proxy; drop dhcpcd and cloudflare-dns (hq ADR 0226)

2026-10-06 14:59:43 +02:00

route-proxy

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

screen-lock

screen-lock: recognise the colour build by its version scheme; its version line never says color

2026-10-04 17:07:40 +02:00

searxng

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

sensors

sensors: take a SAS drive's standby, whose mode holds spaces

2026-10-08 15:04:02 +02:00

showcase

audit-logger, model-usage: retry a failed write and never lose the event (hq issue 276)

2026-10-06 18:36:16 +02:00

slack

Hold what the tools say to the glossary's retired words (hq ADR 0244)

2026-10-07 20:02:09 +02:00

snapd

snapd: tools for the snaps, the package blocked on the mesh's AUR repository (hq to-be 42 phase 2.9)

2026-10-04 13:02:23 +02:00

ssh-client

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

sshd

Say which modules wait for a person's push, and announce the files a merge deleted (hq ADR 0236)

2026-10-06 18:39:13 +02:00

step-ca

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

sudo

sudo: declare the operator account's passwordless escalation as a module

2026-10-04 12:50:20 +02:00

supabase

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

systemd

Record a removal's outcome, publish it, and read one directory once

2026-10-08 17:55:56 +02:00

systemd-networkd

Serve the uplink seat's verbs from both of its holders (hq ADR 0241)

2026-10-07 19:19:52 +02:00

systemd-resolved

systemd-resolved: say when a route's domains do cross the bus

2026-10-07 21:35:49 +02:00

time-sync

time-sync: one time daemon, timesyncd, with its servers declared

2026-10-04 12:50:20 +02:00

triggerhappy

triggerhappy: the machine's hotkeys as a module holding node-hotkeys (hq ADR 0212)

2026-10-04 16:50:57 +02:00

umami

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

unifi

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

website

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

xclip

xclip: the package, and the operator's clipboard from the mesh (hq to-be 42 phase 2.7)

2026-10-04 13:02:23 +02:00

xdg

Say that nothing trusts dunst's and xdg's settings, so a verb may still change them

2026-10-09 01:42:23 +02:00

xorg

xorg: the display server holds node-display-server and writes the session's start (hq ADR 0208)

2026-10-04 13:21:47 +02:00

xterm

xterm: the terminal holds node-terminal-emulator; its resources through xorg's slot (hq ADR 0208)

2026-10-04 13:21:47 +02:00

zfs

Keep the scheduled run's served slot in a folder of root's alone, written never through a link

2026-10-09 01:55:54 +02:00

zsh

zsh: let a machine withhold node-login-shell's execute

2026-10-09 00:10:28 +02:00

zsh-autosuggestions

zsh-autosuggestions, zsh-syntax-highlighting: the plugins as packages and one line each

2026-10-04 04:04:35 +02:00

zsh-syntax-highlighting

zsh-autosuggestions, zsh-syntax-highlighting: the plugins as packages and one line each

2026-10-04 04:04:35 +02:00