novox/mesh-controller
6
0
Fork 0
Code Issues Pull Requests 3 Releases Wiki Activity

Hold a private kind's holder to an account of its own, as a verified one is (hq ADR 0259 §7, §8)

Browse Source 
A private kind is where the router shows a link's code, and the code makes an account the operator's.
Registration refused a verified-sender holder on the machine's runtime and let a private one stand;
it now refuses both (the confirmation review of 2026-10-09, low).
This commit is contained in:
jschoubben
2026-10-09 13:51:54 +02:00
parent 983bf65141
commit 5866b2db94
2 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/catalogue/kinded_test.go
+7
View File
@@ -134,6 +134,13 @@ func TestATrustedHolderMustRunAsAnAccountOfItsOwn(t *testing.T) {
if got := problemsFor(t, Shelf{"messenger": router(), "desk-channel": desk}); got != "" {
t.Errorf("a channel proving nothing was held to it: %s", got)
}
// A kind that is `private` shows a link's code, which links an account as the operator: its holder is
// trusted with it, so it runs as its own account too (the confirmation review of 2026-10-09).
private := aChannel("desk-channel", "desktop")
private.Claims[0].Capabilities = []string{"choice", "private"}
if got := problemsFor(t, Shelf{"messenger": router(), "desk-channel": private}); !strings.Contains(got, "desk-channel must run as an account of its own") {
t.Errorf("a private channel on the machine's runtime stood: %s", got)
}
}
func TestRunsAsIsAnAccountOfTheModulesOwn(t *testing.T) {
internal/catalogue/seats_declared.go
+7 -2
View File
@@ -466,7 +466,8 @@ func RunsAsProblems(m Manifest) []string {
// TrustedHolding is why a module must run as its own account (novox/hq ADR 0259 §8), or "": it holds a seat
// whose events it says to one caller each (a warrant), or speaks for a kind of a kinded bench that proves
// its sender. Neither may be carried by the machine's runtime, which runs as the operator's account.
// its sender, or is private (a link's code is shown there). None may be carried by the machine's runtime, which
// runs as the operator's account.
func TrustedHolding(m Manifest, declared map[string]SeatDeclaration) string {
for _, c := range m.Claims {
s, ok := declared[c.Name]
@@ -480,8 +481,12 @@ func TrustedHolding(m Manifest, declared map[string]SeatDeclaration) string {
}
if s.Kinded {
for _, capability := range c.Capabilities {
if capability == "verified-sender" {
switch capability {
case "verified-sender":
return fmt.Sprintf("it holds %s of kind %s, which proves its sender", c.Name, c.Kind)
case "private":
// A private kind is shown a link's code, which makes an account the operator's.
return fmt.Sprintf("it holds %s of kind %s, which is private: a link's code is shown there", c.Name, c.Kind)
}
}
}