5 Commits

Include renames

Author	SHA1	Message	Date
mesh-admin	93c6ca5432	Merge pull request 'Answer mesh-cli: the control-node's operator is the terminal, everyone else is not (hq ADR 0272)' (#176) from feat/272-answer-mesh-cli into main	2026-10-09 11:38:43 +00:00
jochen	ea1d3ed96d	Merge main (hq ADR 0266) into the mesh-cli answer, and close what the confirmation review found ... - The generic command verb only reads now (commandReads) and terminal-only commands are refused through any verb (terminalOnly). mesh-cli's ordinary line made neither check: `node account`, `token issue` and `secret export` from another node would have run. It now meets both, in the one function the command verb shares. - The serving controller marks itself and its children never the terminal (ADR 0266); a line mesh-cli runs as the terminal drops that mark and carries MESH_CLI_TERMINAL, so it reads as the terminal it is. - Two withholding tests searched the answer's text while JSON writes bytes as base64, so they held nothing. They search both now, each proved by disabling what it guards (Shown, the bus withholding, `calls` via Get). - The control-node refusal is tested through the assign and unassign acts.	2026-10-09 13:08:48 +02:00
jochen	eca6390d6f	Judge the one protection rule the forge applies, and keep a recorded repository id ... The forge applies the rule named for a branch, else the first glob covering it; the judge passed a branch whose applied rule let pushes when a later rule happened to guard it. And a registration whose id the forge could not give cleared the id already recorded (the confirmation review of 2026-10-09).	2026-10-09 12:58:28 +02:00
jochen	95e7a7120a	Register only from a protected trunk of the same repository, and mark the serving controller never the terminal ... A source repository's name is not its identity, and a trunk anyone may push to makes the trunk rule mean nothing (the review of 2026-10-09). Through any verb a module now registers only from a repository on the mesh's forge whose trunk refuses direct pushes, requires a status and lets no administrator merge past one, asked of the forge's own tools; and only from the repository by the forge's id, recorded at registration (migration 0084), so one deleted and made again under the name is refused. The serving controller marks its environment, so nothing it runs or starts reads as the terminal, and a terminal request covers only the repository and path it asked.	2026-10-09 12:37:18 +02:00
jochen	a5e8baf6da	Register a module only from the repository the catalogue builds it from ... An agent could make a repository of its own, or fork one the mesh builds from, commit a module.json naming sudo or mesh-host, and ask the build verb for it: the outcome was registered under that name, and the next push made whoever wrote it root on every node (novox/hq ADR 0266 §7, the review of 2026-10-09). The trunk rule checked the trunk of the repository built, which was the agent's. The take-in, which every outcome reaches whichever verb asked it, now registers a module only from its registered repository, and a new module only from a repository the catalogue already builds from (a merge adding one); anything else only when the build request was kept as asked at the controller's terminal (migration 0084). Through a verb, a build of a repository the catalogue builds nothing from is not asked at all.	2026-10-09 12:37:18 +02:00