5 Commits

Include renames

Author	SHA1	Message	Date
jochen	55d8b43f30	Refuse any change through a verb to a module with a trusted mergeable file ... A mergeable file takes any key, not only those its content names, so an empty runtime configuration a provider reads took a url of the caller's through the settings verb (hq issue 340 review).	2026-10-09 02:54:41 +02:00
jochen	f476494173	Make a mergeable file's own keys the terminal's, so no verb can set what every agent session obeys ... The claude-code module keeps the managed settings and tool servers every Claude Code session on a node runs in a mergeable file, and TerminalKeys only counted ${setting:} placeholders, so any caller of the settings verb, an agent included, could plant a hook in the operator's sessions on every node (hq issue 340).	2026-10-09 02:27:24 +02:00
jochen	0f58602c74	Count a file that says nothing as trusted, and drop the refusal date ... The fourth review (hq issue 339): the safe reading of a file that asks for a setting and does not say is that root or a consumer trusts it, so its settings are the terminal's; `"trusted": false` is the opt-out. With that, nothing unsafe is left to refuse: `module check` lists and counts the unmarked files and never refuses them.	2026-10-09 01:44:50 +02:00
jochen	c3ae3f3e09	Refuse a file that asks for a setting without saying whether it is trusted from 2026-10-10 ... The operator's date (hq issue 339). A test holds the warning before it and the refusal from it.	2026-10-09 01:37:43 +02:00
jochen	b9fc09c375	Derive the terminal's settings from what a module serves and which files it trusts; a found directory is its own condition ... The third review of #170 (hq issue 339): a setting overrides any key a provider serves, so any caller of the settings verb could move a database's port, a registry's port or an issuer to a listener of its own and collect what consumers present. TerminalKeys now derives from the manifest: places, accesses, every served key and every setting a served value asks for, and every setting a file marked `trusted` asks for. `trusted` is the catalogue's word, taken out before the declaration; `module check` warns of a file that asks for a setting without saying, and refuses it from 2026-10-30. The hand list is gone. A directory used as found is now its own condition kind, the operator's, never urgent, and the gate exempts it where it exempts a relogin.	2026-10-09 01:23:44 +02:00