Refuse a node's accounts through any verb, and a stale or service-account agent verdict

The generic command verb ran node account and node agent-account, so an agent
could name itself the operator account and have the next send grant it root
(hq ADR 0266 review). Refuse every node subcommand but list and show through
any verb; refuse the operator account as the agent account in both
directions and well-known service accounts as an agent account; and count a
verdict heard more than 15 minutes ago as not judged, so stopping the
node-engine cannot freeze a healthy one. Re-pin mesh-host to its review head.

cmd/mesh-controller/agent_account.go

@@ -27,6 +27,7 @@ import (
 	"fmt"
 	"sort"
 	"strings"
+	"time"
 
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
@@ -60,16 +61,27 @@ func agentConfined(ctx context.Context, inv *inventory.Inventory, node string) (
 	if err != nil {
 		return true, false, "", err
 	}
-	confined, why = judgedConfined(n.AgentAccount, h, had)
+	confined, why = judgedConfined(n.AgentAccount, h, had, time.Now())
 	return true, confined, why, nil
 }
 
-// judgedConfined is the judgement over one statement, without the store.
-func judgedConfined(agent string, h inventory.NodeHealth, had bool) (bool, string) {
+// verdictFreshFor is how old the statement holding the verdict may be, by this controller's clock. A
+// node-engine states its health on every change and at least every five minutes (mesh-host's sayAnyway), so
+// three statements missed is a node-engine stopped, or a machine away. **A stale verdict is not a pass**: an
+// agent that stopped the node-engine must not leave "cannot become root" standing from before.
+const verdictFreshFor = 15 * time.Minute
+
+// judgedConfined is the judgement over one statement, without the store, at now.
+func judgedConfined(agent string, h inventory.NodeHealth, had bool, now time.Time) (bool, string) {
 	if !had {
 		return false, fmt.Sprintf("the agent account %s is not judged: the machine's node-engine has stated "+
 			"nothing of what it runs", agent)
 	}
+	if age := now.Sub(h.HeardAt); age > verdictFreshFor {
+		return false, fmt.Sprintf("the agent account %s is not judged: the machine's newest statement was heard at "+
+			"%s, more than %d minutes ago, and a verdict that old is not a verdict on now", agent,
+			h.HeardAt.Local().Format("2006-01-02 15:04"), int(verdictFreshFor.Minutes()))
+	}
 	if h.Contract < link.RootContract {
 		return false, fmt.Sprintf("the agent account %s is not judged: the machine's node-engine is older than "+
 			"the judging of an account's root (its statement's contract is %d, the judging is %d)",
@@ -122,7 +134,7 @@ func probeAgentAccounts(ctx context.Context, d *doctor) ([]conditions.Observatio
 		if err != nil {
 			return nil, err
 		}
-		confined, why := judgedConfined(n.AgentAccount, h, had)
+		confined, why := judgedConfined(n.AgentAccount, h, had, time.Now())
 		if confined {
 			continue
 		}

cmd/mesh-controller/agent_account_test.go

@@ -22,7 +22,7 @@ func TestAnAgentAccountIsConfinedOnlyOnAHealthyVerdictJudgedForRoot(t *testing.T
 			Kind: link.KindAccount, Target: target, State: state, Reason: reason, Root: root, Account: target}
 	}
 	statement := func(contract int, rs ...inventory.ResourceHealth) inventory.NodeHealth {
-		return inventory.NodeHealth{Node: "anchor", Contract: contract, SaidAt: at, Resources: rs}
+		return inventory.NodeHealth{Node: "anchor", Contract: contract, SaidAt: at, HeardAt: at, Resources: rs}
 	}
 	for _, c := range []struct {
 		name     string
@@ -45,11 +45,21 @@ func TestAnAgentAccountIsConfinedOnlyOnAHealthyVerdictJudgedForRoot(t *testing.T
 		{"a verdict on another account", statement(link.RootContract, verdict("ops", link.RootNever, link.StateHealthy, "")),
 			true, false, "no verdict on it"},
 	} {
-		confined, why := judgedConfined("agent", c.h, c.had)
+		confined, why := judgedConfined("agent", c.h, c.had, at.Add(time.Minute))
 		if confined != c.confined || !strings.Contains(why, c.says) {
 			t.Errorf("%s: confined %v, %q; want %v saying %q", c.name, confined, why, c.confined, c.says)
 		}
 	}
+	// A verdict heard longer ago than the bound is no verdict: an agent that stopped the node-engine must not
+	// leave "healthy" standing.
+	fresh := statement(link.RootContract, verdict("agent", link.RootNever, link.StateHealthy, ""))
+	if ok, _ := judgedConfined("agent", fresh, true, at.Add(verdictFreshFor)); !ok {
+		t.Error("a verdict exactly at the bound is still one")
+	}
+	if ok, why := judgedConfined("agent", fresh, true, at.Add(verdictFreshFor+time.Second)); ok ||
+		!strings.Contains(why, "not judged") {
+		t.Errorf("a stale healthy verdict passed: %q", why)
+	}
 }
 
 // DA raises an urgent condition, with plain words, on a machine whose agent account is not judged unable to
@@ -146,6 +156,35 @@ func TestTheFactsCarryTheAgentAccountAsAPseudonym(t *testing.T) {
 	}
 }
 
+// No verb runs a `node` command that sets something: through the generic `command` verb, `node account`,
+// `node agent-account` and every other `node` subcommand but list and show are refused, naming the terminal.
+func TestNoVerbSetsANodesAccounts(t *testing.T) {
+	for _, line := range []string{
+		"node agent-account novox --clear",
+		"node agent-account novox ops",
+		"node account novox agent",
+		"node account novox",
+		"node add intruder",
+		"node public-domain novox --clear",
+		"node",
+		"node frobnicate",
+	} {
+		argv, err := argvFor("command", map[string]any{"command": line})
+		if err == nil || !strings.Contains(err.Error(), "controller's terminal only") ||
+			!strings.Contains(err.Error(), "ADR 0266") {
+			t.Errorf("%q ran as %v (%v); want a refusal naming the terminal", line, argv, err)
+		}
+	}
+	for _, line := range []string{"node show novox", "node list --json", "status --json"} {
+		if _, err := argvFor("command", map[string]any{"command": line}); err != nil {
+			t.Errorf("%q, a read, was refused: %v", line, err)
+		}
+	}
+	if err := terminalOnly([]string{"node", "account", "a", "b"}); err == nil {
+		t.Error("the refusal is not only the command verb's")
+	}
+}
+
 // Naming the agent account is the controller's terminal's alone: the `node` verb only shows.
 func TestTheNodeVerbOnlyShows(t *testing.T) {
 	argv, err := argvFor("node", map[string]any{"node": "anchor"})

cmd/mesh-controller/seatverbs.go

@@ -55,6 +55,9 @@ func argvFor(verb string, args map[string]any) ([]string, error) {
 		return nil, err
 	}
 	argv, err := a.commandLine()
+	if err == nil {
+		err = terminalOnly(argv)
+	}
 	if len(a.misread) > 0 {
 		// The table and the command line disagree: the verb reads an argument no caller can see
 		// in its schema, so no caller could ever pass it.
@@ -1324,3 +1327,27 @@ func seatAnnouncement(handlers map[string]link.ToolHandler) micro.Info {
 		Endpoints:   endpoints,
 	}
 }
+
+// nodeReads are the `node` subcommands a verb may run: the ones that only read.
+var nodeReads = map[string]bool{"list": true, "show": true}
+
+// terminalOnly refuses, through any verb, a command that is the operator's at the controller's terminal
+// alone (novox/hq ADR 0266). **Every `node` subcommand that is not a read**: `node account` and
+// `node agent-account` above all. Whoever may call a verb includes agents, and an agent that named itself
+// the operator account, or cleared the agent account, would have the next send grant it root through the
+// sudo module's rule. An allow list, so a subcommand added later is refused until it is judged a read.
+func terminalOnly(argv []string) error {
+	if len(argv) == 0 || argv[0] != "node" {
+		return nil
+	}
+	if len(argv) > 1 && nodeReads[argv[1]] {
+		return nil
+	}
+	sub := "node"
+	if len(argv) > 1 {
+		sub += " " + argv[1]
+	}
+	return fmt.Errorf("%s is run at the controller's terminal only, never through a verb: a node's accounts "+
+		"decide who may become root on it (novox/hq ADR 0266). A verb may run node list and node show. "+
+		"Nothing was done", sub)
+}

cmd/mesh-controller/seatverbs_test.go

@@ -237,19 +237,19 @@ func TestAJSONVerbsAnswerIsItsStandardOutput(t *testing.T) {
 	}
 }
 
-// `command` is the generic verb: the command line as given, split as a shell would, nothing added —
-// so an operator's `node account g14 jochen` is one call through the console rather than a shell on
-// the control node (novox/hq ADR 0154, ADR 0175).
+// `command` is the generic verb: the command line as given, split as a shell would, nothing added
+// (novox/hq ADR 0154, ADR 0175). It once carried an operator's `node account g14 jochen` too; a node's
+// accounts are the controller's terminal's alone since ADR 0266 (TestNoVerbSetsANodesAccounts).
 func TestCommandRunsTheLineAsGiven(t *testing.T) {
-	argv, err := argvFor("command", map[string]any{"command": "node account g14 jochen"})
-	if err != nil || strings.Join(argv, " ") != "node account g14 jochen" {
+	argv, err := argvFor("command", map[string]any{"command": "node show g14"})
+	if err != nil || strings.Join(argv, " ") != "node show g14" {
 		t.Fatalf("a plain line: %v %v", argv, err)
 	}
 	argv, err = argvFor("command", map[string]any{"command": `settings set dnsmasq '{"a": "b c"}' --node ace`})
 	if err != nil || len(argv) != 6 || argv[3] != `{"a": "b c"}` {
 		t.Fatalf("a quoted word stays one word: %q %v", argv, err)
 	}
-	argv, err = argvFor("command", map[string]any{"command": `node add "the box" --adopted`})
+	argv, err = argvFor("command", map[string]any{"command": `module show "the box" --json`})
 	if err != nil || len(argv) != 4 || argv[2] != "the box" {
 		t.Fatalf("double quotes group: %q %v", argv, err)
 	}