mesh-controller

5 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	c544c2a17b	Key root-not-free apart from DA, keep ADR 0266's quiet window there, and judge at one clock (hq ADR 0259 §8) mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it… Details mesh/repo-check pass: its merge-check.sh passed Details mesh/delivery superseded: a newer delivery to the same trunk took over its walk Details mesh/delivery-group group feat/asks-answered-on-any-channel stopped: a member was stopped Details The confirmation review of 2026-10-09 found D-root and DA writing one key, machine.<m>.agent-root, from two probes with different words, so it flapped every run; D-root is now root-not-free. D-root raised the urgent condition after every node-engine restart while the first setuid search ran; it now keeps the same quiet window as DA, and the root-free verb still answers that machine not free. agentConfined takes the judging clock.	2026-10-09 13:55:06 +02:00
jochen	2e1a9abbf7	Count the quiet after a restart from when the controller first saw the search pending mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it… Details mesh/repo-check pass: its merge-check.sh passed Details mesh/delivery failed: its walk failed: a gate on a first machine (what it carried put back), a build, a machine Details The node-engine's own since starts again at every restart, so an agent that restarted the engine in a loop kept agent-can-become-root quiet for ever (the review of 2026-10-09). The controller now keeps when it first saw the verdict waiting for the setuid search (migration 0085), forgets it at the next complete verdict, and raises once the engine's own bound has passed since; the bound and the pending reason are read from mesh-host's rootsearch.	2026-10-09 12:37:18 +02:00
jochen	d15eee61bb	Do not raise agent-can-become-root while the first setuid search is still within its bound After every node-engine restart the account verdict says not judged yet until the engine's first search for setuid programs ends, and DA raised the urgent condition each time. The account stays unconfined and node show still says not judged; the condition is raised once the search fails, runs out its bound, finds a way to root, or the statement goes stale.	2026-10-09 12:37:18 +02:00
jochen	dcbbf4487a	Refuse a node's accounts through any verb, and a stale or service-account agent verdict The generic command verb ran node account and node agent-account, so an agent could name itself the operator account and have the next send grant it root (hq ADR 0266 review). Refuse every node subcommand but list and show through any verb; refuse the operator account as the agent account in both directions and well-known service accounts as an agent account; and count a verdict heard more than 15 minutes ago as not judged, so stopping the node-engine cannot freeze a healthy one. Re-pin mesh-host to its review head.	2026-10-09 10:11:21 +02:00
jochen	fcfbf7e69e	Name the account agents run as on a node, and say whether it can become root On the control node every agent ran as the operator's account, which has passwordless sudo, so an agent could become root without a person (hq ADR 0266). A node now names an agent account at the controller's terminal only; the agent's module declares it never to become root, the node-engine judges that, and the self-check (DA) raises agent-can-become-root while it does not hold, so ADR 0259's router can rest on it.	2026-10-09 10:11:21 +02:00