mesh-controller

1,297 Commits 12 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
jochen	9cef820117	Ask a node's engine for a fresh setuid search at the terminal (hq issue 361) mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it… Details mesh/repo-check pass: its merge-check.sh passed Details mesh/delivery delivered Details After the operator removes by hand what the last search found, no apply says so and nothing searched again until the next day. node setuid-search <node> signs the ask as a hand-over is, under its own context, on a subject only the node's engine hears and only the controller may publish.	2026-10-10 01:56:56 +02:00
jochen	b55a38ca9f	Sign the hand-over ask, and fail the line on the engine's refusal (hq issue 356, review) The subject proved nothing: the bus lets any principal allowed to answer reply to a message it received on the reply subject that message named, so a tool server — the operator's account, every agent — could deliver a hand-over to an engine. The controller now signs the ask with the mesh's key over a fixed context (node, path, who asked, a minute's expiry, a fresh nonce), as declarations are signed, and the engine verifies it. The writers table gains the row for mesh.node.*.ask.hand-over; the subject's comment no longer claims who the engine hears. The line's known-node check and the refusal branch are tested; every check was removed in turn and a test failed.	2026-10-09 19:44:55 +02:00
jochen	9006c82393	node hand-over: the terminal hands a directory used as found to the mesh, asked of the node's engine (hq issue 356) mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it… Details mesh/repo-check pass: its merge-check.sh passed Details mesh/delivery superseded: a newer head of the same pull request Details A module's condition told the operator to run the node-engine's hand-over at the machine, as root (issue 339), and the mesh had no channel for it. Now node hand-over <node> <path> is the controller's terminal's — a node subcommand that is not a read, so every verb and mesh-cli outside the terminal refuse it — and asks that node's engine on mesh.node.<node>.ask.hand-over, a request only the controller may publish and only that node's engine may hear and answer (its grant gains the subject and the right to answer what it was asked). The line's node and path are judged before anything is asked; the engine's answer is printed, a refusal as a refusal. Every text addressed to the operator names the nox line (ADR 0272); the condition's words stay plain.	2026-10-09 18:38:09 +02:00

Author

SHA1

Message

Date

jochen

9cef820117

Ask a node's engine for a fresh setuid search at the terminal (hq issue 361)

mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it…

Details

mesh/repo-check pass: its merge-check.sh passed

Details

mesh/delivery delivered

Details

After the operator removes by hand what the last search found, no apply says so and nothing searched again
until the next day. node setuid-search <node> signs the ask as a hand-over is, under its own context, on a
subject only the node's engine hears and only the controller may publish.

2026-10-10 01:56:56 +02:00

jochen

b55a38ca9f

Sign the hand-over ask, and fail the line on the engine's refusal (hq issue 356, review)

The subject proved nothing: the bus lets any principal allowed to answer reply to a message it received on the reply subject that message named, so a tool server — the operator's account, every agent — could deliver a hand-over to an engine. The controller now signs the ask with the mesh's key over a fixed context (node, path, who asked, a minute's expiry, a fresh nonce), as declarations are signed, and the engine verifies it. The writers table gains the row for mesh.node.*.ask.hand-over; the subject's comment no longer claims who the engine hears. The line's known-node check and the refusal branch are tested; every check was removed in turn and a test failed.

2026-10-09 19:44:55 +02:00

jochen

9006c82393

node hand-over: the terminal hands a directory used as found to the mesh, asked of the node's engine (hq issue 356)

mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it…

Details

mesh/repo-check pass: its merge-check.sh passed

Details

mesh/delivery superseded: a newer head of the same pull request

Details

A module's condition told the operator to run the node-engine's hand-over at the machine, as root (issue 339), and the mesh had no channel for it. Now node hand-over <node> <path> is the controller's terminal's — a node subcommand that is not a read, so every verb and mesh-cli outside the terminal refuse it — and asks that node's engine on mesh.node.<node>.ask.hand-over, a request only the controller may publish and only that node's engine may hear and answer (its grant gains the subject and the right to answer what it was asked). The line's node and path are judged before anything is asked; the engine's answer is printed, a refusal as a refusal. Every text addressed to the operator names the nox line (ADR 0272); the condition's words stay plain.

2026-10-09 18:38:09 +02:00