4 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	7385d9c092	Ask a node's engine which of its directories the walk would refuse, read-only (issue 358) ... Before the node-engine gives a mesh directory its mode and owner only through a walk that follows no link another account could make, the operator is to see which directories that walk would refuse on every node, the control-node included, where no tool reads a path. `node judge-directories <node>` signs the ask as a hand-over is, under its own context, and prints the engine's one line per directory; it changes nothing, so it is a seat verb an agent may call. The node is granted the subject, the controller alone its publish.	2026-10-12 14:17:01 +02:00
jochen	9cef820117	Ask a node's engine for a fresh setuid search at the terminal (hq issue 361) ... After the operator removes by hand what the last search found, no apply says so and nothing searched again until the next day. node setuid-search <node> signs the ask as a hand-over is, under its own context, on a subject only the node's engine hears and only the controller may publish.	2026-10-10 01:56:56 +02:00
jochen	b55a38ca9f	Sign the hand-over ask, and fail the line on the engine's refusal (hq issue 356, review) ... The subject proved nothing: the bus lets any principal allowed to answer reply to a message it received on the reply subject that message named, so a tool server — the operator's account, every agent — could deliver a hand-over to an engine. The controller now signs the ask with the mesh's key over a fixed context (node, path, who asked, a minute's expiry, a fresh nonce), as declarations are signed, and the engine verifies it. The writers table gains the row for mesh.node.*.ask.hand-over; the subject's comment no longer claims who the engine hears. The line's known-node check and the refusal branch are tested; every check was removed in turn and a test failed.	2026-10-09 19:44:55 +02:00
jochen	9006c82393	node hand-over: the terminal hands a directory used as found to the mesh, asked of the node's engine (hq issue 356) ... A module's condition told the operator to run the node-engine's hand-over at the machine, as root (issue 339), and the mesh had no channel for it. Now node hand-over <node> <path> is the controller's terminal's — a node subcommand that is not a read, so every verb and mesh-cli outside the terminal refuse it — and asks that node's engine on mesh.node.<node>.ask.hand-over, a request only the controller may publish and only that node's engine may hear and answer (its grant gains the subject and the right to answer what it was asked). The line's node and path are judged before anything is asked; the engine's answer is printed, a refusal as a refusal. Every text addressed to the operator names the nox line (ADR 0272); the condition's words stay plain.	2026-10-09 18:38:09 +02:00