Count the login shell where its execute is served, not where its seat is held (hq ADR 0268)

The control-node withholds execute through its holder's setting since ADR 0268, so probe D-root read a
closed path as open. It now counts the verb as served while the holder's setting for that machine is
serve, or the bus hears execute answered there, or the bus could not be asked: a withheld value not yet
pushed, or a holder answering against its setting, is never taken for closed.

cmd/mesh-controller/probe_agent_root.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -24,7 +25,12 @@ import (
 //     that machine names (`agent_account`), and the operator's account while it names none;
 //  2. can an agent run a command it chooses, through the mesh's own tools, as an account that can — the login
 //     shell's `execute` runs as the machine's runtime account, which the mesh's acting tools give passwordless
-//     sudo?
+//     sudo? **Only where `execute` is served** (novox/hq ADR 0268): `execute` is an optional verb its holder
+//     withholds on a machine whose `execute` setting is not `serve`. The holder's seat being held there says
+//     nothing; whether the verb is served does. It counts as served while either says so — the holder's
+//     setting as the controller resolves it for that machine (a withheld value not yet pushed is still served),
+//     or the bus's discovery hearing the verb answered there — so a withheld setting the machine has not acted
+//     on yet, or a holder answering against its setting, is never taken for closed.
 //
 // The measurement is the sudo module's on that machine (`sudo_escalation`); a machine it does not run on, or
 // that does not answer, is a probe that could not run — said, never taken for "no".
@@ -39,8 +45,45 @@ const (
 	sudoModule      = "sudo"
 	sudoEscalation  = "sudo_escalation"
 	loginShellSeat  = "node-login-shell"
+	// loginShellVerb is the seat's verb that runs a command, and the name of the setting its holder withholds
+	// it by (novox/hq ADR 0268).
+	loginShellVerb = "execute"
+	// executeServes is the one value of that setting that serves the verb; anything else withholds it.
+	executeServes = "serve"
 )
 
+// loginShellServed judges whether the login shell's execute is served on a machine, failing closed (novox/hq
+// ADR 0268): served while the holder's setting there is `serve` (or the holder has no such setting and claims
+// the verb), or while the bus heard the verb answered there, or while the bus could not be asked. why says
+// which, in words, for the condition.
+func loginShellServed(holder string, claims bool, setting *any, heard, asked bool) (bool, string) {
+	var why []string
+	switch {
+	case setting != nil:
+		if v, _ := (*setting).(string); v == executeServes {
+			why = append(why, holder+"'s execute setting there is "+executeServes)
+		}
+	case claims:
+		why = append(why, holder+" claims execute and has no setting that withholds it")
+	}
+	if heard {
+		why = append(why, "the bus hears execute answered there")
+	} else if !asked {
+		why = append(why, "the bus could not be asked whether execute is answered there")
+	}
+	return len(why) > 0, strings.Join(why, "; ")
+}
+
+// claimServes says whether a manifest's claim of a seat names a verb among those it serves.
+func claimServes(m catalogue.Manifest, seat, verb string) bool {
+	for _, c := range m.Claims {
+		if c.Name == seat && slices.Contains(c.Serves, verb) {
+			return true
+		}
+	}
+	return false
+}
+
 // escalation is the sudo module's answer for one account.
 type escalation struct {
 	Account string `json:"account"`
@@ -55,8 +98,10 @@ type agentRootFacts struct {
 	Agent      string   // the account agents run as there; "" when none run there
 	AgentNamed bool     // the coding-agent module named it, rather than it being taken for the operator's
 	Runtime    string   // the account the machine's runtime runs as
-	LoginShell bool     // the login shell seat is held there, running commands as the runtime's account
-	Answers    map[string]escalation
+	LoginShell bool     // the login shell's execute is served there, running commands as the runtime's account
+	// LoginShellWhy is why execute counts as served there, in words: its holder's setting, the bus, or both.
+	LoginShellWhy string
+	Answers       map[string]escalation
 }
 
 // agentRootObservations judges one machine's facts: an urgent condition while an agent can become root there
@@ -74,8 +119,12 @@ func agentRootObservations(f agentRootFacts) []conditions.Observation {
 	}
 	if f.LoginShell && f.Runtime != "" {
 		if e := f.Answers[f.Runtime]; e.Root {
-			ways = append(ways, fmt.Sprintf("the login shell runs any command an agent gives it as %s, which can "+
-				"become root without a person: %s", f.Runtime, e.Why))
+			served := ""
+			if f.LoginShellWhy != "" {
+				served = " (" + f.LoginShellWhy + ")"
+			}
+			ways = append(ways, fmt.Sprintf("the login shell runs any command an agent gives it as %s%s, which can "+
+				"become root without a person: %s", f.Runtime, served, e.Why))
 		}
 	}
 	if len(ways) == 0 {
@@ -121,15 +170,6 @@ func probeAgentRoot(ctx context.Context, d *doctor) ([]conditions.Observation, e
 			}
 		}
 	}
-	for _, e := range entries {
-		if e.Manifest.ClaimsSeat(loginShellSeat) {
-			for _, node := range e.On {
-				if f := facts[node]; f != nil {
-					f.LoginShell = true
-				}
-			}
-		}
-	}
 	machines := make([]string, 0, len(facts))
 	for m := range facts {
 		machines = append(machines, m)
@@ -137,6 +177,44 @@ func probeAgentRoot(ctx context.Context, d *doctor) ([]conditions.Observation, e
 	sort.Strings(machines)
 	var out []conditions.Observation
 	var unread []string
+	if len(machines) == 0 {
+		return nil, nil
+	}
+	// Whether the login shell's execute is served where a trusted party runs (novox/hq ADR 0268): the
+	// holder's setting for that machine, and what the bus hears answered there. A discovery that could not be
+	// asked leaves only the setting, which is said: the probe then cannot show the verb withheld.
+	heard, derr := discoverSeatVerbs(ctx, d.js.Conn())
+	if derr != nil {
+		unread = append(unread, "the bus's discovery could not be asked whether the login shell's execute is served: "+derr.Error())
+	}
+	for _, e := range entries {
+		if !e.Manifest.ClaimsSeat(loginShellSeat) {
+			continue
+		}
+		for _, node := range e.On {
+			f := facts[node]
+			if f == nil {
+				continue
+			}
+			var setting *any
+			if _, declared := e.Manifest.Settings[loginShellVerb]; declared {
+				layers, err := inv.SettingsFor(ctx, node, e.Manifest.Module)
+				if err != nil {
+					unread = append(unread, node+": "+e.Manifest.Module+"'s settings could not be read: "+err.Error())
+					f.LoginShell, f.LoginShellWhy = true, "its holder's setting could not be read"
+					continue
+				}
+				for _, s := range catalogue.Effective(e.Manifest, layers) {
+					if s.Key == loginShellVerb {
+						v := s.Value
+						setting = &v
+					}
+				}
+			}
+			f.LoginShell, f.LoginShellWhy = loginShellServed(e.Manifest.Module, claimServes(e.Manifest, loginShellSeat, loginShellVerb),
+				setting, heard[loginShellSeat][loginShellVerb][node], derr == nil)
+		}
+	}
 	for _, m := range machines {
 		f := facts[m]
 		record, err := inv.NodeByName(ctx, m)

cmd/mesh-controller/probe_agent_root_test.go

@@ -58,3 +58,45 @@ func TestTheRootConditionIsSaidInPlainWords(t *testing.T) {
 		t.Errorf("not plain: %s", why)
 	}
 }
+
+// novox/hq ADR 0268: the login shell counts only where its execute is served, and fails closed — the holder's
+// setting resolving to anything but serve and the bus hearing no execute there is the one way it is withheld.
+func TestTheLoginShellCountsOnlyWhereExecuteIsServed(t *testing.T) {
+	val := func(v any) *any { return &v }
+	cases := []struct {
+		name          string
+		claims        bool
+		setting       *any
+		heard, asked  bool
+		served        bool
+		saysInTheWhys string
+	}{
+		{"withheld by the setting and silent on the bus", true, val("withhold"), false, true, false, ""},
+		{"withheld by the setting, the machine not yet pushed", true, val("withhold"), true, true, true, "the bus hears"},
+		{"the setting serves", true, val("serve"), false, true, true, "setting there is serve"},
+		{"a wrong value withholds, as the holder does", true, val("Serve"), false, true, false, ""},
+		{"the setting withholds, the bus could not be asked", true, val("withhold"), false, false, true, "could not be asked"},
+		{"a holder with no such setting that claims execute", true, nil, false, true, true, "claims execute"},
+		{"a holder with no such setting that does not claim it, heard all the same", false, nil, true, true, true, "the bus hears"},
+		{"a holder with no such setting that does not claim it, silent", false, nil, false, true, false, ""},
+	}
+	for _, c := range cases {
+		served, why := loginShellServed("zsh", c.claims, c.setting, c.heard, c.asked)
+		if served != c.served || (c.saysInTheWhys != "" && !strings.Contains(why, c.saysInTheWhys)) {
+			t.Errorf("%s: served %v (%q), want %v saying %q", c.name, served, why, c.served, c.saysInTheWhys)
+		}
+	}
+
+	// The control-node with execute withheld and agents of their own account: nothing is said.
+	f := agentRootFacts{Machine: "anchor", Trusted: []string{"telegram"}, Runtime: "ops", Agent: "agents", AgentNamed: true,
+		Answers: map[string]escalation{"ops": {Root: true, Why: "NOPASSWD"}, "agents": {Why: "none"}}}
+	f.LoginShell, f.LoginShellWhy = loginShellServed("zsh", true, val("withhold"), false, true)
+	if got := agentRootObservations(f); len(got) != 0 {
+		t.Errorf("execute withheld and agents confined: %+v", got)
+	}
+	// Withheld in the setting, still answered on the bus: said, with why.
+	f.LoginShell, f.LoginShellWhy = loginShellServed("zsh", true, val("withhold"), true, true)
+	if got := agentRootObservations(f); len(got) != 1 || !strings.Contains(got[0].Summary, "the bus hears execute answered there") {
+		t.Errorf("execute still answered: %+v", got)
+	}
+}

cmd/mesh-controller/probes.go

@@ -637,31 +637,8 @@ const (
 // discoverHolders asks the bus's discovery who serves what, and answers seat → machine for every
 // endpoint a seat's verb is served on.
 func discoverHolders(ctx context.Context, conn *nats.Conn) (map[string]map[string]bool, error) {
-	inbox := conn.NewRespInbox()
-	sub, err := conn.SubscribeSync(inbox)
-	if err != nil {
-		return nil, err
-	}
-	defer func() { _ = sub.Unsubscribe() }()
-	if err := conn.PublishRequest("$SRV.INFO", inbox, nil); err != nil {
-		return nil, fmt.Errorf("asking the bus who serves what: %w", err)
-	}
 	out := map[string]map[string]bool{}
-	deadline := time.Now().Add(discoveryPatience)
-	for time.Now().Before(deadline) {
-		wait, cancel := context.WithTimeout(ctx, discoveryQuiet)
-		msg, err := sub.NextMsgWithContext(wait)
-		cancel()
-		if err != nil {
-			if ctx.Err() != nil {
-				return nil, ctx.Err()
-			}
-			break
-		}
-		var info micro.Info
-		if json.Unmarshal(msg.Data, &info) != nil {
-			continue
-		}
+	err := discoverServices(ctx, conn, func(info micro.Info) {
 		for _, e := range info.Endpoints {
 			seat, node := e.Metadata["seat"], e.Metadata["node"]
 			if seat == "" {
@@ -680,8 +657,69 @@ func discoverHolders(ctx context.Context, conn *nats.Conn) (map[string]map[strin
 			out[info.Name] = map[string]bool{}
 		}
 		out[info.Name][info.ID] = true
+	})
+	return out, err
+}
+
+// discoverSeatVerbs asks the bus's discovery the same, one level finer: seat → verb → machine, for every
+// seat verb answered (an endpoint's `tool` is its verb). A seat held where a verb is withheld (novox/hq ADR
+// 0268) shows the seat and not that verb.
+func discoverSeatVerbs(ctx context.Context, conn *nats.Conn) (map[string]map[string]map[string]bool, error) {
+	out := map[string]map[string]map[string]bool{}
+	err := discoverServices(ctx, conn, func(info micro.Info) {
+		for _, e := range info.Endpoints {
+			seat, verb, node := e.Metadata["seat"], e.Metadata["tool"], e.Metadata["node"]
+			if seat == "" || verb == "" {
+				continue
+			}
+			if node == "" {
+				node = info.ID
+			}
+			if out[seat] == nil {
+				out[seat] = map[string]map[string]bool{}
+			}
+			if out[seat][verb] == nil {
+				out[seat][verb] = map[string]bool{}
+			}
+			out[seat][verb][node] = true
+		}
+	})
+	return out, err
+}
+
+// discoverServices asks the bus's discovery once and hands every service's answer to visit, waiting
+// discoveryQuiet after the last and discoveryPatience at the most.
+func discoverServices(ctx context.Context, conn *nats.Conn, visit func(micro.Info)) error {
+	if conn == nil {
+		return errors.New("the controller holds no connection to the bus")
 	}
-	return out, nil
+	inbox := conn.NewRespInbox()
+	sub, err := conn.SubscribeSync(inbox)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = sub.Unsubscribe() }()
+	if err := conn.PublishRequest("$SRV.INFO", inbox, nil); err != nil {
+		return fmt.Errorf("asking the bus who serves what: %w", err)
+	}
+	deadline := time.Now().Add(discoveryPatience)
+	for time.Now().Before(deadline) {
+		wait, cancel := context.WithTimeout(ctx, discoveryQuiet)
+		msg, err := sub.NextMsgWithContext(wait)
+		cancel()
+		if err != nil {
+			if ctx.Err() != nil {
+				return ctx.Err()
+			}
+			break
+		}
+		var info micro.Info
+		if json.Unmarshal(msg.Data, &info) != nil {
+			continue
+		}
+		visit(info)
+	}
+	return nil
 }
 
 // probeArchives is D4: every archive the mesh keeps is held by its manifest in the artifact store.