Test that plan --diff says a left-out module before the diff, through printed()

- commandEnvironment takes the terminal as a bool instead of reading an
  empty verb as one; every non-terminal line names its verb and is stripped
  of MESH_CLI_TERMINAL, and a test with the mark set in the serving
  environment fails when that strip is taken out.
- On the control-node the operator's account is the terminal only from a
  login session, as the node-engine reads it from the kernel's cgroup; the
  tool runner and the account's user units run as the operator too, and are
  ordinary calls. The request carries `session` (field-name tests on both
  sides).
- A pull request the forge never announced is named with its number in
  the condition's headline (hq issue 347), from the stalled line's
  `number`, which mesh-delivery sends.

cmd/mesh-controller/acts.go

@@ -51,6 +51,9 @@ func assignWith(ctx context.Context, open *stores, node string, opts assignOptio
 	if len(modules) == 0 {
 		return "", fmt.Errorf("assign %s names no module", node)
 	}
+	if err := refusedMovingTheController(modules); err != nil {
+		return "", err
+	}
 	// Held while it is recorded, so it cannot land between a converge's preview and its flip and
 	// be taken without ever having been previewed (novox/hq ADR 0100).
 	ctx, release, err := holdNodes(ctx, open, []string{node})
@@ -209,6 +212,9 @@ func seatDependenciesOnAssign(ctx context.Context, open *stores, node string, mo
 // (novox/hq ADR 0207) — the other side of refusing that module's assignment without one. Several
 // modules in one act are judged together, so a holder and its dependents come off in one command.
 func unassign(ctx context.Context, open *stores, node string, modules ...string) (string, error) {
+	if err := refusedMovingTheController(modules); err != nil {
+		return "", err
+	}
 	if len(modules) == 0 {
 		return "", fmt.Errorf("unassign %s names no module", node)
 	}
@@ -360,3 +366,17 @@ func issueOnAssign(ctx context.Context, open *stores, node, module string) strin
 	}
 	return fmt.Sprintf("its bus credential is issued and sealed to %s, and arrives with the push", node)
 }
+
+// refusedMovingTheController refuses assigning or unassigning the controller's module through a verb (review of
+// novox/hq ADR 0272): the node it is assigned to is the control-node, and the control-node's operator account is
+// the controller's terminal, so whoever moves the module chooses the terminal. At the terminal alone, as every
+// change that says who may change what.
+func refusedMovingTheController(modules []string) error {
+	verb, through := throughAVerb()
+	if !through || !slices.Contains(modules, controllerModule) {
+		return nil
+	}
+	return fmt.Errorf("%s is assigned and unassigned at the controller's terminal only (mesh-cli on the control-node), "+
+		"never through a verb (this came through %q): the node it runs on is the control-node, whose operator is the "+
+		"terminal (novox/hq ADR 0272). Nothing was assigned", controllerModule, verb)
+}

cmd/mesh-controller/agent_account.go

@@ -0,0 +1,250 @@
+package main
+
+// The account agents run as (novox/hq ADR 0266).
+//
+// On the control node every agent session ran as the operator's account, which may become root without a
+// password — so any agent there could become root without a person, and ADR 0259 §8 (an answer from the
+// operator's phone authorises an act) rests on that being false where the router and its channels run. The
+// decision: a node may name an account its agents run as, of their own and without sudo; the operator's
+// account keeps its sudo.
+//
+//   - **Named at the controller's terminal only** (`node agent-account`): not a verb, not a setting, so no
+//     agent can name itself another account. Empty is a real state: agents run as the operator there.
+//   - **Composed** as `${machine:agent-account}`, `${machine:agent-home}` and `${machine:agent-root}` for the
+//     agent's module, which declares the account with `root: never`, and as MESH_AGENT_ACCOUNT and
+//     MESH_AGENT_HOME for its tools (catalogue/machine_into_files.go, runtime.go).
+//   - **Judged by the machine itself.** The node-engine reads, on every look, whether an account declared
+//     `root: never` can become root without a person — uid 0, a group that grants root, a sudo rule, a
+//     secret of the mesh it may read — and says it as the declaring module's account verdict, marked
+//     Root "never". agentConfined reads that verdict; the self-check (probe DA) raises
+//     `agent-can-become-root` while it does not hold, and `node show` says it.
+//
+// A verdict not given is never a pass: an engine older than the judging, an account not yet declared, a
+// statement that says nothing of it — each is "not judged", and fails.
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// kindAgentCanBecomeRoot is the condition raised while a machine's agent account can become root without
+// a person, or is not judged (ADR 0266).
+const kindAgentCanBecomeRoot = "agent-can-become-root"
+
+// agentAccountProbe is the self-check's probe of it.
+const agentAccountProbe = "DA"
+
+// agentConfined says whether the agents of a machine that names an agent account are confined: the
+// machine's newest statement holds a healthy account verdict, judged for root, on that account. named is
+// false for a machine that names none — agents run as the operator account there, which this does not
+// judge. why is said either way, in the mesh's words; err is a store that could not be read.
+//
+// The one judgement: `node show`, the self-check, and ADR 0259's router honouring a verified sender read
+// it here.
+func agentConfined(ctx context.Context, inv *inventory.Inventory, node string) (named, confined bool, why string, err error) {
+	n, err := inv.NodeByName(ctx, node)
+	if err != nil {
+		return false, false, "", err
+	}
+	if n.AgentAccount == "" {
+		return false, false, fmt.Sprintf("%s names no agent account: agents run as the operator account (%s)",
+			node, orNoneKnown(n.Account)), nil
+	}
+	h, had, err := inv.HealthOf(ctx, node)
+	if err != nil {
+		return true, false, "", err
+	}
+	confined, why = judgedConfined(n.AgentAccount, h, had, time.Now())
+	return true, confined, why, nil
+}
+
+// verdictFreshFor is how old the statement holding the verdict may be, by this controller's clock. A
+// node-engine states its health on every change and at least every five minutes (mesh-host's sayAnyway), so
+// three statements missed is a node-engine stopped, or a machine away. **A stale verdict is not a pass**: an
+// agent that stopped the node-engine must not leave "cannot become root" standing from before.
+const verdictFreshFor = 15 * time.Minute
+
+// judgedConfined is the judgement over one statement, without the store, at now.
+func judgedConfined(agent string, h inventory.NodeHealth, had bool, now time.Time) (bool, string) {
+	if !had {
+		return false, fmt.Sprintf("the agent account %s is not judged: the machine's node-engine has stated "+
+			"nothing of what it runs", agent)
+	}
+	if age := now.Sub(h.HeardAt); age > verdictFreshFor {
+		return false, fmt.Sprintf("the agent account %s is not judged: the machine's newest statement was heard at "+
+			"%s, more than %d minutes ago, and a verdict that old is not a verdict on now", agent,
+			h.HeardAt.Local().Format("2006-01-02 15:04"), int(verdictFreshFor.Minutes()))
+	}
+	if h.Contract < link.RootContract {
+		return false, fmt.Sprintf("the agent account %s is not judged: the machine's node-engine is older than "+
+			"the judging of an account's root (its statement's contract is %d, the judging is %d)",
+			agent, h.Contract, link.RootContract)
+	}
+	var verdicts []inventory.ResourceHealth
+	for _, r := range h.Resources {
+		if r.Kind == link.KindAccount && r.Target == agent && r.Root == link.RootNever {
+			verdicts = append(verdicts, r)
+		}
+	}
+	if len(verdicts) == 0 {
+		return false, fmt.Sprintf("the agent account %s is not judged: the machine's newest statement holds no "+
+			"verdict on it — no module there declares it never to become root, or the declaration naming it "+
+			"has not been applied", agent)
+	}
+	sort.Slice(verdicts, func(i, j int) bool {
+		return verdicts[i].Module+verdicts[i].Resource < verdicts[j].Module+verdicts[j].Resource
+	})
+	for _, v := range verdicts {
+		switch v.State {
+		case link.StateHealthy:
+		case link.StateUnhealthy:
+			// The engine's own words, which start with link.ReasonRoot when it found a way to root.
+			return false, fmt.Sprintf("the agent account %s %s (said by %s's %s)", agent,
+				orNoneKnown(v.Reason), v.Module, v.Resource)
+		default:
+			return false, fmt.Sprintf("the agent account %s is not judged: %s (%s's %s, %s)", agent,
+				orNoneKnown(v.Reason), v.Module, v.Resource, v.State)
+		}
+	}
+	return true, fmt.Sprintf("the agent account %s cannot become root without a person (judged %s)", agent,
+		h.SaidAt.Local().Format("2006-01-02 15:04"))
+}
+
+// searchQuietFor is how long the controller lets an agent account's verdict wait for the node-engine's setuid
+// search before that is itself the urgent condition: the engine's bound on one search (link.RootSearchBound, the
+// engine's own value), counted from when this controller first saw it waiting, never from the engine's start.
+const searchQuietFor = link.RootSearchBound
+
+// The kinds of an agent account's verdict, for the quiet a search earns.
+const (
+	verdictOther    = iota // anything else: a stale statement, an older engine, no verdict, another unknown
+	verdictPending         // waiting for the search, and otherwise healthy
+	verdictComplete        // judged: healthy, or a way to root found
+)
+
+// rootVerdictKind reads a statement for the agent account (novox/hq ADR 0266): pending when every verdict on it
+// is healthy or not judged yet because the engine's setuid search runs, at least one of them that; complete when
+// every verdict is healthy or one found a way to root. The engine's own "since" is not read: it starts again at
+// every restart of the engine.
+func rootVerdictKind(agent string, h inventory.NodeHealth, had bool, now time.Time) int {
+	if !had || now.Sub(h.HeardAt) > verdictFreshFor || h.Contract < link.RootContract {
+		return verdictOther
+	}
+	pending, any := false, false
+	for _, r := range h.Resources {
+		if r.Kind != link.KindAccount || r.Target != agent || r.Root != link.RootNever {
+			continue
+		}
+		any = true
+		switch {
+		case r.State == link.StateHealthy:
+		case r.State == link.StateUnhealthy:
+			return verdictComplete
+		case r.State == link.StateUnknown && strings.HasPrefix(r.Reason, link.ReasonRootPending):
+			pending = true
+		default:
+			return verdictOther
+		}
+	}
+	switch {
+	case !any:
+		return verdictOther
+	case pending:
+		return verdictPending
+	}
+	return verdictComplete
+}
+
+// searchStillRunning says the one thing keeping an agent account from being judged is the node-engine's setuid
+// search, and that this controller first saw it waiting less than searchQuietFor ago — kept in the store, so a
+// node-engine restarted in a loop does not keep it quiet. A complete verdict forgets when it began.
+func searchStillRunning(ctx context.Context, inv *inventory.Inventory, node, agent string, h inventory.NodeHealth,
+	had bool, now time.Time) (bool, error) {
+	switch rootVerdictKind(agent, h, had, now) {
+	case verdictComplete:
+		return false, inv.RootSearchJudged(ctx, node)
+	case verdictPending:
+		since, err := inv.RootSearchPending(ctx, node, now)
+		if err != nil {
+			return false, err
+		}
+		return now.Sub(since) <= searchQuietFor, nil
+	}
+	return false, nil
+}
+
+// probeAgentAccounts is DA: every machine that names an agent account has it judged, on its node-engine's
+// newest statement, unable to become root without a person (ADR 0266).
+func probeAgentAccounts(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
+	inv := d.open.inventory
+	nodes, err := inv.Nodes(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var out []conditions.Observation
+	for _, n := range nodes {
+		if n.AgentAccount == "" {
+			continue
+		}
+		h, had, err := inv.HealthOf(ctx, n.Name)
+		if err != nil {
+			return nil, err
+		}
+		now := time.Now()
+		quiet, err := searchStillRunning(ctx, inv, n.Name, n.AgentAccount, h, had, now)
+		if err != nil {
+			return nil, err
+		}
+		confined, why := judgedConfined(n.AgentAccount, h, had, now)
+		if confined {
+			continue
+		}
+		// Not judged yet only because the first search since the node-engine started is still running: not the
+		// urgent condition after every restart. The agent is still not confined — ADR 0259's router reads
+		// agentConfined, not this — and `node show` still says not judged. Loud again once the search fails,
+		// runs out its bound, or the statement goes stale.
+		if quiet {
+			continue
+		}
+		out = append(out, conditions.Observation{Scope: conditions.ScopeMachine, ID: n.Name, Token: "agent-root",
+			Machine: n.Name, Severity: conditions.Urgent,
+			Summary: fmt.Sprintf("on %s, %s (ADR 0266): an agent there may become root without a person, and "+
+				"no answer from a channel authorises an act there (ADR 0259 §8)", n.Name, why),
+			Said: why})
+	}
+	return sortedFound(out), nil
+}
+
+// agentAccountLines is what `node show` says of the account agents run as.
+func agentAccountLines(ctx context.Context, inv *inventory.Inventory, n inventory.Node) []string {
+	if n.AgentAccount == "" {
+		return []string{fmt.Sprintf("  agents run as      the operator account (%s); no agent account is named",
+			orNoneKnown(n.Account))}
+	}
+	_, confined, why, err := agentConfined(ctx, inv, n.Name)
+	if err != nil {
+		return []string{fmt.Sprintf("  agents run as      %s (home %s); whether it can become root could NOT be read: %v",
+			n.AgentAccount, n.AgentHome(), err)}
+	}
+	verdict := "CAN become root, or is not judged: " + why
+	if confined {
+		verdict = why
+	}
+	return []string{fmt.Sprintf("  agents run as      %s (home %s)", n.AgentAccount, n.AgentHome()),
+		"                     " + verdict}
+}
+
+// orNoneKnown is a value, or that none is known.
+func orNoneKnown(s string) string {
+	if strings.TrimSpace(s) == "" {
+		return "none known"
+	}
+	return s
+}

cmd/mesh-controller/agent_account_test.go

@@ -0,0 +1,273 @@
+package main
+
+import (
+	"github.com/novox/mesh-host/rootsearch"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	snapshot "github.com/novox/mesh-controller/internal/facts"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The agent account's judgement (novox/hq ADR 0266): confined only on a healthy account verdict judged for
+// root, on the very account; every verdict not given — no statement, an older engine, no verdict on it, a
+// verdict of unknown — is "not judged" and fails, never a pass.
+func TestAnAgentAccountIsConfinedOnlyOnAHealthyVerdictJudgedForRoot(t *testing.T) {
+	at := time.Date(2026, 10, 8, 19, 21, 0, 0, time.UTC)
+	verdict := func(target, root, state, reason string) inventory.ResourceHealth {
+		return inventory.ResourceHealth{Module: "claude-code", Resource: "claude-code.agent-account",
+			Kind: link.KindAccount, Target: target, State: state, Reason: reason, Root: root, Account: target}
+	}
+	statement := func(contract int, rs ...inventory.ResourceHealth) inventory.NodeHealth {
+		return inventory.NodeHealth{Node: "anchor", Contract: contract, SaidAt: at, HeardAt: at, Resources: rs}
+	}
+	for _, c := range []struct {
+		name     string
+		h        inventory.NodeHealth
+		had      bool
+		confined bool
+		says     string
+	}{
+		{"judged and unable", statement(link.RootContract, verdict("agent", link.RootNever, link.StateHealthy, "")),
+			true, true, "cannot become root without a person"},
+		{"judged and able", statement(link.RootContract, verdict("agent", link.RootNever, link.StateUnhealthy,
+			link.ReasonRoot+": in the group docker, which grants root")), true, false, "in the group docker"},
+		{"a verdict of unknown", statement(link.RootContract, verdict("agent", link.RootNever, link.StateUnknown,
+			"sudo could not be read")), true, false, "not judged"},
+		{"no statement", inventory.NodeHealth{}, false, false, "not judged"},
+		{"an older engine", statement(link.ReadinessContract, verdict("agent", "", link.StateHealthy, "")),
+			true, false, "older than the judging"},
+		{"a verdict on groups only", statement(link.RootContract, verdict("agent", "", link.StateHealthy, "")),
+			true, false, "no verdict on it"},
+		{"a verdict on another account", statement(link.RootContract, verdict("ops", link.RootNever, link.StateHealthy, "")),
+			true, false, "no verdict on it"},
+	} {
+		confined, why := judgedConfined("agent", c.h, c.had, at.Add(time.Minute))
+		if confined != c.confined || !strings.Contains(why, c.says) {
+			t.Errorf("%s: confined %v, %q; want %v saying %q", c.name, confined, why, c.confined, c.says)
+		}
+	}
+	// A verdict heard longer ago than the bound is no verdict: an agent that stopped the node-engine must not
+	// leave "healthy" standing.
+	fresh := statement(link.RootContract, verdict("agent", link.RootNever, link.StateHealthy, ""))
+	if ok, _ := judgedConfined("agent", fresh, true, at.Add(verdictFreshFor)); !ok {
+		t.Error("a verdict exactly at the bound is still one")
+	}
+	if ok, why := judgedConfined("agent", fresh, true, at.Add(verdictFreshFor+time.Second)); ok ||
+		!strings.Contains(why, "not judged") {
+		t.Errorf("a stale healthy verdict passed: %q", why)
+	}
+}
+
+// DA raises an urgent condition, with plain words, on a machine whose agent account is not judged unable to
+// become root; a machine that names none is not its to judge.
+func TestTheSelfCheckSaysAnAgentAccountThatCanBecomeRoot(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	for _, n := range []string{"anchor", "laptop"} {
+		if _, err := inv.NodeByName(ctx, n); err != nil {
+			if _, err := inv.AddNode(ctx, n); err != nil {
+				t.Fatal(err)
+			}
+		}
+		if err := inv.SetAccount(ctx, n, "ops", ""); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := inv.SetAgentAccount(ctx, "anchor", "agent", ""); err != nil {
+		t.Fatal(err)
+	}
+	d := &doctor{open: open}
+	found, err := probeAgentAccounts(ctx, d)
+	if err != nil {
+		t.Fatal(err)
+	}
+	found = onlyMachine(found, "anchor")
+	if len(found) != 1 || found[0].Machine != "anchor" || found[0].Severity != conditions.Urgent ||
+		!strings.Contains(found[0].Said, "not judged") {
+		t.Fatalf("a named agent account with no verdict: %+v", found)
+	}
+	w := plainWordings[kindAgentCanBecomeRoot](conditions.Observation{Kind: kindAgentCanBecomeRoot, Machine: "anchor"})
+	if w.Headline == "" || w.Needs == "" || w.Resolved == "" {
+		t.Errorf("the condition has no plain words: %+v", w)
+	}
+
+	healthy := inventory.ResourceHealth{Module: "claude-code", Resource: "claude-code.agent-account",
+		Kind: link.KindAccount, Target: "agent", State: link.StateHealthy, Root: link.RootNever, Account: "agent"}
+	if _, err := inv.RecordHealth(ctx, inventory.NodeHealth{Node: "anchor", Contract: link.RootContract,
+		SaidAt: time.Now(), HeardAt: time.Now(), Resources: []inventory.ResourceHealth{healthy}}); err != nil {
+		t.Fatal(err)
+	}
+	if found, err = probeAgentAccounts(ctx, d); err != nil || len(onlyMachine(found, "anchor")) != 0 {
+		t.Fatalf("a judged agent account still fails: %+v %v", found, err)
+	}
+	if named, confined, why, err := agentConfined(ctx, inv, "anchor"); err != nil || !named || !confined {
+		t.Fatalf("agentConfined on anchor: %v %v %q %v", named, confined, why, err)
+	}
+	if named, _, why, err := agentConfined(ctx, inv, "laptop"); err != nil || named ||
+		!strings.Contains(why, "operator account") {
+		t.Fatalf("agentConfined on a machine naming none: %v %q %v", named, why, err)
+	}
+}
+
+func TestTheAgentRootWordsArePlain(t *testing.T) {
+	w := plainWordings[kindAgentCanBecomeRoot](conditions.Observation{Kind: kindAgentCanBecomeRoot, Machine: "anchor"})
+	if why, ok := conditions.PlainWords(w, "anchor"); !ok {
+		t.Fatalf("not plain: %s: %+v", why, w)
+	}
+}
+
+func onlyMachine(obs []conditions.Observation, machine string) []conditions.Observation {
+	var out []conditions.Observation
+	for _, o := range obs {
+		if o.Machine == machine {
+			out = append(out, o)
+		}
+	}
+	return out
+}
+
+// The snapshot a merge check composes from carries the agent account as a pseudonym (novox/hq ADR 0266),
+// so a change is judged against machines that name one, and the name never leaves.
+func TestTheFactsCarryTheAgentAccountAsAPseudonym(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	if err := open.inventory.SetAccount(ctx, "anchor", "keeper", ""); err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.SetAgentAccount(ctx, "anchor", "warden", ""); err != nil {
+		t.Fatal(err)
+	}
+	f, err := gatherFacts(ctx, open, "2.11.17")
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, _ := f.Encode()
+	if strings.Contains(string(body), "warden") {
+		t.Error("the agent account's name is in the snapshot")
+	}
+	m, ok := f.Machine(snapshot.Pseudonym("machine", "anchor"))
+	if !ok || m.AgentAccount != snapshot.Pseudonym("account", "warden") || m.Account == m.AgentAccount {
+		t.Fatalf("the anchor's agent account reads as %q (operator %q)", m.AgentAccount, m.Account)
+	}
+}
+
+// No verb runs a `node` command that sets something: through the generic `command` verb, `node account`,
+// `node agent-account` and every other `node` subcommand but list and show are refused, naming the terminal.
+func TestNoVerbSetsANodesAccounts(t *testing.T) {
+	for _, line := range []string{
+		"node agent-account novox --clear",
+		"node agent-account novox ops",
+		"node account novox agent",
+		"node account novox",
+		"node add intruder",
+		"node public-domain novox --clear",
+		"node",
+		"node frobnicate",
+	} {
+		argv, err := argvFor("command", map[string]any{"command": line})
+		if err == nil || !strings.Contains(err.Error(), "controller's terminal") ||
+			!strings.Contains(err.Error(), "ADR 0266") {
+			t.Errorf("%q ran as %v (%v); want a refusal naming the terminal", line, argv, err)
+		}
+	}
+	for _, line := range []string{"node show novox", "node list --json", "status --json"} {
+		if _, err := argvFor("command", map[string]any{"command": line}); err != nil {
+			t.Errorf("%q, a read, was refused: %v", line, err)
+		}
+	}
+	if err := terminalOnly([]string{"node", "account", "a", "b"}); err == nil {
+		t.Error("the refusal is not only the command verb's")
+	}
+}
+
+// Naming the agent account is the controller's terminal's alone: the `node` verb only shows.
+func TestTheNodeVerbOnlyShows(t *testing.T) {
+	argv, err := argvFor("node", map[string]any{"node": "anchor"})
+	if err != nil || strings.Join(argv, " ") != "node show anchor" {
+		t.Fatalf("the node verb runs %v (%v)", argv, err)
+	}
+	for _, v := range catalogue.ControllerVerbs {
+		if strings.Contains(v.Name, "agent") {
+			t.Errorf("a verb %q may name the agent account", v.Name)
+		}
+	}
+}
+
+// After every node-engine restart its search for setuid programs runs for up to its bound, and the agent account
+// is not judged until it ends. DA does not raise that as urgent while the search is within its bound, counted from
+// when this controller first saw it waiting — never from the engine's own "since", which a restart resets, so an
+// engine restarted in a loop does not keep it quiet. The account is still not confined, and `node show` still
+// says not judged; a search that failed, or a way to root found, is urgent at once.
+func TestASearchStillRunningAfterARestartIsNotUrgent(t *testing.T) {
+	if searchQuietFor != rootsearch.Bound {
+		t.Fatalf("the quiet is %s and the node-engine's bound %s: they are one value", searchQuietFor, rootsearch.Bound)
+	}
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	if _, err := inv.NodeByName(ctx, "anchor"); err != nil {
+		if _, err := inv.AddNode(ctx, "anchor"); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := inv.SetAgentAccount(ctx, "anchor", "agent", ""); err != nil {
+		t.Fatal(err)
+	}
+	d := &doctor{open: open}
+	say := func(state, reason string) []conditions.Observation {
+		t.Helper()
+		// The engine's since is always now: it was just restarted.
+		v := inventory.ResourceHealth{Module: "claude-code", Resource: "claude-code.agent-account",
+			Kind: link.KindAccount, Target: "agent", State: state, Reason: reason, Root: link.RootNever,
+			Account: "agent", Since: time.Now()}
+		if _, err := inv.RecordHealth(ctx, inventory.NodeHealth{Node: "anchor", Contract: link.RootContract,
+			SaidAt: time.Now(), HeardAt: time.Now(), Resources: []inventory.ResourceHealth{v}}); err != nil {
+			t.Fatal(err)
+		}
+		found, err := probeAgentAccounts(ctx, d)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return onlyMachine(found, "anchor")
+	}
+	running := link.ReasonRootPending + ": the search for setuid programs, started at 19:21, has not finished yet"
+	healthy := func() {
+		t.Helper()
+		if found := say(link.StateHealthy, ""); len(found) != 0 {
+			t.Fatalf("a healthy verdict raised: %+v", found)
+		}
+	}
+	if found := say(link.StateUnknown, running); len(found) != 0 {
+		t.Fatalf("a search first seen now was raised: %+v", found)
+	}
+	if _, confined, why, _ := agentConfined(ctx, inv, "anchor"); confined || !strings.Contains(why, "not judged") {
+		t.Fatalf("an account whose search runs was read as confined: %q", why)
+	}
+	// The engine restarted again and again, each statement's own since fresh: the controller's clock runs on.
+	if _, err := inv.RootSearchPending(ctx, "anchor", time.Now().Add(-searchQuietFor-time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	healthy() // a complete verdict forgets when the waiting began …
+	if _, err := inv.RootSearchPending(ctx, "anchor", time.Now().Add(-searchQuietFor-time.Minute)); err != nil {
+		t.Fatal(err) // … and this restart loop began past the bound
+	}
+	if found := say(link.StateUnknown, running); len(found) != 1 || found[0].Severity != conditions.Urgent {
+		t.Fatalf("a search pending past the bound, by the controller's clock, was not urgent: %+v", found)
+	}
+	healthy()
+	incomplete := rootsearch.ReasonIncomplete + ": the search for setuid programs did not finish (last tried at " +
+		"19:23: timeout); it is tried again later"
+	if found := say(link.StateUnknown, incomplete); len(found) != 1 || found[0].Severity != conditions.Urgent {
+		t.Fatalf("a search that did not finish was not urgent: %+v", found)
+	}
+	if found := say(link.StateUnhealthy, link.ReasonRoot+": in the group docker; "+running); len(found) != 1 ||
+		found[0].Severity != conditions.Urgent {
+		t.Fatalf("a way to root found while the search runs was not urgent: %+v", found)
+	}
+}

cmd/mesh-controller/build.go

@@ -451,6 +451,10 @@ func buildOneAsked(ctx context.Context, source buildSource, path, ref string, wa
 	if err != nil {
 		return "", err
 	}
+	// Through a verb, only a repository the catalogue builds from (novox/hq ADR 0266).
+	if err := verbMayAsk(ctx, source, repository); err != nil {
+		return "", err
+	}
 
 	ident, err := openIdentity(ctx)
 	if err != nil {
@@ -500,8 +504,10 @@ func buildOneAsked(ctx context.Context, source buildSource, path, ref string, wa
 	// never before, so an ask that failed never reads as a build in flight. A dry run registers nothing, and
 	// is not kept.
 	keep := !dryRun && asker != ""
+	// Asked at the terminal is what lets its outcome register a module from a repository the catalogue does
+	// not build it from (novox/hq ADR 0266); never through a verb.
 	asked := inventory.BuildRequest{ID: request.ID, Repository: source.Repository, Seat: source.Seat, Path: path,
-		Ref: ref, For: asker}
+		Ref: ref, For: asker, AtTerminal: startedAtTheTerminal()}
 
 	if wait == 0 {
 		// Asked and not waited for (novox/hq issue 176): the outcome is the role's event, and the
@@ -631,6 +637,21 @@ func takeIn(ctx context.Context, inv *inventory.Inventory, result link.BuildResu
 		return manifest, kept, fmt.Errorf("%s built %s (%s), and the mesh does not register it: %w",
 			result.On, result.Repository, short(result.Commit), err)
 	}
+	// **Only from the repository the catalogue builds the module from** (novox/hq ADR 0266): else the trunk
+	// below is the trunk of whatever repository was built, which may be one an agent made — and a module named
+	// `sudo` from it would be what the next push sends. Another repository is the operator's, at the terminal.
+	trunk := result.Trunk
+	if was, err := inv.SourceOf(ctx, manifest.Module); err == nil && followedBranch(was.Ref) != "" {
+		trunk = followedBranch(was.Ref)
+	}
+	if trunk == "" {
+		trunk = "main"
+	}
+	repoID, err := mayRegisterFrom(ctx, inv, manifest.Module, recorded, result.ID, result.Path, trunk)
+	if err != nil {
+		return manifest, kept, fmt.Errorf("%s built %s (%s), recorded and not registered: %w", result.On,
+			manifest.Module, short(result.Commit), err)
+	}
 	// **Only a commit on the trunk is published** (novox/hq ADR 0238): a commit off its repository's
 	// default branch — a pull request's head, a feature branch built by hand, a `rebuild` or `replay
 	// --register` of one — is for checking, and is never a module's version; nothing could then send it.
@@ -678,6 +699,10 @@ func takeIn(ctx context.Context, inv *inventory.Inventory, result link.BuildResu
 		}
 		return manifest, kept, err
 	}
+	// Which repository it is registered from, by the forge's own id (novox/hq ADR 0266).
+	if err := inv.SetSourceIdentity(ctx, manifest.Module, repoID); err != nil {
+		return manifest, kept, err
+	}
 	// The keep set just moved, and new bytes just landed (novox/hq ADR 0189). Asked here rather
 	// than on a timer of its own: this is the only moment either is true. Never fatal — the build
 	// worked and the module is registered.
@@ -719,6 +744,9 @@ func buildAndShow(ctx context.Context, source buildSource, path, ref string, wai
 	if err != nil {
 		return err
 	}
+	if err := verbMayAsk(ctx, source, repository); err != nil {
+		return err
+	}
 	ident, err := openIdentity(ctx)
 	if err != nil {
 		return err

cmd/mesh-controller/build_source.go

@@ -0,0 +1,458 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// Where a build may register a module from (novox/hq ADR 0266).
+//
+// A build's outcome registers its module, and a registered module is what the next push sends. Before this,
+// an outcome registered whatever its manifest named, from whichever repository it was built from: an agent
+// that made a repository of its own, committed `modules/sudo/module.json` granting itself a rule without a
+// password, and asked the `build` verb for it had its repository registered as the module `sudo` — whose next
+// push made the agent root on every node. A fork of the node-engine did the same everywhere. The trunk rule
+// (ADR 0238) did not stop it: the trunk it checked was the trunk of the repository built, which was the
+// agent's own.
+//
+// So **an outcome registers a module only from the repository the catalogue already builds that module
+// from**; and a module new to the catalogue only from a repository the catalogue already builds another
+// module from — whose trunk takes a reviewed, approved merge, which is how a merge adds a module (novox/hq
+// issue 300). Anything else — a module moved to another repository, a module from a repository the
+// catalogue has never built — is the operator's, at the controller's terminal: allowed only when the build
+// request was kept as asked there. Judged at the take-in, which every outcome reaches whoever hears it and
+// whichever verb asked it (`build`, `rebuild`, `replay --register`, `assign` with build), and before the ask
+// for a call through a verb, so an agent cannot have a build node run a repository the catalogue does not
+// build from at all.
+
+// errNotItsSource is an outcome refused for where it was built from.
+var errNotItsSource = errors.New("not built from the repository the catalogue builds it from")
+
+// servedVar marks every process the serving controller starts — each verb's command, each child — and the serving
+// process itself, so none of them can read as the operator at the terminal (novox/hq ADR 0266). Set by serve
+// before it answers anything, inherited by every child through os.Environ.
+const servedVar = "MESH_SERVED_BY_THE_CONTROLLER"
+
+// startedAtTheTerminal says this process was started at the controller's terminal: not the serving controller,
+// not anything it started, not a verb's command, not a seat call's. The serving controller marks its own
+// environment (servedVar), so a build asked in it, or by any process it starts, never reads as the terminal's;
+// runVerb also names the verb and the caller.
+//
+// **And a line mesh-cli asked as the controller's terminal** (novox/hq ADR 0272 §4): the serving controller runs it
+// without the served mark and without a verb, names its caller, and marks it with cliTerminalVar — a mark only the
+// mesh-cli path sets and every other command line the controller runs is stripped of (commandEnvironment).
+func startedAtTheTerminal() bool {
+	if os.Getenv(servedVar) != "" || os.Getenv(verbVar) != "" {
+		return false
+	}
+	return os.Getenv(link.CallerVar) == "" || os.Getenv(cliTerminalVar) != ""
+}
+
+// cliTerminalVar marks a command line the serving controller runs as the controller's terminal for mesh-cli.
+const cliTerminalVar = "MESH_CLI_TERMINAL"
+
+// markServed marks this process, and so everything it starts, as the serving controller's.
+func markServed() {
+	if err := os.Setenv(servedVar, "1"); err != nil {
+		panic("the serving controller could not mark its environment: " + err.Error())
+	}
+}
+
+// sourceForms compares sources however each is spelled: a path on a seat's holder (ADR 0111) or a URL — a
+// build asked of a seat's path is registered with the URL composed from it when its outcome does not echo
+// the seat. A seat's path is composed into its URL where the seat's holder is known, so both spellings of
+// one repository are one; where it is not, a seat's path matches only the same seat's same path.
+type sourceForms struct {
+	bases map[string]string // the seat's clone base, `scheme://host:port`, by seat; "" where it is not known
+	base  func(seat string) string
+}
+
+// newSourceForms reads the seats' bases from the mesh once, when first needed.
+func newSourceForms(ctx context.Context, inv *inventory.Inventory) *sourceForms {
+	f := &sourceForms{bases: map[string]string{}}
+	var world *catalogue.World
+	f.base = func(seat string) string {
+		if b, known := f.bases[seat]; known {
+			return b
+		}
+		if world == nil {
+			w := catalogue.World{}
+			if shelf, err := inv.Catalogue(ctx); err == nil {
+				if read, err := theRestOfTheMesh(ctx, inv, shelf, ""); err == nil {
+					w = read
+				}
+			}
+			world = &w
+		}
+		b, err := seatBase(*world, seat)
+		if err != nil {
+			b = ""
+		}
+		f.bases[seat] = b
+		return b
+	}
+	return f
+}
+
+// canonical is one spelling of a repository: lower case, no `.git`, no trailing slash, and a seat's path as
+// the URL its holder serves it at where that is known.
+func (f *sourceForms) canonical(repository, seat string) string {
+	trim := func(s string) string {
+		s = strings.TrimSpace(strings.ToLower(s))
+		s = strings.TrimRight(s, "/")
+		return strings.TrimRight(strings.TrimSuffix(s, ".git"), "/")
+	}
+	if seat == "" {
+		return trim(repository)
+	}
+	if b := f.base(seat); b != "" {
+		return trim(b + "/" + strings.Trim(repository, "/"))
+	}
+	return "seat:" + seat + ":" + trim(strings.Trim(repository, "/"))
+}
+
+// same says two sources are one repository.
+func (f *sourceForms) same(aRepository, aSeat, bRepository, bSeat string) bool {
+	if aRepository == "" || bRepository == "" {
+		return false
+	}
+	return f.canonical(aRepository, aSeat) == f.canonical(bRepository, bSeat)
+}
+
+// buildsFrom says the catalogue builds some module from this repository.
+func (f *sourceForms) buildsFrom(entries []inventory.Entry, repository, seat string) bool {
+	for _, e := range entries {
+		if e.Provided || e.Source.Repository == "" {
+			continue
+		}
+		if f.same(e.Source.Repository, e.Source.Seat, repository, seat) {
+			return true
+		}
+	}
+	return false
+}
+
+// forgeFacts is what the mesh's forge says of a repository a module is registered from (novox/hq ADR 0266).
+type forgeFacts struct {
+	// ID is the forge's own id of the repository: what tells it from one deleted and made again by its name.
+	ID int64
+	// Guarded is whether the branch is protected as a module's trunk must be: no direct push, at least one
+	// required status, and no administrator merging past one. Why says what is missing when it is not.
+	Guarded bool
+	Why     string
+}
+
+// askTheForge asks the forge, through its module's tools on the bus, for a repository's id and its branch's
+// protection. A variable so a test needs no forge.
+var askTheForge = func(ctx context.Context, owner, repo, branch string) (forgeFacts, error) {
+	js, err := aBus()
+	if err != nil {
+		return forgeFacts{}, err
+	}
+	defer js.Close()
+	bus := link.OverNATS{Conn: js.Conn()}
+	ask := func(tool string, args map[string]any, into any) error {
+		raw, _ := json.Marshal(args)
+		answer, err := link.Ask(ctx, bus, "gitea", tool, raw, 30*time.Second)
+		if err != nil {
+			return err
+		}
+		if answer.Error != "" {
+			return fmt.Errorf("gitea.%s: %s", tool, answer.Error)
+		}
+		return json.Unmarshal(answer.Result, into)
+	}
+	var found struct {
+		Result struct {
+			ID       int64  `json:"id"`
+			FullName string `json:"full_name"`
+		} `json:"result"`
+	}
+	if err := ask("gitea_api", map[string]any{"path": "/repos/" + owner + "/" + repo}, &found); err != nil {
+		return forgeFacts{}, err
+	}
+	if found.Result.ID == 0 {
+		return forgeFacts{}, fmt.Errorf("the forge named no id for %s/%s", owner, repo)
+	}
+	var rules struct {
+		Rules []protectionRule `json:"rules"`
+	}
+	if err := ask("gitea_branch_protection_get", map[string]any{"owner": owner, "repo": repo}, &rules); err != nil {
+		return forgeFacts{}, err
+	}
+	facts := judgedRule(rules.Rules, branch)
+	facts.ID = found.Result.ID
+	return facts, nil
+}
+
+// protectionRule is a branch protection rule as the forge's tool summarises it.
+type protectionRule struct {
+	Rule             string   `json:"rule"`
+	Push             bool     `json:"push"`
+	RequiredStatuses []string `json:"required_statuses"`
+	AdminMayOverride bool     `json:"admin_may_override"`
+}
+
+// judgedRule judges the one rule the forge applies to a branch, as the forge picks it: the rule named for the
+// branch, else the first glob rule, in the forge's order, that covers it (gitea's first matching rule). Never a
+// later rule that happens to be stronger: the forge does not read it.
+func judgedRule(rules []protectionRule, branch string) forgeFacts {
+	var applied *protectionRule
+	for i := range rules {
+		if rules[i].Rule == branch {
+			applied = &rules[i]
+			break
+		}
+	}
+	if applied == nil {
+		for i := range rules {
+			if ruleCovers(rules[i].Rule, branch) {
+				applied = &rules[i]
+				break
+			}
+		}
+	}
+	switch r := applied; {
+	case r == nil:
+		return forgeFacts{Why: fmt.Sprintf("no protection rule covers %s", branch)}
+	case r.Push:
+		return forgeFacts{Why: fmt.Sprintf("the rule %s lets a person push to %s directly", r.Rule, branch)}
+	case len(r.RequiredStatuses) == 0:
+		return forgeFacts{Why: fmt.Sprintf("the rule %s requires no status before a merge into %s", r.Rule, branch)}
+	case r.AdminMayOverride:
+		return forgeFacts{Why: fmt.Sprintf("the rule %s lets an administrator merge into %s past a status", r.Rule, branch)}
+	}
+	return forgeFacts{Guarded: true}
+}
+
+// ruleCovers says a protection rule's name — a branch, or a glob of them — covers a branch, as the forge reads it.
+func ruleCovers(rule, branch string) bool {
+	if rule == branch {
+		return true
+	}
+	if !strings.ContainsAny(rule, "*?[") {
+		return false
+	}
+	var re strings.Builder
+	re.WriteString("^")
+	for i := 0; i < len(rule); i++ {
+		switch c := rule[i]; {
+		case c == '*' && i+1 < len(rule) && rule[i+1] == '*':
+			re.WriteString(".*")
+			i++
+		case c == '*':
+			re.WriteString("[^/]*")
+		case c == '?':
+			re.WriteString("[^/]")
+		default:
+			re.WriteString(regexp.QuoteMeta(string(c)))
+		}
+	}
+	re.WriteString("$")
+	ok, _ := regexp.MatchString(re.String(), branch)
+	return ok
+}
+
+// onTheForge is a source's owner and name on the mesh's own forge (the git seat's holder), and whether it is
+// there at all.
+func (f *sourceForms) onTheForge(repository, seat string) (owner, name string, ok bool) {
+	var rest string
+	switch {
+	case seat == gitSeat:
+		rest = strings.Trim(repository, "/")
+	case seat == "":
+		base := f.base(gitSeat)
+		if base == "" {
+			return "", "", false
+		}
+		url, prefix := f.canonical(repository, ""), f.canonical(base, "")+"/"
+		if !strings.HasPrefix(url, prefix) {
+			return "", "", false
+		}
+		// The case the forge spells it with: the URL as given, past the base.
+		rest = strings.TrimSuffix(strings.Trim(repository[len(prefix):], "/"), ".git")
+	default:
+		return "", "", false
+	}
+	parts := strings.Split(rest, "/")
+	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+		return "", "", false
+	}
+	return parts[0], parts[1], true
+}
+
+// mayRegisterFrom says whether a build's outcome may register module from the source it was built from, and the
+// forge's id of that repository to record (novox/hq ADR 0266). Through any verb, only:
+//
+//   - from the module's registered repository — the same repository by the forge's own id, not only its name; or,
+//     for a module new to the catalogue, from a repository the catalogue builds another module from;
+//   - and from a repository on the mesh's forge whose trunk is protected as a trunk must be: no direct push, at
+//     least one required status, no administrator merging past one.
+//
+// Anything else only when the build request was kept as asked at the controller's terminal, for this very
+// repository and path. path is the module's directory as built; branch the trunk it is registered from.
+func mayRegisterFrom(ctx context.Context, inv *inventory.Inventory, module string, built inventory.Source,
+	buildID, path, branch string) (int64, error) {
+	forms := newSourceForms(ctx, inv)
+	was, err := inv.SourceOf(ctx, module)
+	isNew := errors.Is(err, inventory.ErrNoSuchModule)
+	if err != nil && !isNew {
+		return 0, err
+	}
+	terminal, err := askedHereFor(ctx, inv, forms, buildID, built, path)
+	if err != nil {
+		return 0, err
+	}
+	refuse := func(why string) (int64, error) {
+		return 0, fmt.Errorf("%w: %s. A module is registered from such a source only by a build asked at the "+
+			"controller's terminal, never through a verb: a registered module is what the next push sends, and whoever "+
+			"may call a verb includes agents (novox/hq ADR 0266)", errNotItsSource, why)
+	}
+
+	var why string
+	var alongside []inventory.Entry // the modules a new one's repository already builds
+	switch {
+	case !isNew && forms.same(was.Repository, was.Seat, built.Repository, built.Seat):
+	case !isNew:
+		registered := was.Repository
+		if registered == "" {
+			registered = "no repository (it was handed over by hand)"
+		}
+		why = fmt.Sprintf("%s is built from %s, and this build is of %s", module, sourceWords(registered, was.Seat),
+			sourceWords(built.Repository, built.Seat))
+	default:
+		entries, err := inv.Catalogued(ctx)
+		if err != nil {
+			return 0, err
+		}
+		for _, e := range entries {
+			if !e.Provided && e.Source.Repository != "" &&
+				forms.same(e.Source.Repository, e.Source.Seat, built.Repository, built.Seat) {
+				alongside = append(alongside, e)
+			}
+		}
+		if len(alongside) == 0 {
+			why = fmt.Sprintf("%s is new to the catalogue, and %s is no repository the catalogue builds a module from",
+				module, sourceWords(built.Repository, built.Seat))
+		}
+	}
+	if why != "" && !terminal {
+		return refuse(why)
+	}
+
+	owner, name, onForge := forms.onTheForge(built.Repository, built.Seat)
+	if !onForge {
+		if terminal {
+			fmt.Printf("%s: %s is not on the mesh's forge — registered, as asked at the controller's terminal\n",
+				buildID, sourceWords(built.Repository, built.Seat))
+			return 0, nil
+		}
+		return refuse(fmt.Sprintf("%s is not on the mesh's forge, so whether its trunk is protected cannot be read",
+			sourceWords(built.Repository, built.Seat)))
+	}
+	facts, err := askTheForge(ctx, owner, name, branch)
+	if err != nil {
+		if terminal {
+			fmt.Printf("%s: the forge could not be asked about %s/%s (%v) — registered, as asked at the controller's "+
+				"terminal\n", buildID, owner, name, err)
+			return 0, nil
+		}
+		return refuse(fmt.Sprintf("the forge could not say whether %s/%s's %s is protected: %v", owner, name, branch, err))
+	}
+	if terminal {
+		if why != "" || !facts.Guarded {
+			fmt.Printf("%s: %s — registered, as asked at the controller's terminal\n", buildID,
+				strings.Trim(why+"; "+facts.Why, "; "))
+		}
+		return facts.ID, nil
+	}
+	if !facts.Guarded {
+		return refuse(fmt.Sprintf("%s/%s's %s is not protected as a module's trunk must be: %s", owner, name, branch,
+			facts.Why))
+	}
+	// The same repository by the forge's id, not only its name: one deleted and made again is another.
+	recorded := map[string]int64{}
+	if !isNew {
+		id, err := inv.SourceIdentity(ctx, module)
+		if err != nil {
+			return 0, err
+		}
+		recorded[module] = id
+	}
+	for _, e := range alongside {
+		id, err := inv.SourceIdentity(ctx, e.Manifest.Module)
+		if err != nil {
+			return 0, err
+		}
+		recorded[e.Manifest.Module] = id
+	}
+	for m, id := range recorded {
+		if id != 0 && id != facts.ID {
+			return refuse(fmt.Sprintf("%s/%s is not the repository %s was registered from: the forge knows it as "+
+				"repository %d, and %s was registered from repository %d — one of that name deleted and made again",
+				owner, name, m, facts.ID, m, id))
+		}
+	}
+	return facts.ID, nil
+}
+
+// askedHereFor says the build was asked at the controller's terminal, for this repository and this path: a kept
+// request marked so, whose source is the outcome's (novox/hq ADR 0266).
+func askedHereFor(ctx context.Context, inv *inventory.Inventory, forms *sourceForms, buildID string,
+	built inventory.Source, path string) (bool, error) {
+	r, found, err := inv.BuildRequestByID(ctx, buildID)
+	if err != nil || !found || !r.AtTerminal {
+		return false, err
+	}
+	if !forms.same(r.Repository, r.Seat, built.Repository, built.Seat) ||
+		strings.Trim(r.Path, "/") != strings.Trim(path, "/") {
+		fmt.Printf("%s was asked at the terminal of %s at %q, and its outcome is of %s at %q: not the terminal's\n",
+			buildID, sourceWords(r.Repository, r.Seat), r.Path, sourceWords(built.Repository, built.Seat), path)
+		return false, nil
+	}
+	return true, nil
+}
+
+// sourceWords is a source as a person reads it.
+func sourceWords(repository, seat string) string {
+	if seat == "" {
+		return repository
+	}
+	return buildSource{Repository: repository, Seat: seat}.String()
+}
+
+// verbMayAsk refuses, for a call through a verb, a build of a repository the catalogue builds no module from
+// (novox/hq ADR 0266): the build node would run what an agent wrote, and its outcome could never be
+// registered anyway. url is the repository as it is cloned. At the terminal anything may be asked.
+func verbMayAsk(ctx context.Context, source buildSource, url string) error {
+	if startedAtTheTerminal() {
+		return nil
+	}
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	entries, err := open.inventory.Catalogued(ctx)
+	if err != nil {
+		return err
+	}
+	forms := newSourceForms(ctx, open.inventory)
+	if forms.buildsFrom(entries, source.Repository, source.Seat) || forms.buildsFrom(entries, url, "") {
+		return nil
+	}
+	return terminalRefusal("%s is no repository the catalogue builds a module from, and a build of any other is "+
+		"asked at the controller's terminal only, never through a verb: a build node runs what the repository "+
+		"says, and its outcome would register a module the next push sends — whoever may call a verb includes "+
+		"agents (novox/hq ADR 0266). Nothing was asked", source)
+}

cmd/mesh-controller/build_source_test.go

@@ -0,0 +1,380 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"hash/fnv"
+	"os"
+	"os/exec"
+	"slices"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The routes to root a review of ADR 0266 found (novox/hq ADR 0266 §7): an agent makes a repository of its
+// own — or forks one the mesh builds from — commits a module.json naming a module the mesh runs everywhere
+// (`sudo`, granting itself a rule without a password; `mesh-host`, the node-engine), and asks the `build` verb
+// for it. Its outcome was registered under that name from the agent's repository, and the next push sent it.
+
+// onTrunk is an outcome of a commit on its repository's trunk, as the build seat says it.
+func onTrunk(id, repository, seat, path string, manifest map[string]any) link.BuildResult {
+	raw, _ := json.Marshal(manifest)
+	r := link.BuildResult{ID: id, Repository: "http://forge.internal:20000/" + repository + ".git", Path: path,
+		Ref: "main", On: "anchor", Commit: "c0ffee0123456789", Manifest: raw,
+		Trunk: "main", OnTrunk: true, Branches: []string{"main"}}
+	if seat != "" {
+		r.Source = &link.SourceOnSeat{Seat: seat, Repository: repository}
+	}
+	return r
+}
+
+// keptAsked keeps a build request as the asker would: through a verb, or at the terminal.
+func keptAsked(t *testing.T, inv *inventory.Inventory, id, repository, path string, atTerminal bool) {
+	t.Helper()
+	if err := inv.RecordBuildRequest(t.Context(), inventory.BuildRequest{ID: id, Repository: repository, Seat: "git",
+		Path: path, For: "build", AtTerminal: atTerminal}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// theCatalogue is a mesh whose sudo is built from the catalogue repository and whose node-engine from its own.
+func theCatalogue(t *testing.T) *stores {
+	t.Helper()
+	open := aMesh(t)
+	ctx := t.Context()
+	for _, b := range []link.BuildResult{
+		onTrunk("build-sudo", "novox/mesh-catalog", "git", "modules/sudo", map[string]any{"module": "sudo", "version": "1"}),
+		onTrunk("build-host", "novox/mesh-host", "git", "", map[string]any{"module": "mesh-host", "version": "1"}),
+	} {
+		keptAsked(t, open.inventory, b.ID, b.Source.Repository, b.Path, true)
+		if _, _, err := takeIn(ctx, open.inventory, b); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return open
+}
+
+func TestABuildFromAnAgentsRepositoryIsNotRegisteredAsAModuleTheMeshHolds(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	for _, c := range []struct {
+		name, repository, path, module string
+	}{
+		{"its own repository naming sudo", "agent/sudo", "modules/sudo", "sudo"},
+		{"a fork of the catalogue", "agent/mesh-catalog", "modules/sudo", "sudo"},
+		{"a fork of the node-engine", "agent/mesh-host", "", "mesh-host"},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			id := "build-" + strings.ReplaceAll(c.repository, "/", "-")
+			keptAsked(t, open.inventory, id, c.repository, c.path, false) // through the build verb
+			evil := onTrunk(id, c.repository, "git", c.path, map[string]any{"module": c.module, "version": "evil"})
+			_, _, err := takeIn(ctx, open.inventory, evil)
+			if !errors.Is(err, errNotItsSource) {
+				t.Fatalf("a build of %s was taken in as %s: %v", c.repository, c.module, err)
+			}
+			shelf, err := open.inventory.Catalogue(ctx)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got := shelf[c.module].Version; got != "1" {
+				t.Fatalf("%s is now %q, from %s", c.module, got, c.repository)
+			}
+			if _, found, _ := open.inventory.BuildByID(ctx, id); !found {
+				t.Errorf("the refused build %s is not recorded", id)
+			}
+		})
+	}
+}
+
+func TestANewModuleFromARepositoryTheCatalogueDoesNotBuildFromIsNotRegistered(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	keptAsked(t, open.inventory, "build-new", "agent/tools", "", false)
+	_, _, err := takeIn(ctx, open.inventory, onTrunk("build-new", "agent/tools", "git", "",
+		map[string]any{"module": "agent-tools", "version": "1"}))
+	if !errors.Is(err, errNotItsSource) {
+		t.Fatalf("a new module from an agent's repository was taken in: %v", err)
+	}
+	// And one asked of nobody here — an outcome on the bus no request was kept for — the same.
+	_, _, err = takeIn(ctx, open.inventory, onTrunk("build-unasked", "agent/tools", "git", "",
+		map[string]any{"module": "agent-tools", "version": "1"}))
+	if !errors.Is(err, errNotItsSource) {
+		t.Fatalf("an outcome nobody asked for was taken in: %v", err)
+	}
+	if shelf, _ := open.inventory.Catalogue(ctx); shelf["agent-tools"].Module != "" {
+		t.Fatal("the refused module is in the catalogue")
+	}
+}
+
+// The operator at the terminal may still move a module, or add one from a new repository.
+func TestAtTheTerminalAnotherRepositoryIsRegistered(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	keptAsked(t, open.inventory, "build-moved", "novox/sudo", "", true)
+	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-moved", "novox/sudo", "git", "",
+		map[string]any{"module": "sudo", "version": "2"})); err != nil {
+		t.Fatalf("a move the operator asked for at the terminal was refused: %v", err)
+	}
+	if src, _ := open.inventory.SourceOf(ctx, "sudo"); src.Repository != "novox/sudo" {
+		t.Fatalf("sudo is built from %q", src.Repository)
+	}
+	if err := open.inventory.RecordBuildRequest(ctx, inventory.BuildRequest{ID: "build-external",
+		Repository: "http://forge.internal:20000/someone/app.git", For: "build", AtTerminal: true}); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-external", "someone/app", "", "",
+		map[string]any{"module": "app", "version": "1"})); err != nil {
+		t.Fatalf("a new module the operator asked for at the terminal was refused: %v", err)
+	}
+}
+
+// The delivery's flow is untouched: a merge's rebuild of a module from its own repository, and a merge adding
+// a module to a repository the catalogue builds from (novox/hq issue 300), are registered with no terminal.
+func TestADeliveryFromTheRegisteredRepositoryIsRegistered(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	rebuilt := onTrunk("build-plan", "novox/mesh-catalog", "git", "modules/sudo", map[string]any{"module": "sudo", "version": "2"})
+	if err := open.inventory.RecordBuildRequest(ctx, inventory.BuildRequest{ID: rebuilt.ID,
+		Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/sudo", For: "plan"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := takeIn(ctx, open.inventory, rebuilt); err != nil {
+		t.Fatalf("a plan's build of the module's own repository was refused: %v", err)
+	}
+	added := onTrunk("build-merge", "novox/mesh-catalog", "git", "modules/zram", map[string]any{"module": "zram", "version": "1"})
+	if _, _, err := takeIn(ctx, open.inventory, added); err != nil {
+		t.Fatalf("a module a merge added to the catalogue repository was refused: %v", err)
+	}
+	shelf, _ := open.inventory.Catalogue(ctx)
+	if shelf["sudo"].Version != "2" || shelf["zram"].Module == "" {
+		t.Fatalf("not registered: sudo %q, zram %q", shelf["sudo"].Version, shelf["zram"].Module)
+	}
+}
+
+// Through a verb, a build of a repository the catalogue builds nothing from is not even asked: the build node
+// would run what the agent wrote.
+func TestAVerbAsksNoBuildOfARepositoryTheCatalogueDoesNotBuildFrom(t *testing.T) {
+	theCatalogue(t)
+	ctx := t.Context()
+	t.Setenv(verbVar, "build")
+	t.Setenv(link.CallerVar, "node-tools.anchor, through the mesh-controller seat")
+	err := verbMayAsk(ctx, buildSource{Repository: "agent/sudo", Seat: "git"}, "http://forge.internal:20000/agent/sudo.git")
+	var policy *heldAtTheTerminal
+	if !errors.As(err, &policy) {
+		t.Fatalf("a verb's build of an agent's repository was asked: %v", err)
+	}
+	if err := verbMayAsk(ctx, buildSource{Repository: "novox/mesh-catalog", Seat: "git"},
+		"http://forge.internal:20000/novox/mesh-catalog.git"); err != nil {
+		t.Fatalf("a verb's build of the catalogue repository was refused: %v", err)
+	}
+	t.Setenv(verbVar, "")
+	t.Setenv(link.CallerVar, "")
+	if err := verbMayAsk(ctx, buildSource{Repository: "agent/sudo", Seat: "git"}, ""); err != nil {
+		t.Fatalf("the terminal was refused: %v", err)
+	}
+}
+
+// asTheOperator keeps a build as asked at the controller's terminal, as the operator's first build of a module
+// from a repository the catalogue does not yet build from is (novox/hq ADR 0266), and hands it back.
+func asTheOperator(t *testing.T, inv *inventory.Inventory, b link.BuildResult) link.BuildResult {
+	t.Helper()
+	repository, seat := b.Repository, ""
+	if b.Source != nil {
+		repository, seat = b.Source.Repository, b.Source.Seat
+	}
+	if err := inv.RecordBuildRequest(t.Context(), inventory.BuildRequest{ID: b.ID, Repository: repository, Seat: seat,
+		Path: b.Path, For: "build", AtTerminal: true}); err != nil {
+		t.Fatal(err)
+	}
+	return b
+}
+
+// A rollback puts back only a build of the module's own repository: an agent's build of the module's name,
+// recorded and refused, at the very commit the machine ran before (a fork carries it), is never registered by
+// the back door of a failed gate.
+func TestARollbackNeverPutsBackABuildFromAnotherRepository(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	inv := open.inventory
+	fork := onTrunk("build-1791500000000000000", "agent/mesh-catalog", "git", "modules/sudo",
+		map[string]any{"module": "sudo", "version": "evil"})
+	fork.Commit = "c0ffee0123456789" // the commit sudo was registered at
+	keptAsked(t, inv, fork.ID, "agent/mesh-catalog", "modules/sudo", false)
+	if _, _, err := takeIn(ctx, inv, fork); !errors.Is(err, errNotItsSource) {
+		t.Fatalf("the fork's build was taken in: %v", err)
+	}
+	failed := onTrunk("build-1791600000000000000", "novox/mesh-catalog", "git", "modules/sudo",
+		map[string]any{"module": "sudo", "version": "2"})
+	failed.Commit = "badbadbad0123456"
+	if _, _, err := takeIn(ctx, inv, failed); err != nil {
+		t.Fatal(err)
+	}
+	record, _, err := inv.BuildByID(ctx, failed.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	previous, found, err := inv.PreviousBuild(ctx, "sudo", "c0ffee0123456789", record)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if found && previous.ID == fork.ID {
+		t.Fatalf("a rollback would put back the fork's build %s", previous.ID)
+	}
+	if !found || previous.ID != "build-sudo" {
+		t.Fatalf("a rollback puts back %q (found %v), want the registered build-sudo", previous.ID, found)
+	}
+}
+
+// theForge is what the forge says in a test, by owner/name: a repository not named here is protected as a
+// trunk must be, with an id of its own.
+var theForge sync.Map
+
+func init() {
+	askTheForge = func(_ context.Context, owner, repo, _ string) (forgeFacts, error) {
+		if said, ok := theForge.Load(owner + "/" + repo); ok {
+			switch f := said.(type) {
+			case error:
+				return forgeFacts{}, f
+			case forgeFacts:
+				return f, nil
+			}
+		}
+		h := fnv.New32a()
+		_, _ = h.Write([]byte(owner + "/" + repo))
+		return forgeFacts{ID: int64(h.Sum32()), Guarded: true}, nil
+	}
+}
+
+// A module's trunk the forge does not protect — direct pushes, no required status — or a forge that cannot say,
+// registers nothing through a verb: the trunk rule means nothing on a branch anyone pushes to.
+func TestATrunkTheForgeDoesNotProtectRegistersNothing(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	theForge.Store("novox/unguarded", forgeFacts{ID: 7, Why: "the rule main lets a person push to main directly"})
+	t.Cleanup(func() { theForge.Delete("novox/unguarded") })
+	first := onTrunk("build-unguarded-1", "novox/unguarded", "git", "", map[string]any{"module": "unguarded", "version": "1"})
+	keptAsked(t, open.inventory, first.ID, "novox/unguarded", "", true)
+	if _, _, err := takeIn(ctx, open.inventory, first); err != nil {
+		t.Fatalf("at the terminal: %v", err)
+	}
+	again := onTrunk("build-unguarded-2", "novox/unguarded", "git", "", map[string]any{"module": "unguarded", "version": "2"})
+	if _, _, err := takeIn(ctx, open.inventory, again); !errors.Is(err, errNotItsSource) ||
+		!strings.Contains(err.Error(), "push to main directly") {
+		t.Fatalf("a rebuild from an unprotected trunk was taken in: %v", err)
+	}
+	theForge.Store("novox/unguarded", errors.New("nothing serves gitea.gitea_api"))
+	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-unguarded-3", "novox/unguarded", "git", "",
+		map[string]any{"module": "unguarded", "version": "3"})); !errors.Is(err, errNotItsSource) {
+		t.Fatalf("a forge that could not say was read as a protected trunk: %v", err)
+	}
+	if shelf, _ := open.inventory.Catalogue(ctx); shelf["unguarded"].Version != "1" {
+		t.Fatalf("unguarded is %q", shelf["unguarded"].Version)
+	}
+}
+
+// A repository deleted and made again under the module's repository's name is another repository: the forge's
+// id, recorded at registration, tells them apart.
+func TestARepositoryMadeAgainUnderItsNameIsNotTheModulesSource(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	theForge.Store("novox/remade", forgeFacts{ID: 100, Guarded: true})
+	t.Cleanup(func() { theForge.Delete("novox/remade") })
+	first := onTrunk("build-remade-1", "novox/remade", "git", "", map[string]any{"module": "remade", "version": "1"})
+	keptAsked(t, open.inventory, first.ID, "novox/remade", "", true)
+	if _, _, err := takeIn(ctx, open.inventory, first); err != nil {
+		t.Fatal(err)
+	}
+	if id, _ := open.inventory.SourceIdentity(ctx, "remade"); id != 100 {
+		t.Fatalf("the forge's id was not recorded: %d", id)
+	}
+	theForge.Store("novox/remade", forgeFacts{ID: 101, Guarded: true}) // deleted, and made again by an agent
+	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-remade-2", "novox/remade", "git", "",
+		map[string]any{"module": "remade", "version": "evil"})); !errors.Is(err, errNotItsSource) ||
+		!strings.Contains(err.Error(), "made again") {
+		t.Fatalf("a repository made again under the name was taken in: %v", err)
+	}
+	// And a new module from it, beside the one registered from the first, the same.
+	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-remade-3", "novox/remade", "git", "modules/other",
+		map[string]any{"module": "other", "version": "1"})); !errors.Is(err, errNotItsSource) {
+		t.Fatalf("a new module from a repository made again was taken in: %v", err)
+	}
+}
+
+// The terminal's mark is the operator's for the repository and path they asked: an outcome of another, under that
+// build's id, is not theirs.
+func TestATerminalRequestCoversOnlyWhatItAsked(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	if err := open.inventory.RecordBuildRequest(ctx, inventory.BuildRequest{ID: "build-asked", Repository: "novox/app",
+		Seat: "git", Path: "modules/app", For: "build", AtTerminal: true}); err != nil {
+		t.Fatal(err)
+	}
+	other := onTrunk("build-asked", "agent/sudo", "git", "modules/app", map[string]any{"module": "sudo", "version": "evil"})
+	if _, _, err := takeIn(ctx, open.inventory, other); !errors.Is(err, errNotItsSource) {
+		t.Fatalf("an outcome of another repository under a terminal request's id was taken in: %v", err)
+	}
+	elsewhere := onTrunk("build-asked", "novox/app", "git", "modules/sudo", map[string]any{"module": "sudo", "version": "evil"})
+	if _, _, err := takeIn(ctx, open.inventory, elsewhere); !errors.Is(err, errNotItsSource) {
+		t.Fatalf("an outcome of another path under a terminal request's id was taken in: %v", err)
+	}
+}
+
+// The serving controller, and everything it starts, is never the terminal: a build asked in it reads as asked
+// through the mesh even when no verb and no caller is named.
+func TestTheServingControllerIsNeverTheTerminal(t *testing.T) {
+	t.Setenv(verbVar, "")
+	t.Setenv(link.CallerVar, "")
+	t.Setenv(servedVar, "")
+	if !startedAtTheTerminal() {
+		t.Fatal("a process started by hand is not the terminal")
+	}
+	markServed()
+	if startedAtTheTerminal() {
+		t.Fatal("the serving controller reads as the terminal")
+	}
+	child := exec.Command(os.Args[0], "-test.run=^$")
+	child.Env = os.Environ()
+	if !slices.Contains(child.Env, servedVar+"=1") {
+		t.Fatal("what the serving controller starts does not carry its mark")
+	}
+}
+
+// The forge applies one rule to a branch: the rule named for it, else the first glob that covers it. A stronger
+// rule later in the list is not what guards the branch, and is not read as if it were (the confirmation review).
+func TestTheRuleJudgedIsTheOneTheForgeApplies(t *testing.T) {
+	guarded := protectionRule{Rule: "*", RequiredStatuses: []string{"mesh/merge-gate"}}
+	open := protectionRule{Rule: "main", Push: true, RequiredStatuses: []string{"mesh/merge-gate"}}
+	if f := judgedRule([]protectionRule{guarded, open}, "main"); f.Guarded {
+		t.Error("an exact rule letting pushes was passed over for a glob that guards")
+	}
+	if f := judgedRule([]protectionRule{{Rule: "ma*", RequiredStatuses: nil}, {Rule: "*", RequiredStatuses: []string{"x"}}},
+		"main"); f.Guarded || !strings.Contains(f.Why, "ma*") {
+		t.Errorf("the first glob covering the branch was not the one judged: %+v", f)
+	}
+	if f := judgedRule([]protectionRule{{Rule: "release/*"}, {Rule: "main", RequiredStatuses: []string{"x"}}}, "main"); !f.Guarded {
+		t.Errorf("the rule named for the branch was not judged: %+v", f)
+	}
+	if f := judgedRule(nil, "main"); f.Guarded {
+		t.Error("no rule is no protection")
+	}
+}
+
+// An id the forge could not give keeps the id already recorded.
+func TestAnUnknownIdentityKeepsTheRecordedOne(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	if err := open.inventory.SetSourceIdentity(ctx, "sudo", 100); err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.SetSourceIdentity(ctx, "sudo", 0); err != nil {
+		t.Fatal(err)
+	}
+	if id, _ := open.inventory.SourceIdentity(ctx, "sudo"); id != 100 {
+		t.Fatalf("the recorded id became %d", id)
+	}
+}

cmd/mesh-controller/build_test.go

@@ -19,11 +19,11 @@ func TestABuildHeardIsRecordedAndRegistered(t *testing.T) {
 	open := aMesh(t)
 	ctx := t.Context()
 	manifest, _ := json.Marshal(map[string]any{"module": "shop", "version": "3"})
-	m, _, err := takeIn(ctx, open.inventory, link.BuildResult{
+	m, _, err := takeIn(ctx, open.inventory, asTheOperator(t, open.inventory, link.BuildResult{
 		ID: "b-1", Repository: "http://forge.internal:20000/novox/shop.git", Path: "modules/shop",
 		Ref: "main", On: "anchor", Commit: "abcdef0123", Manifest: manifest,
 		Source: &link.SourceOnSeat{Seat: "git", Repository: "novox/shop"},
-	})
+	}))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -78,7 +78,7 @@ func TestABuildAtACommitKeepsTheBranchTheModuleFollows(t *testing.T) {
 			Path: "modules/unifi", Ref: ref, On: "anchor", Commit: commit, Manifest: manifest,
 			Source: &link.SourceOnSeat{Seat: "git", Repository: "novox/mesh-catalog"}}
 	}
-	if _, _, err := takeIn(ctx, open.inventory, result("b-1", "main", "1111111aaaa")); err != nil {
+	if _, _, err := takeIn(ctx, open.inventory, asTheOperator(t, open.inventory, result("b-1", "main", "1111111aaaa"))); err != nil {
 		t.Fatal(err)
 	}
 	if _, _, err := takeIn(ctx, open.inventory, result("b-2", "9c97a8a", "9c97a8a1d2c3")); err != nil {
@@ -117,7 +117,7 @@ func TestAnOlderBuildHeardLaterDoesNotReplaceTheNewer(t *testing.T) {
 			Path: "modules/postgres", Ref: "main", On: "anchor", Commit: "efff5415", Manifest: manifest,
 			Source: &link.SourceOnSeat{Seat: "git", Repository: "novox/mesh-catalog"}}
 	}
-	if _, _, err := takeIn(ctx, open.inventory, result(newer, "4bcd5f73")); err != nil {
+	if _, _, err := takeIn(ctx, open.inventory, asTheOperator(t, open.inventory, result(newer, "4bcd5f73"))); err != nil {
 		t.Fatal(err)
 	}
 	_, _, err := takeIn(ctx, open.inventory, result(older, "0ab07fa9"))

cmd/mesh-controller/busobjects.go

@@ -53,26 +53,9 @@ func assertBusObjects(ctx context.Context, inv *inventory.Inventory, r broker.Ra
 	if err != nil {
 		return nil, err
 	}
-	// And the work queues of seats that name their caller or their kind, with each holder's worker
-	// (novox/hq ADR 0259 §3): an ask queues until the router takes it, a channel's work until that kind
-	// takes it.
-	trafficStreams, trafficWorkers, err := seatTrafficObjects(ctx, inv)
-	if err != nil {
-		return nil, err
-	}
 	// Every one tried, and every failure named: one module's consumer the bus refuses is no reason
 	// the modules after it in the list hear nothing (novox/hq issue 208, where this runs on each send).
 	var failed []error
-	for _, s := range trafficStreams {
-		if err := r.EnsureStream(s); err != nil {
-			failed = append(failed, fmt.Errorf("the work queue %s: %w", s.Name, err))
-		}
-	}
-	for _, c := range trafficWorkers {
-		if err := r.EnsureConsumer(c); err != nil {
-			failed = append(failed, fmt.Errorf("the worker %s on %s: %w", c.Name, c.Stream, err))
-		}
-	}
 	for _, c := range consumers {
 		if err := r.EnsureConsumer(c.Consumer); err != nil {
 			failed = append(failed, fmt.Errorf("how %s on %s hears what it consumes: %w", c.Module, c.Node, err))
@@ -147,37 +130,6 @@ func moduleConsumers(ctx context.Context, inv *inventory.Inventory) ([]broker.Mo
 	return broker.ConsumersOf(users), nil
 }
 
-// seatTrafficObjects is the work queues and workers of seats that name their caller or their kind, from
-// the records the user list is composed from.
-func seatTrafficObjects(ctx context.Context, inv *inventory.Inventory) ([]broker.Stream, []broker.Consumer, error) {
-	records, err := inv.BusRecords(ctx)
-	if err != nil {
-		return nil, nil, err
-	}
-	users, err := broker.Users(records)
-	if err != nil {
-		return nil, nil, err
-	}
-	streams, workers := broker.SeatTrafficObjects(users)
-	// And the queue of every such seat the catalogue declares, held or not: work queues from registration,
-	// so what is submitted before a holder is assigned waits for it (the correctness review of 2026-10-08).
-	declared, err := inv.DeclaredTrafficSeats(ctx)
-	if err != nil {
-		return nil, nil, err
-	}
-	have := map[string]bool{}
-	for _, s := range streams {
-		have[s.Name] = true
-	}
-	for _, s := range broker.TrafficQueues(declared) {
-		if !have[s.Name] {
-			streams = append(streams, s)
-			have[s.Name] = true
-		}
-	}
-	return streams, workers, nil
-}
-
 // moduleConsumerCount is how many modules hear what they consume, for the raise's one line.
 func moduleConsumerCount(ctx context.Context, inv *inventory.Inventory) (int, error) {
 	consumers, err := moduleConsumers(ctx, inv)

cmd/mesh-controller/calls_verb_test.go

@@ -37,8 +37,6 @@ func TestAPushAnswersBeforeItSends(t *testing.T) {
 	}{
 		{"push", map[string]any{"node": "anchor", "why": "w"}, true},
 		{"push", map[string]any{"why": "w"}, true},
-		{"command", map[string]any{"command": "push anchor --why w"}, true},
-		{"command", map[string]any{"command": "push --behind --why=w"}, true},
 		{"command", map[string]any{"command": "builds"}, false},
 		{"status", map[string]any{}, false},
 		{"assign", map[string]any{"node": "anchor", "module": "m"}, false},

cmd/mesh-controller/delivery_conditions.go

@@ -34,6 +34,8 @@ var deliveryOwnerWithin = 10 * time.Second
 // stalledLine is one delivery past its bound, as mesh-delivery's `stalled` says it.
 type stalledLine struct {
 	ID string `json:"id"`
+	// Number is the pull request's, for a line of a head the forge never announced (novox/hq issue 347).
+	Number int    `json:"number,omitempty"`
 	State  string `json:"state"`
 	For    string `json:"for"`
 	Bound  string `json:"bound"`

cmd/mesh-controller/doctor.go

@@ -121,11 +121,11 @@ var probeRegistry = []probe{
 	{ID: probeReconnectsID, Asserts: "no user of the bus had its connection dropped more than twelve times in the " +
 		"last hour: the bus module's nats_closed_connections", From: "issue 327", Kind: kindBusReconnects,
 		Phase: 1, run: probeReconnects},
-	// Root where the trusted parties run (novox/hq ADR 0259 §8): while an agent can become root there without a
+	// The account agents run as (novox/hq ADR 0266): where a machine names one, its node-engine has judged it
-	// person, an answer proven there proves nothing.
+	// unable to become root without a person — what ADR 0259 §8 rests an authorised answer on.
-	{ID: "D-root", Asserts: "no agent can become root without a person on a machine where the router or a channel " +
+	{ID: agentAccountProbe, Asserts: "every machine that names an agent account has it judged, on its node-engine's " +
-		"proving its sender runs: not by its own account, and not through a tool that runs its command as an account " +
+		"newest statement, unable to become root without a person", From: "ADR 0266, ADR 0259 §8",
-		"that can", From: "ADR 0259 §8", Kind: kindAgentRoot, Phase: 2, run: probeAgentRoot},
+		Kind: kindAgentCanBecomeRoot, Phase: 1, run: probeAgentAccounts},
 	{ID: "DW", Asserts: "the watchdogs of the signals table ran within three of their intervals",
 		From: "ADR 0227 rule 6: the watchers are watched", Kind: "watchdogs-silent", Phase: 1, run: probeWatchdogs},
 	// The core's health definitions (novox/hq to-be 45 §8, ADR 0236): what a core component's new build is

cmd/mesh-controller/facts.go

@@ -269,7 +269,8 @@ func gatherFacts(ctx context.Context, open *stores, busVersion string) (snapshot
 	engines := map[string]bool{}
 	for _, n := range nodes {
 		m := snapshot.Machine{Name: scrub.Machine(n.Name), Length: len(n.Name), Adopted: n.Adopted,
-			AccountHome: scrub.Text(n.AccountHome), NodeEngine: n.HostVersion, PublicDomain: domains[n.Name]}
+			AccountHome: scrub.Text(n.AccountHome), NodeEngine: n.HostVersion, PublicDomain: domains[n.Name],
+			AgentAccount: scrub.Account(n.AgentAccount), AgentAccountHome: scrub.Text(n.AgentAccountHome)}
 		switch n.Account {
 		case "", "root":
 			m.Account = n.Account

cmd/mesh-controller/gate_test.go

@@ -221,7 +221,8 @@ func TestABuildThatFailsItsGateIsRolledBackOnItsFirstMachineAndGoesNoFurther(t *
 		t.Fatalf("sent again after the rollback: %v", g.sent)
 	}
 	_, _, err = takeIn(ctx, inv, link.BuildResult{ID: "build-2", Repository: "novox/mesh-catalog", Path: "modules/app",
-		Commit: "c2", Manifest: mustJSON(t, catalogue.Manifest{Module: "app", Version: "c2"})})
+		Commit: "c2", Manifest: mustJSON(t, catalogue.Manifest{Module: "app", Version: "c2"}),
+		Source: &link.SourceOnSeat{Seat: "git", Repository: "novox/mesh-catalog"}})
 	if err == nil || !strings.Contains(err.Error(), "failed its gate") {
 		t.Fatalf("the failed build was registered again: %v", err)
 	}

cmd/mesh-controller/handacts_test.go

@@ -22,10 +22,6 @@ func TestARepairByHandWithoutAReasonIsRefused(t *testing.T) {
 		{"plans", map[string]any{"close": "plan-1"}},
 		{"plans", map[string]any{"stop": "plan-1"}},
 		{"hand-act", map[string]any{"what": "restarted the proxy", "cause": "proxy-stuck"}},
-		{"command", map[string]any{"command": "push anchor"}},
-		{"command", map[string]any{"command": "plans close plan-1"}},
-		{"command", map[string]any{"command": "broker consumer-reset EVENTS controller"}},
-		{"command", map[string]any{"command": "hand-act record restarted --cause x"}},
 	} {
 		argv, err := argvFor(c.verb, c.args)
 		if c.verb == "plans" && err == nil {
@@ -65,7 +61,6 @@ func TestARepairByHandCarriesItsReason(t *testing.T) {
 		{"plans", map[string]any{"retry": "plan-1"}, "plans retry plan-1"},
 		{"hand-act", map[string]any{"what": "restarted", "why": "hung", "cause": "proxy", "condition": "machine.a.silent"},
 			"hand-act record restarted --why hung --cause proxy --condition machine.a.silent"},
-		{"command", map[string]any{"command": "push anchor --why stuck"}, "push anchor --why stuck"},
 		{"command", map[string]any{"command": "plans plan-1"}, "plans plan-1"},
 	} {
 		argv, err := argvFor(c.verb, c.args)

cmd/mesh-controller/main.go

@@ -216,6 +216,10 @@ func run() error {
 func usage() {
 	fmt.Fprint(os.Stderr, `mesh-controller — the control plane
 
+  On a node the operator types these as 'mesh-cli <command>' (in zsh, 'nox <command>'): asked
+  through the node's engine, and run as the controller's terminal only on the control-node
+  (novox/hq ADR 0272).
+
   migrate                        bring each context's schema up to date
   prepare                        the same, asked the way the mesh asks any module (ADR 0135)
   node add <name> [--adopted]    create a node record; --adopted: the machine is in use

cmd/mesh-controller/merge_gate.go

@@ -1013,6 +1013,11 @@ func raiseFromFacts(ctx context.Context, open *stores, f snapshot.Facts, shelf m
 				return notes, err
 			}
 		}
+		if m.AgentAccount != "" {
+			if err := inv.SetAgentAccount(ctx, m.Name, m.AgentAccount, m.AgentAccountHome); err != nil {
+				return notes, err
+			}
+		}
 		if m.PublicDomain != "" {
 			if err := inv.SetPublicDomain(ctx, m.Name, m.PublicDomain); err != nil {
 				return notes, err

cmd/mesh-controller/meshcli.go

@@ -0,0 +1,261 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"os/exec"
+	"slices"
+	"strings"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The operator's command, `mesh-cli` (alias `nox`), answered here (novox/hq ADR 0272).
+//
+// mesh-cli asks the node-engine on its own machine; the engine reads the asking account from the kernel and asks
+// this controller on its own node's subject. Here it is judged — the controller's terminal, an ordinary call, or
+// nothing — and run as every verb's line is: a fresh process of this binary, with this process's environment.
+//
+// **The terminal** is a line from a node's operator account, on the control-node (§4). Phase 2 adds a node whose
+// agents run under an account of their own, judged unable to become root (ADR 0266, not built yet); until then no
+// other node is the terminal, because agents there run as its operator. **An ordinary call** is a line from that
+// account elsewhere: it meets every refusal of the generic `command` verb and runs with `MESH_VERB=mesh-cli`, so a
+// terminal-only change is refused with its reason. **Any other account is refused**, root included: those two
+// accounts already reach the mesh's verbs through the mesh MCP server, and no other account gains anything here.
+
+// cliVerb is what a line from mesh-cli that is not the terminal runs as: the verb its process names, so every
+// terminal-only refusal applies and says it came through mesh-cli.
+const cliVerb = "mesh-cli"
+
+// cliServers are commands that serve until stopped. Run for mesh-cli they would hold a second server under this
+// one until the call's bound killed it.
+var cliServers = map[string]bool{"serve": true, "api": true, "board": true}
+
+// cliVerdict is how a line is run, or why it is not.
+type cliVerdict struct {
+	terminal bool
+	// why says why the line is or is not the terminal, in words the operator reads under the answer.
+	why string
+	// refused says why nothing runs.
+	refused string
+}
+
+// judgeCLI decides how a line from mesh-cli runs (ADR 0272 §4). nodes is every node the mesh knows; control is
+// every node the controller's module is assigned to, which is exactly one in a mesh that is well.
+func judgeCLI(node string, asked link.CLIAsked, nodes []inventory.Node, control []string) cliVerdict {
+	var record *inventory.Node
+	for i := range nodes {
+		if nodes[i].Name == node {
+			record = &nodes[i]
+			break
+		}
+	}
+	switch {
+	case record == nil:
+		return cliVerdict{refused: fmt.Sprintf("%s is not a node this mesh knows, so nothing ran", node)}
+	case asked.UID == 0 || asked.Account == "root":
+		return cliVerdict{refused: "mesh-cli answers the operator's own account, never root: run it as yourself, " +
+			"not under sudo. Nothing ran"}
+	case record.Account == "":
+		return cliVerdict{refused: fmt.Sprintf("the mesh does not know %s's operator account (`node account <node> <login>`), "+
+			"so no account there is answered. Nothing ran", node)}
+	case asked.Account != record.Account:
+		return cliVerdict{refused: fmt.Sprintf("mesh-cli answers %s's operator account (%s) only, and this line came "+
+			"from %s. Nothing ran", node, record.Account, asked.Account)}
+	}
+	if len(control) != 1 {
+		return cliVerdict{why: fmt.Sprintf("not the controller's terminal: the mesh names %d control-nodes, and the "+
+			"terminal is the one control-node's operator account", len(control))}
+	}
+	if control[0] == node {
+		// **A person at a terminal, not a service of the operator's** (review of ADR 0272): the tool runner and the
+		// account's user units run as the operator too, and only a login session is the terminal.
+		if asked.Session == "" {
+			return cliVerdict{why: fmt.Sprintf("not the controller's terminal: %s on %s asked from no login session — a "+
+				"service or a user unit running as the operator, not a person at a terminal", asked.Account, node)}
+		}
+		return cliVerdict{terminal: true, why: fmt.Sprintf("the controller's terminal: %s on the control-node %s, "+
+			"login session %s", asked.Account, node, asked.Session)}
+	}
+	return cliVerdict{why: fmt.Sprintf("not the controller's terminal: agents on %s may run as %s, so a "+
+		"terminal-only change is made from the control-node %s (novox/hq ADR 0272)", node, asked.Account, control[0])}
+}
+
+// controlNodes is every node the controller's module is assigned to.
+func controlNodes(ctx context.Context, inv *inventory.Inventory, nodes []inventory.Node) ([]string, error) {
+	var out []string
+	for _, n := range nodes {
+		modules, err := inv.Assigned(ctx, n.Name)
+		if err != nil {
+			return nil, err
+		}
+		if slices.Contains(modules, controllerModule) {
+			out = append(out, n.Name)
+		}
+	}
+	return out, nil
+}
+
+// controllerModule is the module that runs the controller, and so marks the control-node.
+const controllerModule = "mesh-controller"
+
+// answerMeshCLI is the serving controller's answer to mesh-cli.
+func answerMeshCLI(inv *inventory.Inventory) link.CLIHandler {
+	return func(ctx context.Context, node string, asked link.CLIAsked) link.CLIAnswer {
+		if handingOver.Load() {
+			return link.CLIRefusal("this controller is stopping and runs no new command; ask again in a moment. Nothing ran")
+		}
+		nodes, err := inv.Nodes(ctx)
+		if err != nil {
+			return link.CLIRefusal("the mesh's nodes cannot be read, so nothing ran: " + err.Error())
+		}
+		control, err := controlNodes(ctx, inv, nodes)
+		if err != nil {
+			return link.CLIRefusal("which node is the control-node cannot be read, so nothing ran: " + err.Error())
+		}
+		return runForMeshCLI(ctx, node, asked, judgeCLI(node, asked, nodes, control))
+	}
+}
+
+// cliJournal says one line in the controller's journal (its standard output); a variable so a test can read it.
+var cliJournal = func(line string) { fmt.Println(line) }
+
+// runForMeshCLI runs a judged line and answers what it said. Every line is said in the journal first: its call,
+// who asked on which node, its command word only, and how it runs (review of ADR 0272).
+func runForMeshCLI(ctx context.Context, node string, asked link.CLIAsked, v cliVerdict) link.CLIAnswer {
+	how := "as an ordinary call"
+	switch {
+	case v.refused != "":
+		how = "refused: " + v.refused
+	case v.terminal:
+		how = "as the controller's terminal"
+	}
+	call := link.CallIDIn(ctx)
+	if call == "" {
+		call = "(no call)"
+	}
+	cliJournal(fmt.Sprintf("mesh-cli %s: %s on %s asked %q, %s", call, asked.Account, node, asked.Line[0], how))
+	if v.refused != "" {
+		return link.CLIRefusal(v.refused)
+	}
+	if cliServers[asked.Line[0]] {
+		return link.CLIAnswer{Exit: 1, Why: v.why, Refused: fmt.Sprintf("%s serves until stopped, and is not a "+
+			"command line mesh-cli runs. Nothing ran", asked.Line[0])}
+	}
+	verb, line := "", asked.Line
+	if !v.terminal {
+		composed, err := ordinaryLine(asked.Line)
+		if err != nil {
+			return link.CLIAnswer{Exit: 1, Why: v.why, Refused: err.Error()}
+		}
+		verb, line = cliVerb, composed
+	}
+	cmd := selfCommand(ctx, line)
+	cmd.Env = commandEnvironment(fmt.Sprintf("%s through mesh-cli on %s", asked.Account, node), verb, v.terminal)
+	// No standard input: a command that reads one gets nothing, and fails saying so (ADR 0272 §5).
+	cmd.Stdin = nil
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout, cmd.Stderr = &stdout, &stderr
+	err := cmd.Run()
+	answer := link.CLIAnswer{Stdout: stdout.Bytes(), Stderr: stderr.Bytes(), Terminal: v.terminal, Why: v.why}
+	var exit *exec.ExitError
+	switch {
+	case err == nil:
+	case errors.As(err, &exit):
+		answer.Exit = exit.ExitCode()
+		if answer.Exit < 0 {
+			// Killed: by the call's bound, or by this controller stopping.
+			answer.Exit = 1
+			answer.Stderr = append(answer.Stderr, []byte(fmt.Sprintf("\nmesh-cli: the command was stopped (%v)\n",
+				exit))...)
+		}
+	default:
+		answer.Exit = 1
+		answer.Refused = fmt.Sprintf("could not run %s from this controller's own build: %v", strings.Join(asked.Line, " "), err)
+	}
+	return answer
+}
+
+// settingsForms is what an ordinary `settings` line may say: the settings verb's own forms.
+const settingsForms = "settings set <module> <values> [--replace] [--node <node>], settings clear <module> " +
+	"[--node <node>], settings show <module> [--history] [--node <node>], or settings preferences [<module>] " +
+	"[--node <node>]"
+
+// ordinaryLine is the command line an ordinary call runs (ADR 0272 §4): a `settings` line composed exactly as the
+// settings verb composes its own, so its refusals — the terminal-only keys among them — are that verb's (review of
+// ADR 0272); any other line as the generic `command` verb takes it, with its refusals.
+func ordinaryLine(argv []string) ([]string, error) {
+	if len(argv) == 0 || argv[0] != "settings" {
+		// What the generic verb runs, and nothing it would refuse: its reading forms only, and never a command that
+		// is the terminal's alone (novox/hq ADR 0266) — the two checks argvFor makes of the `command` verb's line,
+		// made of the words as given rather than re-split from one string.
+		if err := refusedAsTheGenericCommand(argv); err != nil {
+			return nil, err
+		}
+		if err := terminalOnly(argv); err != nil {
+			return nil, err
+		}
+		return argv, nil
+	}
+	args := map[string]any{}
+	var words []string
+	rest := argv[1:]
+	for i := 0; i < len(rest); i++ {
+		w := rest[i]
+		switch {
+		case w == "--replace" || w == "-replace":
+			args["replace"] = "true"
+		case w == "--history" || w == "-history":
+			args["history"] = "true"
+		case w == "--node" || w == "-node":
+			if i+1 >= len(rest) {
+				return nil, fmt.Errorf("--node names no node; settings takes %s. Nothing ran", settingsForms)
+			}
+			i++
+			args["node"] = rest[i]
+		case strings.HasPrefix(w, "--node=") || strings.HasPrefix(w, "-node="):
+			_, args["node"], _ = strings.Cut(w, "=")
+		case strings.HasPrefix(w, "-"):
+			return nil, fmt.Errorf("settings takes no %s through mesh-cli outside the terminal; it takes %s. "+
+				"Nothing ran", w, settingsForms)
+		default:
+			words = append(words, w)
+		}
+	}
+	wrong := fmt.Errorf("through mesh-cli outside the terminal, settings takes the settings verb's forms: %s. "+
+		"Nothing ran", settingsForms)
+	if len(words) == 0 {
+		return nil, wrong
+	}
+	switch words[0] {
+	case "set":
+		if len(words) != 3 {
+			return nil, wrong
+		}
+		args["module"], args["values"] = words[1], words[2]
+	case "clear":
+		if len(words) != 2 {
+			return nil, wrong
+		}
+		args["module"], args["clear"] = words[1], "true"
+	case "show":
+		if len(words) != 2 {
+			return nil, wrong
+		}
+		args["module"] = words[1]
+	case "preferences":
+		if len(words) > 2 {
+			return nil, wrong
+		}
+		args["list"] = "preferences"
+		if len(words) == 2 {
+			args["module"] = words[1]
+		}
+	default:
+		return nil, wrong
+	}
+	return argvFor("settings", args)
+}

cmd/mesh-controller/meshcli_test.go

@@ -0,0 +1,305 @@
+package main
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// echoEnvironment makes the test binary, run as a command line, say the verb and caller it was given (TestMain).
+const echoEnvironment = "MESH_TEST_ECHO_ENVIRONMENT"
+
+var cliNodes = []inventory.Node{
+	{Name: "control", Account: "operator"},
+	{Name: "laptop", Account: "operator"},
+	{Name: "unnamed"},
+}
+
+func asked(account string, uid uint32, line ...string) link.CLIAsked {
+	return link.CLIAsked{Line: line, Account: account, UID: uid, Session: "session-1.scope"}
+}
+
+// Who is the controller's terminal, and who is an ordinary call or refused (novox/hq ADR 0272 §4).
+func TestMeshCLIIsTheTerminalOnlyForTheControlNodesOperator(t *testing.T) {
+	control := []string{"control"}
+	cases := []struct {
+		name, node string
+		asked      link.CLIAsked
+		control    []string
+		terminal   bool
+		refused    string
+		why        string
+	}{
+		{"the control-node's operator", "control", asked("operator", 1000, "status"), control, true, "", "the controller's terminal"},
+		{"another node's operator", "laptop", asked("operator", 1000, "status"), control, false, "", "agents on laptop may run as operator"},
+		{"another account", "control", asked("agent", 1001, "status"), control, false, "operator account (operator) only", ""},
+		{"root", "control", asked("root", 0, "status"), control, false, "never root", ""},
+		{"a node with no operator account", "unnamed", asked("operator", 1000, "status"), control, false, "does not know unnamed's operator account", ""},
+		{"a node the mesh does not know", "elsewhere", asked("operator", 1000, "status"), control, false, "not a node this mesh knows", ""},
+		{"two control-nodes", "control", asked("operator", 1000, "status"), []string{"control", "laptop"}, false, "", "2 control-nodes"},
+	}
+	for _, c := range cases {
+		v := judgeCLI(c.node, c.asked, cliNodes, c.control)
+		if v.terminal != c.terminal {
+			t.Errorf("%s: terminal %v, want %v (%+v)", c.name, v.terminal, c.terminal, v)
+		}
+		if c.refused == "" && v.refused != "" || c.refused != "" && !strings.Contains(v.refused, c.refused) {
+			t.Errorf("%s: refused %q, want %q", c.name, v.refused, c.refused)
+		}
+		if c.why != "" && !strings.Contains(v.why, c.why) {
+			t.Errorf("%s: why %q, want %q", c.name, v.why, c.why)
+		}
+	}
+}
+
+// The terminal runs its line without MESH_VERB, even where this process carries one; an ordinary call names
+// mesh-cli; both record who asked through mesh-cli.
+func TestTheTerminalRunsWithoutAVerbAndAnOrdinaryCallNamesMeshCLI(t *testing.T) {
+	t.Setenv(echoEnvironment, "1")
+	t.Setenv("MESH_VERB", "leaked-from-the-serving-process")
+	// The serving controller marks itself (ADR 0266); its terminal line for mesh-cli is still the terminal's.
+	t.Setenv(servedVar, "1")
+	ctx := context.Background()
+
+	a := runForMeshCLI(ctx, "control", asked("operator", 1000, "status"), cliVerdict{terminal: true, why: "the terminal"})
+	if a.Exit != 0 || a.Refused != "" || !a.Terminal {
+		t.Fatalf("the terminal's line did not run: %+v", a)
+	}
+	if got := string(a.Stdout); !strings.Contains(got, `verb=""`) || !strings.Contains(got, "operator through mesh-cli on control") ||
+		!strings.Contains(got, "terminal=true") {
+		t.Fatalf("the terminal's line ran with %s", got)
+	}
+
+	a = runForMeshCLI(ctx, "laptop", asked("operator", 1000, "status"), cliVerdict{why: "not the terminal"})
+	if a.Exit != 0 || a.Terminal || a.Why != "not the terminal" {
+		t.Fatalf("an ordinary line did not run as one: %+v", a)
+	}
+	if got := string(a.Stdout); !strings.Contains(got, `verb="mesh-cli"`) || !strings.Contains(got, "terminal=false") {
+		t.Fatalf("an ordinary line ran with %s", got)
+	}
+}
+
+// An ordinary call meets every refusal of the generic command verb, and nothing runs; a server is never run.
+func TestAnOrdinaryCallMeetsTheCommandVerbsRefusals(t *testing.T) {
+	t.Setenv(echoEnvironment, "1")
+	ctx := context.Background()
+	ordinary := cliVerdict{why: "not the terminal"}
+	a := runForMeshCLI(ctx, "laptop", asked("operator", 1000, "cleanup", "delete", "x"), ordinary)
+	if a.Refused == "" || len(a.Stdout) != 0 || a.Exit != 1 || a.Why != "not the terminal" {
+		t.Fatalf("a repair without --why ran as an ordinary call: %+v", a)
+	}
+	a = runForMeshCLI(ctx, "laptop", asked("operator", 1000, "settings", "set", "claude-code", "{}"), ordinary)
+	if a.Refused != "" || !strings.Contains(string(a.Stdout), `verb="mesh-cli"`) {
+		t.Fatalf("an ordinary settings set did not run through the settings verb's path with MESH_VERB set: %+v", a)
+	}
+	for _, server := range []string{"serve", "api", "board"} {
+		a := runForMeshCLI(ctx, "control", asked("operator", 1000, server), cliVerdict{terminal: true})
+		if a.Refused == "" || len(a.Stdout) != 0 {
+			t.Fatalf("%s was run for mesh-cli: %+v", server, a)
+		}
+	}
+	a = runForMeshCLI(ctx, "control", asked("agent", 1001, "status"), cliVerdict{refused: "agent is not answered"})
+	if a.Refused != "agent is not answered" || len(a.Stdout) != 0 {
+		t.Fatalf("a refused line ran: %+v", a)
+	}
+}
+
+// **Which node is the terminal does not follow a verb** (review of ADR 0272): the controller's module is assigned
+// and unassigned at the terminal alone, so no caller of `assign` can move the terminal to a node of its choosing.
+// Asked through the acts themselves, as the verbs ask them; refused before any store is touched (none is given).
+func TestTheControllersModuleIsMovedAtTheTerminalAlone(t *testing.T) {
+	t.Setenv("MESH_VERB", "assign")
+	ctx := context.Background()
+	if _, err := assignWith(ctx, nil, "laptop", assignOptions{}, "zsh", "mesh-controller"); err == nil ||
+		!strings.Contains(err.Error(), "terminal") {
+		t.Fatalf("assigning the controller through a verb was not refused: %v", err)
+	}
+	if _, err := assign(ctx, nil, "laptop", "mesh-controller"); err == nil || !strings.Contains(err.Error(), "terminal") {
+		t.Fatalf("assigning the controller through a verb was not refused: %v", err)
+	}
+	t.Setenv("MESH_VERB", "unassign")
+	if _, err := unassign(ctx, nil, "control", "mesh-controller"); err == nil || !strings.Contains(err.Error(), "terminal") {
+		t.Fatalf("unassigning the controller through a verb was not refused: %v", err)
+	}
+	// Another module through a verb, and the controller's at the terminal, are not refused for it.
+	if err := refusedMovingTheController([]string{"zsh"}); err != nil {
+		t.Fatalf("another module was refused: %v", err)
+	}
+	t.Setenv("MESH_VERB", "")
+	if err := refusedMovingTheController([]string{"mesh-controller"}); err != nil {
+		t.Fatalf("the terminal was refused: %v", err)
+	}
+}
+
+// An ordinary `settings set|clear` goes down the settings verb's own path: composed as that verb composes it, and
+// run with MESH_VERB set, so its refusals — the terminal-only keys among them — are the settings command's own,
+// not a blanket refusal of the generic command (review of ADR 0272).
+func TestAnOrdinarySettingsLineTakesTheSettingsVerbsPath(t *testing.T) {
+	cases := []struct {
+		line []string
+		want string
+		err  string
+	}{
+		{[]string{"settings", "set", "zsh", `{"execute":"withhold"}`, "--node", "laptop"}, `settings set zsh {"execute":"withhold"} --node laptop`, ""},
+		{[]string{"settings", "set", "zsh", "{}", "--replace"}, "settings set zsh {} --replace", ""},
+		{[]string{"settings", "clear", "zsh", "--node", "laptop"}, "settings clear zsh --node laptop", ""},
+		{[]string{"settings", "show", "zsh", "--history"}, "settings show zsh --history", ""},
+		{[]string{"settings", "preferences"}, "settings preferences", ""},
+		{[]string{"settings", "set", "zsh"}, "", "settings"},
+		{[]string{"settings", "set", "zsh", "{}", "--sideways"}, "", "--sideways"},
+	}
+	for _, c := range cases {
+		argv, err := ordinaryLine(c.line)
+		if c.err != "" {
+			if err == nil || !strings.Contains(err.Error(), c.err) {
+				t.Errorf("%q: refused with %v, want %q", c.line, err, c.err)
+			}
+			continue
+		}
+		if err != nil || strings.Join(argv, " ") != c.want {
+			t.Errorf("%q: composed %q (%v), want %q", c.line, argv, err, c.want)
+		}
+	}
+	// Anything else still meets the generic command verb's refusals.
+	if _, err := ordinaryLine([]string{"retire", "delete", "x"}); err == nil {
+		t.Error("a repair composed as an ordinary line")
+	}
+}
+
+// Every line is said in the controller's journal, with its call, who asked where and how it ran — its command word
+// only, never the rest of the line (review of ADR 0272).
+func TestEveryMeshCLILineIsSaidInTheJournal(t *testing.T) {
+	t.Setenv(echoEnvironment, "1")
+	var said []string
+	was := cliJournal
+	cliJournal = func(line string) { said = append(said, line) }
+	t.Cleanup(func() { cliJournal = was })
+	ctx := link.WithCallID(context.Background(), "call-1")
+	runForMeshCLI(ctx, "control", asked("operator", 1000, "settings", "set", "x", `{"password":"s3cret"}`),
+		cliVerdict{terminal: true, why: "the terminal"})
+	runForMeshCLI(ctx, "control", asked("agent", 1001, "status"), cliVerdict{refused: "agent is not answered"})
+	all := strings.Join(said, "\n")
+	if len(said) != 2 || !strings.Contains(all, "call-1") || !strings.Contains(all, "operator on control") ||
+		!strings.Contains(all, "as the controller's terminal") || !strings.Contains(all, "refused") {
+		t.Fatalf("the journal said %q", said)
+	}
+	if strings.Contains(all, "s3cret") {
+		t.Fatalf("the journal carries the line's values: %q", said)
+	}
+}
+
+// **An ordinary line runs only what the generic command verb would** (review of ADR 0272, ADR 0266): its reading
+// forms, and never a command that is the terminal's alone. Each of these, from another node's operator, is refused
+// and runs nothing.
+func TestAnOrdinaryLineRunsNothingTheCommandVerbWouldRefuse(t *testing.T) {
+	t.Setenv(echoEnvironment, "1")
+	for _, line := range [][]string{
+		{"node", "account", "control", "x"},
+		{"node", "agent-account", "control", "x", "--clear"},
+		{"token", "issue", "laptop"},
+		{"secret", "export", "x"},
+		{"operator", "key", "set", "x"},
+		{"assign", "laptop", "zsh"},
+	} {
+		if _, err := ordinaryLine(line); err == nil {
+			t.Errorf("%q composed as an ordinary line", line)
+		}
+		a := runForMeshCLI(context.Background(), "laptop", asked("operator", 1000, line...), cliVerdict{why: "not the terminal"})
+		if a.Refused == "" || len(a.Stdout) != 0 {
+			t.Errorf("%q ran as an ordinary line: %+v", line, a)
+		}
+	}
+	if argv, err := ordinaryLine([]string{"status"}); err != nil || argv[0] != "status" {
+		t.Fatalf("a read was refused: %v", err)
+	}
+}
+
+// **`calls` never shows a mesh-cli line's answer** (review of ADR 0272): the verb's own answer is read for a line
+// served over a bus, and neither the answer's text nor the base64 JSON writes its bytes in is there.
+func TestTheCallsVerbNeverShowsAMeshCLILinesAnswer(t *testing.T) {
+	conn, err := nats.Connect(testbus.URL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	stop, err := link.OverNATS{Conn: conn}.ServeCLI(func(context.Context, string, link.CLIAsked) link.CLIAnswer {
+		return link.CLIAnswer{Stdout: []byte("s3cret-join")}
+	}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer stop()
+	body, _ := json.Marshal(link.CLIAsked{Line: []string{"token", "issue", "x"}, Account: "operator"})
+	msg, err := conn.Request(link.CLISubject("control"), body, 5*time.Second)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(msg.Data), base64.StdEncoding.EncodeToString([]byte("s3cret-join"))) {
+		t.Fatalf("the asker was not given its answer: %s", msg.Data)
+	}
+	recent, _ := link.Calls.Recent()
+	var id string
+	for _, c := range recent {
+		if c.Seat == link.CLISeat {
+			id = c.ID
+			break
+		}
+	}
+	shown, err := callsAnswer(link.Calls, id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	said, _ := json.Marshal(shown)
+	if strings.Contains(string(said), "s3cret-join") ||
+		strings.Contains(string(said), base64.StdEncoding.EncodeToString([]byte("s3cret-join"))) {
+		t.Fatalf("calls showed a mesh-cli line's answer: %s", said)
+	}
+}
+
+// **Only the terminal's line carries the terminal's mark** (review of ADR 0272): a mark the serving controller's
+// environment holds — leaked, or set by anything — is stripped from every other command line it runs, a verb's and
+// an ordinary mesh-cli line alike, so neither reads as the terminal.
+func TestTheTerminalsMarkIsStrippedFromEveryOtherLine(t *testing.T) {
+	t.Setenv(echoEnvironment, "1")
+	t.Setenv(cliTerminalVar, "1")
+	t.Setenv(servedVar, "1")
+	for _, env := range [][]string{commandEnvironment("someone", "status", false)} {
+		for _, kv := range env {
+			if strings.HasPrefix(kv, cliTerminalVar+"=") {
+				t.Fatalf("a verb's line carries the terminal's mark: %s", kv)
+			}
+		}
+	}
+	a := runForMeshCLI(context.Background(), "laptop", asked("operator", 1000, "status"), cliVerdict{why: "not the terminal"})
+	if got := string(a.Stdout); !strings.Contains(got, "terminal=false") || !strings.Contains(got, `verb="mesh-cli"`) {
+		t.Fatalf("an ordinary line with the mark in the serving environment ran as %s", got)
+	}
+	a = runForMeshCLI(context.Background(), "control", asked("operator", 1000, "status"), cliVerdict{terminal: true})
+	if got := string(a.Stdout); !strings.Contains(got, "terminal=true") {
+		t.Fatalf("the terminal's line ran as %s", got)
+	}
+}
+
+// **Only a login session is the terminal** (review of ADR 0272): the operator's account on the control-node, asking
+// from a service — the tool runner, a user unit — and not a login session, is an ordinary call.
+func TestOnlyALoginSessionIsTheTerminal(t *testing.T) {
+	control := []string{"control"}
+	v := judgeCLI("control", link.CLIAsked{Line: []string{"status"}, Account: "operator", UID: 1000}, cliNodes, control)
+	if v.terminal || v.refused != "" || !strings.Contains(v.why, "login session") {
+		t.Fatalf("a line from no login session reads %+v", v)
+	}
+	v = judgeCLI("control", link.CLIAsked{Line: []string{"status"}, Account: "operator", UID: 1000, Session: "session-3.scope"},
+		cliNodes, control)
+	if !v.terminal {
+		t.Fatalf("a line from a login session on the control-node reads %+v", v)
+	}
+}

cmd/mesh-controller/module_health.go

@@ -73,7 +73,7 @@ func stateHealth(ctx context.Context, inv *inventory.Inventory, k *conditions.Ke
 	for _, r := range h.Resources {
 		kept := inventory.ResourceHealth{Module: r.Module, Resource: r.Resource, Kind: r.Kind, Target: r.Target,
 			State: r.State, Reason: r.Reason, Since: r.Since, Streak: r.Streak, Restarts: r.Restarts,
-			Check: r.Check, Needs: r.Needs, Account: r.Account}
+			Check: r.Check, Needs: r.Needs, Account: r.Account, Root: r.Root}
 		resources = append(resources, kept)
 		if r.State == link.StateUnhealthy && r.Module != "" {
 			unhealthy[r.Module] = append(unhealthy[r.Module], kept)

cmd/mesh-controller/modules.go

@@ -1107,7 +1107,7 @@ func refuseTerminalSettingsThroughAVerb(ctx context.Context, inv *inventory.Inve
 	}
 	// A trusted mergeable file takes any key, so its module's whole layer is the terminal's (novox/hq issue 340).
 	if files := catalogue.TrustedMergeable(shelf[module]); len(files) > 0 && !sameLayer(before, after) {
-		return fmt.Errorf("the settings of %s on %s are set at the controller's terminal only, never through a verb (this "+
+		return fmt.Errorf("the settings of %s on %s are set at the controller's terminal only (`mesh-cli` on the control-node), never through a verb (this "+
 			"line came through %q): %s merges whatever key a layer sets into a file root or a consumer trusts, so "+
 			"any key could point the module at a listener of the caller's, and whoever may call a verb includes "+
 			"agents (novox/hq issue 340; a file nothing trusts says \"trusted\": false). Nothing was changed",
@@ -1119,7 +1119,7 @@ func refuseTerminalSettingsThroughAVerb(ctx context.Context, inv *inventory.Inve
 		if string(was) == string(now) {
 			continue
 		}
-		return fmt.Errorf("%s of %s on %s is set at the controller's terminal only, never through a verb (this "+
+		return fmt.Errorf("%s of %s on %s is set at the controller's terminal only (`mesh-cli` on the control-node), never through a verb (this "+
 			"line came through %q): it says where root creates and owns a module's directories, which of "+
 			"the machine's paths are mounted into its container, what the mesh's consumers trust, or what a file "+
 			"root or a person's session obeys takes, and whoever may call a verb includes agents (novox/hq issue 339; "+

cmd/mesh-controller/nodes.go

@@ -100,6 +100,12 @@ func nodeCommand(ctx context.Context, args []string) error {
 			"containers reaching outward. The machine reports which of its links face outside; see " +
 			"`node show <name>`")
 
+	case "agent-account":
+		// The account agents run as on this machine, when it is not the operator's (novox/hq ADR 0266). Here,
+		// at the controller's terminal, and nowhere else: no verb and no setting names it, so no agent can
+		// name itself another account.
+		return nodeAgentAccount(ctx, inv, args[1:])
+
 	case "account":
 		// The operator's login on this machine (novox/hq to-be 29): what a home-scoped file is
 		// owned by and which account `ssh <node>` uses. Reports with no argument; sets with one;
@@ -107,7 +113,7 @@ func nodeCommand(ctx context.Context, args []string) error {
 		return nodeAccount(ctx, inv, args[1:])
 
 	default:
-		return fmt.Errorf("node has no %q; it has add, list, show, public-domain and account", args[0])
+		return fmt.Errorf("node has no %q; it has add, list, show, public-domain, account and agent-account", args[0])
 	}
 }
 
@@ -178,6 +184,57 @@ func nodeAccount(ctx context.Context, inv *inventory.Inventory, positionals []st
 	return nil
 }
 
+const agentAccountUsage = "node agent-account <name> — what it is now; " +
+	"<name> <account> [home] to name the account agents run as (home defaults to /home/<account>); " +
+	"<name> --clear to have them run as the operator account again"
+
+// nodeAgentAccount reports, names or clears the account agents run as on a node (novox/hq ADR 0266). Read-
+// shaped with no account, like public-domain; clearing is asked for by name.
+func nodeAgentAccount(ctx context.Context, inv *inventory.Inventory, args []string) error {
+	set := flag.NewFlagSet("node agent-account", flag.ContinueOnError)
+	clear := set.Bool("clear", false, "agents run as the operator account again")
+	positionals, err := parseAround(set, args)
+	if err != nil {
+		return err
+	}
+	if len(positionals) == 0 || len(positionals) > 3 {
+		return errors.New(agentAccountUsage)
+	}
+	node := positionals[0]
+	switch {
+	case *clear && len(positionals) > 1:
+		return fmt.Errorf("name an agent account for %s or --clear, not both", node)
+	case *clear:
+		if err := inv.SetAgentAccount(ctx, node, "", ""); err != nil {
+			return err
+		}
+		fmt.Printf("agents on %s run as the operator account again\n", node)
+		fmt.Printf("  run `push %s` to send it; the agent account itself is kept (the mesh never deletes a login)\n", node)
+		return nil
+	case len(positionals) >= 2:
+		home := ""
+		if len(positionals) == 3 {
+			home = positionals[2]
+		}
+		if err := inv.SetAgentAccount(ctx, node, positionals[1], home); err != nil {
+			return err
+		}
+		fmt.Printf("agents on %s run as %s\n", node, positionals[1])
+		fmt.Printf("  run `push %s` to send it; the self-check says once its node-engine has judged it "+
+			"unable to become root\n", node)
+		return nil
+	default:
+		n, err := inv.NodeByName(ctx, node)
+		if err != nil {
+			return err
+		}
+		for _, line := range agentAccountLines(ctx, inv, n) {
+			fmt.Println(strings.TrimPrefix(line, "  "))
+		}
+		return nil
+	}
+}
+
 const publicDomainUsage = "node public-domain <name> — what it is now; " +
 	"<name> <domain> to set it; <name> --clear to take it away"
 
@@ -592,6 +649,10 @@ func showNode(ctx context.Context, inv *inventory.Inventory, name string) error
 	if err := showMode(ctx, inv, node); err != nil {
 		return err
 	}
+	// Whom agents run as here, and whether that account can become root without a person (ADR 0266).
+	for _, line := range agentAccountLines(ctx, inv, node) {
+		fmt.Println(line)
+	}
 
 	// The domain its routed names are composed under, when it has one (novox/hq ADR 0066). Shown
 	// only when set: a machine that serves nothing to the outside has no domain, and saying so of

cmd/mesh-controller/plain_words.go

@@ -110,6 +110,15 @@ var plainWordings = map[string]func(conditions.Observation) words{
 				"reaches it. It keeps running what it has.", m),
 			Resolved: m + " can get new instructions again"}
 	}),
+	kindAgentCanBecomeRoot: worded(func(o conditions.Observation) words {
+		m := machineOr(o, "a machine")
+		return words{Headline: "Sessions on " + m + " could become root",
+			Needs: "take the sessions' own account out of every group and rule that grants root; the details say which.",
+			Explanation: fmt.Sprintf("Assistant sessions on %s run under an account of their own, so that none "+
+				"can take over the machine without you. The machine cannot show that this holds now, so an answer "+
+				"from your phone authorises nothing there until it does.", m),
+			Resolved: "Sessions on " + m + " cannot become root again"}
+	}),
 	"own-address-banned": worded(func(o conditions.Observation) words {
 		m := machineOr(o, "a machine")
 		return words{Headline: m + " has banned the mesh",
@@ -739,6 +748,25 @@ func stalledWords(l stalledLine, o conditions.Observation) (headline, explanatio
 	actions []conditions.Action) {
 	repository, _, _ := strings.Cut(l.ID, "@")
 	name := repoName(repository)
+	if l.State == "unannounced" {
+		// A pull request the forge never announced (novox/hq issue 347): no delivery exists, so there is nothing to
+		// stop, release or close; a new commit on its branch is announced and checked.
+		long := "for too long"
+		if d, err := time.ParseDuration(l.For); err == nil {
+			long = "for " + humanDuration(d)
+		}
+		if o.Resolver == conditions.ResolverOperator {
+			needs = "push a new commit to its branch; the forge announces it and the mesh checks it."
+		}
+		pull := "A pull request of " + name
+		if l.Number > 0 {
+			pull = fmt.Sprintf("Pull request %s #%d", name, l.Number)
+		}
+		return fmt.Sprintf("%s has had no merge check %s", pull, long),
+			fmt.Sprintf("%s has been open %s on a branch that requires the merge check, and the mesh was never asked "+
+				"to check it: the forge never announced it. It cannot merge until it is checked.", pull, long),
+			fmt.Sprintf("%s has a merge check now, or is closed", pull), needs, nil
+	}
 	held := l.State
 	if held == "" {
 		held = "held"

cmd/mesh-controller/plain_words_test.go

@@ -309,3 +309,24 @@ func TestANeedNoNotificationAnswersNamesTheMeshMCPServer(t *testing.T) {
 	}
 	check("updates held", releaseHeldWords([]string{"openrazer"}, []string{"g14"}))
 }
+
+// **A pull request the forge never announced says what to do about it** (novox/hq issue 347): mesh-delivery says one
+// as a stalled line in state `unannounced` — no delivery exists, so there is nothing to stop, release or close —
+// and the operator's one act is a new commit on its branch, which the forge announces.
+func TestAnUnannouncedPullRequestSaysToPushANewCommit(t *testing.T) {
+	l := stalledLine{ID: "novox/hq@bfe82315f42c", Number: 243, State: "unannounced", For: "11m0s", Bound: "10m0s",
+		H2:   "none: the forge never announced it, so there is no delivery to close — the operator's",
+		Says: "novox/hq#243 is open on main, which requires the merge check, and its head has had no merge check"}
+	obs := stalledObservations([]stalledLine{l})
+	if len(obs) != 1 || obs[0].Resolver != conditions.ResolverOperator {
+		t.Fatalf("an unannounced pull request is not the operator's: %+v", obs)
+	}
+	o := obs[0]
+	if strings.Contains(o.Needs, "stop") || strings.Contains(o.Needs, "release") || !strings.Contains(o.Needs, "commit") {
+		t.Fatalf("it says to %q", o.Needs)
+	}
+	if !strings.Contains(o.Headline, "no merge check") || !strings.Contains(o.Headline, "#243") ||
+		!strings.Contains(o.Explanation, "never") {
+		t.Fatalf("it reads %q / %q", o.Headline, o.Explanation)
+	}
+}

cmd/mesh-controller/plan.go

@@ -136,7 +136,8 @@ func planFor(ctx context.Context, open *stores, nodeName string) (catalogue.Reso
 	resolved, err := catalogue.Resolve(shelf, assigned,
 		catalogue.Node{Name: nodeName, Site: site, Capabilities: capabilities,
 			At: onNetwork[nodeName], PublicDomain: publicDomain,
-			Account: who.Account, AccountHome: who.AccountHome}, world)
+			Account: who.Account, AccountHome: who.AccountHome,
+			AgentAccount: who.AgentAccount, AgentAccountHome: who.AgentAccountHome}, world)
 	if err != nil {
 		// The node's own set does not compose. Marked, because this is the only failure here that
 		// a mesh-wide gatherer may pass over — see notResolvable.
@@ -511,6 +512,15 @@ func sortedKeysOf(m map[string]string) []string {
 	return out
 }
 
+// sayPlanDiff is `plan --diff`: what the declaration leaves out, then the diff. A module left out is not in
+// the body, so the diff alone would say "nothing would change" for a module just assigned whose settings
+// cannot compose — success-shaped silence. Said first, with why, as push and the plain plan say it
+// (novox/hq ADR 0163, rule 6).
+func sayPlanDiff(node string, declared sendable, diff func() error) error {
+	reportLeftOut(node, declared)
+	return diff()
+}
+
 // reportLeftOut says which of a machine's modules its declaration leaves out and why (novox/hq ADR
 // 0163, rule 6), one line each: the machine is told everything else, and is told it was left out.
 func reportLeftOut(node string, declared sendable) {
@@ -885,8 +895,13 @@ func renderingFor(ctx context.Context, open *stores, node string,
 	if err != nil {
 		return catalogue.Rendering{}, inventory.Node{}, err
 	}
+	judgesRoot, err := engineJudgesRoot(ctx, inv, node)
+	if err != nil {
+		return catalogue.Rendering{}, inventory.Node{}, err
+	}
 	return catalogue.Rendering{
 		ReadsHealth:   readsHealth,
+		JudgesRoot:    judgesRoot,
 		BusMembership: memberships[node],
 		Settings:      settings, Generators: gens, Grants: grants, Needed: needed, Foreseen: foreseen, Ports: ports,
 		Certificate: certificate, Authority: authority, Mesh: private, Names: names,
@@ -909,6 +924,16 @@ func engineReadsHealth(ctx context.Context, inv *inventory.Inventory, node strin
 	return had && stated.Contract >= link.ReadinessContract, nil
 }
 
+// engineJudgesRoot says whether a machine's node-engine judges a user's declared `root` (novox/hq ADR 0266),
+// by its own newest statement, for the same reason as engineReadsHealth: an older engine parses strictly.
+func engineJudgesRoot(ctx context.Context, inv *inventory.Inventory, node string) (bool, error) {
+	stated, had, err := inv.HealthOf(ctx, node)
+	if err != nil {
+		return false, err
+	}
+	return had && stated.Contract >= link.RootContract, nil
+}
+
 // zonesInTheMesh is every zone a module in the mesh declares, where the mesh placed it (novox/hq ADR
 // 0199): the zone settled from that node's settings, the node's private address, the port the
 // answering listen is published on there.
@@ -1223,7 +1248,9 @@ func planCommand(ctx context.Context, args []string) error {
 		if err != nil {
 			return err
 		}
+		return sayPlanDiff(args[0], declared, func() error {
 			return writePlanDiff(ctx, open.inventory, args[0], body)
+		})
 	}
 	if *asJSON {
 		declared, err := declarationFor(ctx, open, args[0], plan, settings)

cmd/mesh-controller/plan_diff_left_out_test.go

@@ -0,0 +1,25 @@
+package main
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+// 2026-10-09: nfs-server was assigned to the home server, its file asked for a setting nothing set, and
+// `plan --diff` said "nothing would change". The diff now says what is left out, and why, before the diff.
+func TestPlanDiffSaysAModuleLeftOutBeforeTheDiff(t *testing.T) {
+	declared := sendable{LeftOut: []string{"nfs-server"},
+		leftOutWhy: map[string]string{"nfs-server": `nothing sets "shares" for it`}}
+	said := printed(t, func() error {
+		return sayPlanDiff("home", declared, func() error {
+			writeDiff(os.Stdout, "home", sentDiff{}, nil)
+			return nil
+		})
+	})
+	left := strings.Index(said, "home: nfs-server left out")
+	nothing := strings.Index(said, "home: nothing would change")
+	if left < 0 || !strings.Contains(said, `nothing sets "shares" for it`) || nothing < left {
+		t.Errorf("the left-out module and why, then the diff:\n%s", said)
+	}
+}

cmd/mesh-controller/probe_agent_root.go

@@ -1,298 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"slices"
-	"sort"
-	"strings"
-	"time"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/conditions"
-	"github.com/novox/mesh-controller/internal/link"
-)
-
-// The self-check's probe of who can become root where the trusted parties run (novox/hq ADR 0259 §8, rule 3).
-//
-// The router and every channel proving its sender run as accounts of their own, so that no agent reads what
-// they hold or speaks as them. **Root on their machine undoes all of it.** So on every machine where a module
-// of its own account runs, this probe asks two questions, and raises an urgent condition while either is yes:
-//
-//  1. can an account an agent runs as become root without a person there — passwordless sudo, or a group
-//     that is root by another name (docker, disk)? The agent's account is the one the coding-agent module on
-//     that machine names (`agent_account`), and the operator's account while it names none;
-//  2. can an agent run a command it chooses, through the mesh's own tools, as an account that can — the login
-//     shell's `execute` runs as the machine's runtime account, which the mesh's acting tools give passwordless
-//     sudo? **Only where `execute` is served** (novox/hq ADR 0268): `execute` is an optional verb its holder
-//     withholds on a machine whose `execute` setting is not `serve`. The holder's seat being held there says
-//     nothing; whether the verb is served does. It counts as served while either says so — the holder's
-//     setting as the controller resolves it for that machine (a withheld value not yet pushed is still served),
-//     or the bus's discovery hearing the verb answered there — so a withheld setting the machine has not acted
-//     on yet, or a holder answering against its setting, is never taken for closed.
-//
-// The measurement is the sudo module's on that machine (`sudo_escalation`). **What cannot be measured is not a
-// pass**: a machine it does not run on, or that does not answer, raises the same urgent condition, saying it
-// was not measured — the router reads the condition, and a probe that merely failed to run would leave it
-// approving there (hq ADR 0259 §8, as amended on 2026-10-09).
-
-// kindAgentRoot is the condition an agent able to become root where a trusted party runs raises.
-const kindAgentRoot = "agent-root"
-
-// The tools the probe asks, of the modules on each machine.
-const (
-	agentModule     = "claude-code"
-	agentStatusTool = "claude_code_status"
-	sudoModule      = "sudo"
-	sudoEscalation  = "sudo_escalation"
-	loginShellSeat  = "node-login-shell"
-	// loginShellVerb is the seat's verb that runs a command, and the name of the setting its holder withholds
-	// it by (novox/hq ADR 0268).
-	loginShellVerb = "execute"
-	// executeServes is the one value of that setting that serves the verb; anything else withholds it.
-	executeServes = "serve"
-)
-
-// loginShellServed judges whether the login shell's execute is served on a machine, failing closed (novox/hq
-// ADR 0268): served while the holder's setting there is `serve` (or the holder has no such setting and claims
-// the verb), or while the bus heard the verb answered there, or while the bus could not be asked. why says
-// which, in words, for the condition.
-func loginShellServed(holder string, claims bool, setting *any, heard, asked bool) (bool, string) {
-	var why []string
-	switch {
-	case setting != nil:
-		if v, _ := (*setting).(string); v == executeServes {
-			why = append(why, holder+"'s execute setting there is "+executeServes)
-		}
-	case claims:
-		why = append(why, holder+" claims execute and has no setting that withholds it")
-	}
-	if heard {
-		why = append(why, "the bus hears execute answered there")
-	} else if !asked {
-		why = append(why, "the bus could not be asked whether execute is answered there")
-	}
-	return len(why) > 0, strings.Join(why, "; ")
-}
-
-// claimServes says whether a manifest's claim of a seat names a verb among those it serves.
-func claimServes(m catalogue.Manifest, seat, verb string) bool {
-	for _, c := range m.Claims {
-		if c.Name == seat && slices.Contains(c.Serves, verb) {
-			return true
-		}
-	}
-	return false
-}
-
-// escalation is the sudo module's answer for one account.
-type escalation struct {
-	Account string `json:"account"`
-	Root    bool   `json:"root_without_a_person"`
-	Why     string `json:"why"`
-}
-
-// agentRootFacts is what one machine says, as the probe reads it.
-type agentRootFacts struct {
-	Machine    string
-	Trusted    []string // the modules of their own account on it
-	Agent      string   // the account agents run as there; "" when none run there
-	AgentNamed bool     // the coding-agent module named it, rather than it being taken for the operator's
-	Runtime    string   // the account the machine's runtime runs as
-	LoginShell bool     // the login shell's execute is served there, running commands as the runtime's account
-	// LoginShellWhy is why execute counts as served there, in words: its holder's setting, the bus, or both.
-	LoginShellWhy string
-	Answers       map[string]escalation
-}
-
-// agentRootObservations judges one machine's facts: an urgent condition while an agent can become root there
-// without a person, one way or the other, naming which.
-func agentRootObservations(f agentRootFacts) []conditions.Observation {
-	var ways []string
-	if f.Agent != "" {
-		if e := f.Answers[f.Agent]; e.Root {
-			named := "the operator's account, which agents run as while the coding-agent module names no other"
-			if f.AgentNamed {
-				named = "the account agents run as"
-			}
-			ways = append(ways, fmt.Sprintf("%s (%s) can become root without a person: %s", f.Agent, named, e.Why))
-		}
-	}
-	if f.LoginShell && f.Runtime != "" {
-		if e := f.Answers[f.Runtime]; e.Root {
-			served := ""
-			if f.LoginShellWhy != "" {
-				served = " (" + f.LoginShellWhy + ")"
-			}
-			ways = append(ways, fmt.Sprintf("the login shell runs any command an agent gives it as %s%s, which can "+
-				"become root without a person: %s", f.Runtime, served, e.Why))
-		}
-	}
-	if len(ways) == 0 {
-		return nil
-	}
-	sort.Strings(f.Trusted)
-	return []conditions.Observation{{Scope: conditions.ScopeMachine, ID: f.Machine, Token: kindAgentRoot,
-		Machine: f.Machine, Kind: kindAgentRoot, Severity: conditions.Urgent,
-		Summary: fmt.Sprintf("an agent can become root on %s without a person, where %s run as accounts of their "+
-			"own; until it cannot, the router approves nothing proven there (novox/hq ADR 0259 §8): %s",
-			f.Machine, strings.Join(f.Trusted, ", "), strings.Join(ways, "; ")),
-		Headline: "Root without you on " + f.Machine,
-		Needs:    "choose how programs working for you on " + f.Machine + " stop becoming root without asking you.",
-		Explanation: "The modules that prove your answers from your phone run on " + f.Machine + ", and a program " +
-			"working for you there can become root without asking you, so it could answer in your name. Until " +
-			"that changes, answers from your phone can only acknowledge.",
-		Resolved: "Nothing on " + f.Machine + " becomes root without you any more"}}
-}
-
-// probeAgentRoot is the probe: every machine a module of its own account runs on, judged.
-func probeAgentRoot(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
-	inv := d.open.inventory
-	entries, err := inv.Catalogued(ctx)
-	if err != nil {
-		return nil, err
-	}
-	facts := map[string]*agentRootFacts{}
-	agentOn, sudoOn := map[string]bool{}, map[string]bool{}
-	for _, e := range entries {
-		for _, node := range e.On {
-			switch {
-			case e.Manifest.RunsAs != "":
-				f := facts[node]
-				if f == nil {
-					f = &agentRootFacts{Machine: node, Answers: map[string]escalation{}}
-					facts[node] = f
-				}
-				f.Trusted = append(f.Trusted, e.Manifest.Module)
-			case e.Manifest.Module == agentModule:
-				agentOn[node] = true
-			case e.Manifest.Module == sudoModule:
-				sudoOn[node] = true
-			}
-		}
-	}
-	machines := make([]string, 0, len(facts))
-	for m := range facts {
-		machines = append(machines, m)
-	}
-	sort.Strings(machines)
-	var out []conditions.Observation
-	var unread []string
-	if len(machines) == 0 {
-		return nil, nil
-	}
-	// Whether the login shell's execute is served where a trusted party runs (novox/hq ADR 0268): the
-	// holder's setting for that machine, and what the bus hears answered there. A discovery that could not be
-	// asked leaves only the setting, which is said: the probe then cannot show the verb withheld.
-	// A discovery that could not be asked counts execute as served (loginShellServed), and says so.
-	heard, derr := discoverSeatVerbs(ctx, d.js.Conn())
-	for _, e := range entries {
-		if !e.Manifest.ClaimsSeat(loginShellSeat) {
-			continue
-		}
-		for _, node := range e.On {
-			f := facts[node]
-			if f == nil {
-				continue
-			}
-			var setting *any
-			if _, declared := e.Manifest.Settings[loginShellVerb]; declared {
-				layers, err := inv.SettingsFor(ctx, node, e.Manifest.Module)
-				if err != nil {
-					f.LoginShell, f.LoginShellWhy = true, e.Manifest.Module+"'s setting there could not be read: "+err.Error()
-					continue
-				}
-				for _, s := range catalogue.Effective(e.Manifest, layers) {
-					if s.Key == loginShellVerb {
-						v := s.Value
-						setting = &v
-					}
-				}
-			}
-			f.LoginShell, f.LoginShellWhy = loginShellServed(e.Manifest.Module, claimServes(e.Manifest, loginShellSeat, loginShellVerb),
-				setting, heard[loginShellSeat][loginShellVerb][node], derr == nil)
-		}
-	}
-	for _, m := range machines {
-		f := facts[m]
-		record, err := inv.NodeByName(ctx, m)
-		if err != nil {
-			unread = append(unread, m+": "+err.Error())
-			continue
-		}
-		f.Runtime = record.Account
-		if agentOn[m] {
-			f.Agent = record.Account
-			if a, err := link.AskModuleToolOn(ctx, d.js.Conn(), agentModule, agentStatusTool, m, map[string]any{}, 10*time.Second); err == nil && a.Error == "" {
-				var status struct {
-					AgentAccount string `json:"agent_account"`
-				}
-				if json.Unmarshal(a.Result, &status) == nil && status.AgentAccount != "" {
-					f.Agent, f.AgentNamed = status.AgentAccount, true
-				}
-			}
-		}
-		if !sudoOn[m] {
-			unread = append(unread, m+": the sudo module is not assigned there, so who can become root is not measured")
-			continue
-		}
-		var accounts []string
-		for _, a := range []string{f.Agent, f.Runtime} {
-			if a != "" && !slices.Contains(accounts, a) {
-				accounts = append(accounts, a)
-			}
-		}
-		if len(accounts) == 0 {
-			continue
-		}
-		a, err := link.AskModuleToolOn(ctx, d.js.Conn(), sudoModule, sudoEscalation, m, map[string]any{"accounts": accounts}, 15*time.Second)
-		if err == nil && a.Error != "" {
-			err = fmt.Errorf("%s", a.Error)
-		}
-		if err != nil {
-			unread = append(unread, m+": "+err.Error())
-			continue
-		}
-		var answers []escalation
-		if err := json.Unmarshal(a.Result, &answers); err != nil {
-			unread = append(unread, m+": the sudo module's answer could not be read: "+err.Error())
-			continue
-		}
-		for _, e := range answers {
-			f.Answers[e.Account] = e
-		}
-		out = append(out, agentRootObservations(*f)...)
-	}
-	// Each machine whose measure failed is said as not measured, the same condition: never a pass.
-	for _, m := range machines {
-		var why []string
-		for _, u := range unread {
-			if strings.HasPrefix(u, m+": ") {
-				why = append(why, strings.TrimPrefix(u, m+": "))
-			}
-		}
-		if len(why) > 0 {
-			out = append(out, agentRootUnmeasured(*facts[m], strings.Join(why, "; ")))
-		}
-	}
-	return out, nil
-}
-
-// agentRootUnmeasured is the condition of a machine where a trusted party runs and who can become root was
-// not measured: urgent, like a measured yes, because the router believes a proof only where it is a no.
-func agentRootUnmeasured(f agentRootFacts, why string) conditions.Observation {
-	trusted := append([]string(nil), f.Trusted...)
-	sort.Strings(trusted)
-	return conditions.Observation{Scope: conditions.ScopeMachine, ID: f.Machine, Token: kindAgentRoot,
-		Machine: f.Machine, Kind: kindAgentRoot, Severity: conditions.Urgent,
-		Summary: fmt.Sprintf("whether an agent can become root on %s without a person is not measured, where %s "+
-			"run as accounts of their own; until it is, the router approves nothing proven there (novox/hq ADR "+
-			"0259 §8): %s", f.Machine, strings.Join(trusted, ", "), why),
-		Headline: "Root not checked on " + f.Machine,
-		Needs:    "let the mesh check who can become root on " + f.Machine + ": assign the sudo module there, or bring it back.",
-		Explanation: "The modules that prove your answers from your phone run on " + f.Machine + ", and the mesh " +
-			"could not check whether a program working for you there can become root without asking you. Until " +
-			"it can, answers from your phone can only acknowledge.",
-		Resolved: "The mesh checks who can become root on " + f.Machine + " again"}
-}

cmd/mesh-controller/probe_agent_root_test.go

@@ -1,123 +0,0 @@
-package main
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/conditions"
-)
-
-// novox/hq ADR 0259 §8, rule 3: the probe fails today — agents run as the operator's account, which has
-// passwordless sudo, and the login shell runs their commands as it — and passes only once neither holds.
-func TestAnAgentAbleToBecomeRootWhereTheRouterRunsIsSaid(t *testing.T) {
-	root := escalation{Root: true, Why: "(ALL : ALL) NOPASSWD: ALL"}
-	none := escalation{Why: "no rule lets it without a password"}
-	base := func() agentRootFacts {
-		return agentRootFacts{Machine: "anchor", Trusted: []string{"telegram", "messenger"}, Runtime: "ops",
-			Answers: map[string]escalation{}}
-	}
-
-	today := base()
-	today.Agent, today.LoginShell = "ops", true
-	today.Answers["ops"] = root
-	got := agentRootObservations(today)
-	if len(got) != 1 || got[0].Severity != conditions.Urgent || got[0].Kind != kindAgentRoot ||
-		!strings.Contains(got[0].Summary, "the operator's account") || !strings.Contains(got[0].Summary, "the login shell") {
-		t.Fatalf("today: %+v", got)
-	}
-
-	agentsMoved := base()
-	agentsMoved.Agent, agentsMoved.AgentNamed, agentsMoved.LoginShell = "agents", true, true
-	agentsMoved.Answers["agents"], agentsMoved.Answers["ops"] = none, root
-	if got := agentRootObservations(agentsMoved); len(got) != 1 || strings.Contains(got[0].Summary, "agents (") ||
-		!strings.Contains(got[0].Summary, "the login shell") {
-		t.Errorf("agents of their own account, the login shell still the runtime's: %+v", got)
-	}
-
-	closed := base()
-	closed.Agent, closed.AgentNamed = "agents", true
-	closed.Answers["agents"], closed.Answers["ops"] = none, root
-	if got := agentRootObservations(closed); len(got) != 0 {
-		t.Errorf("agents of their own account and no login shell there: %+v", got)
-	}
-
-	noAgents := base()
-	noAgents.Answers["ops"] = root
-	if got := agentRootObservations(noAgents); len(got) != 0 {
-		t.Errorf("no agent runs there and no login shell is held: %+v", got)
-	}
-}
-
-// Its words are plain, as every condition's are (novox/hq ADR 0253).
-func TestTheRootConditionIsSaidInPlainWords(t *testing.T) {
-	f := agentRootFacts{Machine: "anchor", Trusted: []string{"telegram"}, Runtime: "ops", Agent: "ops",
-		Answers: map[string]escalation{"ops": {Root: true, Why: "x"}}}
-	o := agentRootObservations(f)[0]
-	if why, ok := conditions.PlainWords(conditions.Words{Headline: o.Headline, Explanation: o.Explanation,
-		Needs: o.Needs, Resolved: o.Resolved}, "anchor"); !ok {
-		t.Errorf("not plain: %s", why)
-	}
-}
-
-// novox/hq ADR 0268: the login shell counts only where its execute is served, and fails closed — the holder's
-// setting resolving to anything but serve and the bus hearing no execute there is the one way it is withheld.
-func TestTheLoginShellCountsOnlyWhereExecuteIsServed(t *testing.T) {
-	val := func(v any) *any { return &v }
-	cases := []struct {
-		name          string
-		claims        bool
-		setting       *any
-		heard, asked  bool
-		served        bool
-		saysInTheWhys string
-	}{
-		{"withheld by the setting and silent on the bus", true, val("withhold"), false, true, false, ""},
-		{"withheld by the setting, the machine not yet pushed", true, val("withhold"), true, true, true, "the bus hears"},
-		{"the setting serves", true, val("serve"), false, true, true, "setting there is serve"},
-		{"a wrong value withholds, as the holder does", true, val("Serve"), false, true, false, ""},
-		{"the setting withholds, the bus could not be asked", true, val("withhold"), false, false, true, "could not be asked"},
-		{"a holder with no such setting that claims execute", true, nil, false, true, true, "claims execute"},
-		{"a holder with no such setting that does not claim it, heard all the same", false, nil, true, true, true, "the bus hears"},
-		{"a holder with no such setting that does not claim it, silent", false, nil, false, true, false, ""},
-	}
-	for _, c := range cases {
-		served, why := loginShellServed("zsh", c.claims, c.setting, c.heard, c.asked)
-		if served != c.served || (c.saysInTheWhys != "" && !strings.Contains(why, c.saysInTheWhys)) {
-			t.Errorf("%s: served %v (%q), want %v saying %q", c.name, served, why, c.served, c.saysInTheWhys)
-		}
-	}
-
-	// The control-node with execute withheld and agents of their own account: nothing is said.
-	f := agentRootFacts{Machine: "anchor", Trusted: []string{"telegram"}, Runtime: "ops", Agent: "agents", AgentNamed: true,
-		Answers: map[string]escalation{"ops": {Root: true, Why: "NOPASSWD"}, "agents": {Why: "none"}}}
-	f.LoginShell, f.LoginShellWhy = loginShellServed("zsh", true, val("withhold"), false, true)
-	if got := agentRootObservations(f); len(got) != 0 {
-		t.Errorf("execute withheld and agents confined: %+v", got)
-	}
-	// Withheld in the setting, still answered on the bus: said, with why.
-	f.LoginShell, f.LoginShellWhy = loginShellServed("zsh", true, val("withhold"), true, true)
-	if got := agentRootObservations(f); len(got) != 1 || !strings.Contains(got[0].Summary, "the bus hears execute answered there") {
-		t.Errorf("execute still answered: %+v", got)
-	}
-}
-
-// hq ADR 0259 §8 as amended on 2026-10-09: a machine where a trusted party runs and who can become root is not
-// measured raises the same urgent condition, so the router, which reads the condition, approves nothing there.
-func TestRootNotMeasuredWhereTheRouterRunsIsSaidAndNeverAPass(t *testing.T) {
-	o := agentRootUnmeasured(agentRootFacts{Machine: "anchor", Trusted: []string{"telegram", "messenger"}},
-		"the sudo module is not assigned there, so who can become root is not measured")
-	if o.Kind != kindAgentRoot || o.Severity != conditions.Urgent || o.Machine != "anchor" ||
-		!strings.Contains(o.Summary, "not measured") || !strings.Contains(o.Summary, "messenger, telegram") {
-		t.Errorf("%+v", o)
-	}
-	if why, ok := conditions.PlainWords(conditions.Words{Headline: o.Headline, Explanation: o.Explanation,
-		Needs: o.Needs, Resolved: o.Resolved}, "anchor"); !ok {
-		t.Errorf("not plain: %s", why)
-	}
-	// The same key as a measured yes, so the router's one rule reads both.
-	measured := agentRootObservations(agentRootFacts{Machine: "anchor", Trusted: []string{"telegram"}, Runtime: "ops",
-		Agent: "ops", Answers: map[string]escalation{"ops": {Root: true, Why: "x"}}})[0]
-	if o.Key() != measured.Key() {
-		t.Errorf("keys differ: %s, %s", o.Key(), measured.Key())
-	}
-}

cmd/mesh-controller/probes.go

@@ -637,8 +637,31 @@ const (
 // discoverHolders asks the bus's discovery who serves what, and answers seat → machine for every
 // endpoint a seat's verb is served on.
 func discoverHolders(ctx context.Context, conn *nats.Conn) (map[string]map[string]bool, error) {
+	inbox := conn.NewRespInbox()
+	sub, err := conn.SubscribeSync(inbox)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = sub.Unsubscribe() }()
+	if err := conn.PublishRequest("$SRV.INFO", inbox, nil); err != nil {
+		return nil, fmt.Errorf("asking the bus who serves what: %w", err)
+	}
 	out := map[string]map[string]bool{}
-	err := discoverServices(ctx, conn, func(info micro.Info) {
+	deadline := time.Now().Add(discoveryPatience)
+	for time.Now().Before(deadline) {
+		wait, cancel := context.WithTimeout(ctx, discoveryQuiet)
+		msg, err := sub.NextMsgWithContext(wait)
+		cancel()
+		if err != nil {
+			if ctx.Err() != nil {
+				return nil, ctx.Err()
+			}
+			break
+		}
+		var info micro.Info
+		if json.Unmarshal(msg.Data, &info) != nil {
+			continue
+		}
 		for _, e := range info.Endpoints {
 			seat, node := e.Metadata["seat"], e.Metadata["node"]
 			if seat == "" {
@@ -657,69 +680,8 @@ func discoverHolders(ctx context.Context, conn *nats.Conn) (map[string]map[strin
 			out[info.Name] = map[string]bool{}
 		}
 		out[info.Name][info.ID] = true
-	})
-	return out, err
 	}
-
+	return out, nil
-// discoverSeatVerbs asks the bus's discovery the same, one level finer: seat → verb → machine, for every
-// seat verb answered (an endpoint's `tool` is its verb). A seat held where a verb is withheld (novox/hq ADR
-// 0268) shows the seat and not that verb.
-func discoverSeatVerbs(ctx context.Context, conn *nats.Conn) (map[string]map[string]map[string]bool, error) {
-	out := map[string]map[string]map[string]bool{}
-	err := discoverServices(ctx, conn, func(info micro.Info) {
-		for _, e := range info.Endpoints {
-			seat, verb, node := e.Metadata["seat"], e.Metadata["tool"], e.Metadata["node"]
-			if seat == "" || verb == "" {
-				continue
-			}
-			if node == "" {
-				node = info.ID
-			}
-			if out[seat] == nil {
-				out[seat] = map[string]map[string]bool{}
-			}
-			if out[seat][verb] == nil {
-				out[seat][verb] = map[string]bool{}
-			}
-			out[seat][verb][node] = true
-		}
-	})
-	return out, err
-}
-
-// discoverServices asks the bus's discovery once and hands every service's answer to visit, waiting
-// discoveryQuiet after the last and discoveryPatience at the most.
-func discoverServices(ctx context.Context, conn *nats.Conn, visit func(micro.Info)) error {
-	if conn == nil {
-		return errors.New("the controller holds no connection to the bus")
-	}
-	inbox := conn.NewRespInbox()
-	sub, err := conn.SubscribeSync(inbox)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = sub.Unsubscribe() }()
-	if err := conn.PublishRequest("$SRV.INFO", inbox, nil); err != nil {
-		return fmt.Errorf("asking the bus who serves what: %w", err)
-	}
-	deadline := time.Now().Add(discoveryPatience)
-	for time.Now().Before(deadline) {
-		wait, cancel := context.WithTimeout(ctx, discoveryQuiet)
-		msg, err := sub.NextMsgWithContext(wait)
-		cancel()
-		if err != nil {
-			if ctx.Err() != nil {
-				return ctx.Err()
-			}
-			break
-		}
-		var info micro.Info
-		if json.Unmarshal(msg.Data, &info) != nil {
-			continue
-		}
-		visit(info)
-	}
-	return nil
 }
 
 // probeArchives is D4: every archive the mesh keeps is held by its manifest in the artifact store.

cmd/mesh-controller/push.go

@@ -65,6 +65,8 @@ func connectLink(ctx context.Context, inv *inventory.Inventory, enroller link.En
 }
 
 func serve(ctx context.Context) (err error) {
+	// Nothing this process does, or starts, is the operator at the terminal (novox/hq ADR 0266).
+	markServed()
 	// The one process whose log is read over time, so the one that says each change to a node's
 	// unmet seat dependencies once (novox/hq ADR 0207).
 	logUnheldChanges = true
@@ -264,6 +266,12 @@ func serve(ctx context.Context) (err error) {
 		return err
 	}
 	defer stopServing()
+	// And the operator's command on every node, asked through each node's engine (novox/hq ADR 0272).
+	stopCLI, err := bus.ServeCLI(answerMeshCLI(open.inventory), log.New(os.Stdout, "", log.LstdFlags))
+	if err != nil {
+		return err
+	}
+	defer stopCLI()
 	// And says so on the bus (novox/hq ADR 0197): what it serves, as the NATS services protocol asks.
 	stopAnnouncing, err := bus.Announce(seatAnnouncement(handlers), log.New(os.Stdout, "", log.LstdFlags))
 	if err != nil {

cmd/mesh-controller/push_recreates_test.go

@@ -26,7 +26,7 @@ func TestAPushSaysWhatItRecreates(t *testing.T) {
 		aContainerBuild(t, "postgres", "c1111111", "", start.Add(time.Second),
 			map[string][2]string{"server": {image("e"), ""}}),
 	} {
-		if _, _, err := takeIn(ctx, inv, b); err != nil {
+		if _, _, err := takeIn(ctx, inv, asTheOperator(t, inv, b)); err != nil {
 			t.Fatal(err)
 		}
 	}

cmd/mesh-controller/recorded_kept_test.go

@@ -71,7 +71,7 @@ func TestARecordedBuildIsCarriedOnlyByAPersonsPush(t *testing.T) {
 		aContainerBuild(t, "mailu", "c1111111", "", start.Add(time.Second),
 			map[string][2]string{"smtp": {mailImage, ""}, "imap": {mailImage, ""}}),
 	} {
-		if _, _, err := takeIn(ctx, inv, b); err != nil {
+		if _, _, err := takeIn(ctx, inv, asTheOperator(t, inv, b)); err != nil {
 			t.Fatal(err)
 		}
 	}

cmd/mesh-controller/replays_test.go

@@ -539,8 +539,8 @@ func TestReplay301APersonsPushOfAHeldRecordedBuildIsNoRepair(t *testing.T) {
 	inv := open.inventory
 	start := time.Now().Add(-time.Hour)
 	image := "registry.invalid:5000/resolver/server@sha256:" + strings.Repeat("e", 64)
-	if _, _, err := takeIn(ctx, inv, aContainerBuild(t, "resolver", "c1111111", catalogue.PolicyRecord, start,
+	if _, _, err := takeIn(ctx, inv, asTheOperator(t, inv, aContainerBuild(t, "resolver", "c1111111", catalogue.PolicyRecord, start,
-		map[string][2]string{"server": {image, ""}})); err != nil {
+		map[string][2]string{"server": {image, ""}}))); err != nil {
 		t.Fatal(err)
 	}
 	for _, node := range []string{"anchor", "laptop"} {

cmd/mesh-controller/same_source_test.go

@@ -54,7 +54,7 @@ func TestARebuildOfAnUnchangedSourceKeepsItsArtifacts(t *testing.T) {
 		// Another module's merge rebuilt it: a new commit, a new image digest, the same source.
 		anImageBuild(t, "app", "", "c2bbbbbb", strings.Repeat("b", 64), "src1:same", start.Add(time.Minute)),
 	} {
-		if _, _, err := takeIn(ctx, inv, b); err != nil {
+		if _, _, err := takeIn(ctx, inv, asTheOperator(t, inv, b)); err != nil {
 			t.Fatalf("build %d: %v", i, err)
 		}
 	}
@@ -114,7 +114,7 @@ func TestABusRebuiltFromAnUnchangedSourceDemandsNoBusStep(t *testing.T) {
 		b.Manifest = manifest
 		return b
 	}
-	if _, _, err := takeIn(ctx, inv, bus("", "n1111111", strings.Repeat("a", 64), "src1:bus", start)); err != nil {
+	if _, _, err := takeIn(ctx, inv, asTheOperator(t, inv, bus("", "n1111111", strings.Repeat("a", 64), "src1:bus", start))); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := inv.Assign(ctx, "anchor", "nats"); err != nil {

cmd/mesh-controller/sayable_test.go

@@ -26,6 +26,12 @@ import (
 // shape fails the suite, naming its source. The keeper would say such a summary in words at run time;
 // this is where the producer is made to say it rightly in the first place.
 func TestMain(m *testing.M) {
+	// The process a mesh-cli test runs as a command line: it says the verb and the caller it was given, and
+	// ends (meshcli_test.go).
+	if os.Getenv(echoEnvironment) != "" {
+		fmt.Printf("verb=%q caller=%q terminal=%v\n", os.Getenv("MESH_VERB"), os.Getenv("MESH_CALLER"), startedAtTheTerminal())
+		os.Exit(0)
+	}
 	conditions.Unsayable = func(o conditions.Observation, field string, r outward.Refusal) {
 		unsaid.note(o, field, r)
 	}

cmd/mesh-controller/seats.go

@@ -135,12 +135,6 @@ func handOver(ctx context.Context, seatName, to string, adding bool) error {
 	if !ok || nodeName == "" || module == "" {
 		return fmt.Errorf("the new holder is named <node>/<module>, not %q", to)
 	}
-	// A kinded bench is held once per kind, by the claims themselves (novox/hq ADR 0234 §2, ADR 0259): the
-	// record of who holds a seat has no kind, so a handover would name one holder for every kind.
-	if catalogue.KindedBenches[seatName] {
-		return fmt.Errorf("%s is a kinded bench: each kind is held by the module claiming it, and is not handed "+
-			"over by `seat` — assign the module that claims the kind, or unassign the one that does", seatName)
-	}
 	open, err := openStores(ctx)
 	if err != nil {
 		return err

cmd/mesh-controller/seats_test.go

@@ -1,8 +1,6 @@
 package main
 
 import (
-	"context"
-	"strings"
 	"testing"
 
 	"github.com/novox/mesh-controller/internal/catalogue"
@@ -64,13 +62,3 @@ func TestAClaimOutsideTheSetIsShownNotHidden(t *testing.T) {
 		t.Fatalf("a claim outside the set was not shown: %+v", outside)
 	}
 }
-
-// A kinded bench is not handed over by `seat`: each kind is held by its claim (novox/hq ADR 0259).
-func TestAKindedBenchIsNotHandedOver(t *testing.T) {
-	for _, bench := range []string{"channel", "intake"} {
-		err := handOver(context.Background(), bench, "anchor/telegram", false)
-		if err == nil || !strings.Contains(err.Error(), "is a kinded bench") {
-			t.Errorf("%s: %v", bench, err)
-		}
-	}
-}

cmd/mesh-controller/seatverbs.go

@@ -55,6 +55,9 @@ func argvFor(verb string, args map[string]any) ([]string, error) {
 		return nil, err
 	}
 	argv, err := a.commandLine()
+	if err == nil {
+		err = terminalOnly(argv)
+	}
 	if len(a.misread) > 0 {
 		// The table and the command line disagree: the verb reads an argument no caller can see
 		// in its schema, so no caller could ever pass it.
@@ -226,6 +229,35 @@ func quoteAll(xs []string) string {
 	return strings.Join(q, ", ")
 }
 
+// refusedAsTheGenericCommand is what the generic `command` verb refuses of a command line, and so what every
+// line asked through a verb's route refuses: the `command` verb's, and an ordinary line from mesh-cli (novox/hq ADR
+// 0272 §4). One function, so the two routes cannot drift apart.
+func refusedAsTheGenericCommand(argv []string) error {
+	if len(argv) == 0 {
+		return errors.New("command names no command")
+	}
+	// A layer is written through the settings verb, never the generic one (novox/hq issue 339): the
+	// settings verb is where what a verb may not set is refused, and one route is one set of words.
+	// The command refuses places and accesses through any verb as well; this says so before it runs.
+	if argv[0] == "settings" && slices.ContainsFunc(argv[1:], func(w string) bool { return w == "set" || w == "clear" }) {
+		return &heldAtTheTerminal{msg: "settings are set and cleared through the settings verb, not the " +
+			"generic command; and places and accesses only at the controller's terminal (novox/hq issue 339). " +
+			"Nothing was done"}
+	}
+	// The generic verb only reads (novox/hq ADR 0266): what writes has a named verb that composes its own
+	// line, or is the operator's at the controller's terminal.
+	if err := commandReads(argv); err != nil {
+		return err
+	}
+	// The generic verb is no way round the hand-act log (novox/hq to-be 45 §7): a repair through
+	// it says why, as it would through its own verb.
+	if repair := repairingCommand(argv); repair != "" && !slices.ContainsFunc(argv, isWhyFlag) {
+		return fmt.Errorf("%s is a repair done by hand, and says why: add --why <text> to the command "+
+			"line (recorded in the hand-act log). Nothing was done", repair)
+	}
+	return nil
+}
+
 // commandLine composes the command. Every argument it reads is one it uses: a branch that reads an
 // argument and then drops it would pass it over, which is what the check after it exists to refuse.
 func (a *verbArguments) commandLine() ([]string, error) {
@@ -242,22 +274,8 @@ func (a *verbArguments) commandLine() ([]string, error) {
 		if err != nil {
 			return nil, err
 		}
-		if len(argv) == 0 {
+		if err := refusedAsTheGenericCommand(argv); err != nil {
-			return nil, errors.New("command names no command")
+			return nil, err
-		}
-		// A layer is written through the settings verb, never the generic one (novox/hq issue 339): the
-		// settings verb is where what a verb may not set is refused, and one route is one set of words.
-		// The command refuses places and accesses through any verb as well; this says so before it runs.
-		if argv[0] == "settings" && slices.ContainsFunc(argv[1:], func(w string) bool { return w == "set" || w == "clear" }) {
-			return nil, errors.New("settings are set and cleared through the settings verb, not the generic " +
-				"command; and places and accesses only at the controller's terminal (novox/hq issue 339). " +
-				"Nothing was done")
-		}
-		// The generic verb is no way round the hand-act log (novox/hq to-be 45 §7): a repair through
-		// it says why, as it would through its own verb.
-		if repair := repairingCommand(argv); repair != "" && !slices.ContainsFunc(argv, isWhyFlag) {
-			return nil, fmt.Errorf("%s is a repair done by hand, and says why: add --why <text> to the command "+
-				"line (recorded in the hand-act log). Nothing was done", repair)
 		}
 		return argv, nil
 	case "tools":
@@ -911,6 +929,30 @@ func isWhyFlag(word string) bool {
 	return word == "--why" || word == "-why" || strings.HasPrefix(word, "--why=") || strings.HasPrefix(word, "-why=")
 }
 
+// commandEnvironment is the environment of a command line this controller runs for someone: its own — the
+// stores' credentials, the bus, the broker, everything a command run from a shell beside it would have, because it
+// is that — with who asked, and how it came.
+//
+// **terminal** is said, never inferred (novox/hq ADR 0272): only a line mesh-cli asked as the controller's terminal
+// passes true. Its line has no `MESH_VERB`, not the served mark ADR 0266 puts on everything the serving controller
+// starts, and the terminal's mark (cliTerminalVar), so startedAtTheTerminal reads yes. Every other line names its
+// verb, and is stripped of the terminal's mark whatever this process's environment holds.
+func commandEnvironment(caller, verb string, terminal bool) []string {
+	env := make([]string, 0, len(os.Environ())+3)
+	for _, kv := range os.Environ() {
+		if strings.HasPrefix(kv, verbVar+"=") || strings.HasPrefix(kv, link.CallerVar+"=") ||
+			strings.HasPrefix(kv, cliTerminalVar+"=") || (terminal && strings.HasPrefix(kv, servedVar+"=")) {
+			continue
+		}
+		env = append(env, kv)
+	}
+	env = append(env, link.CallerVar+"="+caller)
+	if terminal {
+		return append(env, cliTerminalVar+"=1")
+	}
+	return append(env, verbVar+"="+verb)
+}
+
 // runVerb runs this binary with the given command line and gathers what it said.
 //
 // **This binary is the image this process runs, never the file at the path it started from**
@@ -924,21 +966,17 @@ func runVerb(ctx context.Context, argv []string) (verbAnswer, error) {
 		return verbAnswer{}, fmt.Errorf("%w: this controller is stopping and runs no new command", link.ErrHandingOver)
 	}
 	cmd := selfCommand(ctx, argv)
-	// The same environment: the stores' credentials, the bus, the broker — everything a command run
-	// from a shell in this container would have, because it is that.
-	cmd.Env = os.Environ()
 	// And who asked, so an act it does by hand is recorded as theirs (novox/hq to-be 45 §7).
 	caller := link.CallerIn(ctx)
 	if caller == "" {
 		caller = "a seat call whose caller the bus did not name"
 	}
-	cmd.Env = append(cmd.Env, link.CallerVar+"="+caller+", through the "+catalogue.ControllerSeatName+" seat")
 	// And which verb, so the connection it dials says so in the bus's list (novox/hq issue 327).
 	verb, _ := ctx.Value(verbKey{}).(string)
 	if verb == "" {
 		verb = argv[0]
 	}
-	cmd.Env = append(cmd.Env, verbVar+"="+verb)
+	cmd.Env = commandEnvironment(caller+", through the "+catalogue.ControllerSeatName+" seat", verb, false)
 	// Two buffers, one answer. What the command *says* is both streams, in the order a person at
 	// a shell would read them; what it *answers as data* is standard output alone — `status --json`
 	// prints its warnings beside the document, and a JSON parsed from the two together parsed
@@ -1071,7 +1109,8 @@ func seatToolHandlers() (map[string]link.ToolHandler, []string, error) {
 			}
 			continue
 		}
-		if _, err := argvFor(verb, sampleArguments(v)); err != nil {
+		var policy *heldAtTheTerminal
+		if _, err := argvFor(verb, sampleArguments(v)); err != nil && !errors.As(err, &policy) {
 			// **A row ahead of this binary is not a reason to go silent.**
 			//
 			// The row is the store's and a control plane follows it (novox/hq ADR 0154), so a verb
@@ -1159,7 +1198,7 @@ func answersFirst(argv []string) bool {
 // the reason said beside it.
 func callsAnswer(log *link.CallLog, id string) (any, error) {
 	if id != "" {
-		c, ok, err := log.Get(id)
+		c, ok, err := log.Shown(id)
 		if err != nil {
 			return nil, fmt.Errorf("call %s is not in this controller's memory, and the calls kept on the "+
 				"bus could not be read: %w", id, err)
@@ -1332,3 +1371,131 @@ func seatAnnouncement(handlers map[string]link.ToolHandler) micro.Info {
 		Endpoints:   endpoints,
 	}
 }
+
+// nodeReads are the `node` subcommands a verb may run: the ones that only read.
+var nodeReads = map[string]bool{"list": true, "show": true}
+
+// flagsOnly says a command line's rest names no subcommand: empty, or beginning with a flag. For a command
+// with no subcommands every word is a flag, its value or a name it reads.
+func flagsOnly(rest []string) bool { return len(rest) == 0 || strings.HasPrefix(rest[0], "-") }
+
+// subIn says the rest begins with one of these subcommands.
+func subIn(rest []string, subs ...string) bool {
+	return len(rest) > 0 && slices.Contains(subs, rest[0])
+}
+
+// commandReadForms are the command lines the generic `command` verb may run (novox/hq ADR 0266): **an allow
+// list of the ones that only read**, judged command by command. Anything else — every command that writes a
+// record, sends, builds, issues an account or a token, sets a key, accepts, rotates, recovers or exports a
+// secret — is refused, and a command added later is refused until it is judged a read. Writing has its named
+// verbs, which compose their own lines and are judged by terminalOnly; the rest is the operator's at the
+// controller's terminal.
+var commandReadForms = map[string]func(rest []string) bool{
+	"status": flagsOnly, "version": flagsOnly, "help": flagsOnly, "seats": flagsOnly, "healers": flagsOnly,
+	"hand-acts": flagsOnly, "durations": flagsOnly, "collection": flagsOnly, "images": flagsOnly,
+	"artifacts": flagsOnly, "data": flagsOnly, "builds": flagsOnly, "queue": flagsOnly,
+	// `plan <node>` previews a node's declaration; it sends nothing.
+	"plan": func([]string) bool { return true },
+	// `plans` lists and `plans <id>` shows one; `plans stop|close|go` acts.
+	// Judged on every word, not the first: a flag before the subcommand (`plans --json go <id>`) still acts.
+	"plans": func(r []string) bool {
+		return !slices.ContainsFunc(r, func(w string) bool { return slices.Contains(plansActs, w) })
+	},
+	// `doctor` answers the last run, `probes` and `signals` describe; `doctor run` runs.
+	"doctor":     func(r []string) bool { return flagsOnly(r) || subIn(r, "probes", "signals") },
+	"conditions": func(r []string) bool { return flagsOnly(r) || subIn(r, "list", "show", "history") },
+	"node":       func(r []string) bool { return subIn(r, "list", "show") },
+	"module":     func(r []string) bool { return subIn(r, "list") },
+	"settings":   func(r []string) bool { return subIn(r, "show", "preferences") },
+	"retire":     func(r []string) bool { return subIn(r, "list") },
+	"cleanup":    func(r []string) bool { return subIn(r, "list") },
+	"delivery":   func(r []string) bool { return subIn(r, "plan", "walks") },
+	// `bus` alone says the bus's step; `bus upgrade` takes one.
+	"bus": func(r []string) bool { return len(r) == 0 },
+	// `mirrors` lists; --record and --confirm keep a mirror.
+	"mirrors": func(r []string) bool {
+		return flagsOnly(r) && !slices.ContainsFunc(r, func(w string) bool {
+			return w == "--record" || w == "-record" || strings.HasPrefix(w, "--record=") || strings.HasPrefix(w, "-record=") ||
+				w == "--confirm" || w == "-confirm" || strings.HasPrefix(w, "--confirm=")
+		})
+	},
+}
+
+// plansActs are the `plans` subcommands that act on a walk; no other word of a plans line is one of them.
+var plansActs = []string{"go", "stop", "close", "retry"}
+
+// heldAtTheTerminal is a refusal of policy (novox/hq ADR 0266): the verb is known and served, and this line is
+// the operator's at the controller's terminal. Never read as a verb this binary is behind on.
+type heldAtTheTerminal struct{ msg string }
+
+func (e *heldAtTheTerminal) Error() string { return e.msg }
+
+func terminalRefusal(format string, args ...any) error {
+	return &heldAtTheTerminal{fmt.Sprintf(format, args...)}
+}
+
+// commandReads refuses a line the generic verb may not run, saying what it may.
+func commandReads(argv []string) error {
+	if read, ok := commandReadForms[argv[0]]; ok && read(argv[1:]) {
+		return nil
+	}
+	return terminalRefusal("%q is not a reading command, and the generic command verb only reads (novox/hq ADR 0266): "+
+		"whoever may call a verb includes agents, and a line that writes, issues, sets a key or reveals a secret "+
+		"would be theirs to run. Use the named verb for it, or run it at the controller's terminal. The verb may "+
+		"run: %s. Nothing was done", strings.Join(argv, " "), commandReadNames())
+}
+
+func commandReadNames() string {
+	names := make([]string, 0, len(commandReadForms))
+	for n := range commandReadForms {
+		names = append(names, n)
+	}
+	sort.Strings(names)
+	return strings.Join(names, ", ") + " (each in its reading forms)"
+}
+
+// terminalOnlyCommands are the commands no verb runs, whatever composed them (novox/hq ADR 0266): they set
+// the operator's key, issue a credential or a token that is answered to the caller, or accept, recover or
+// export a secret. Their answers or effects hand whoever calls them what the runtime's account holds.
+var terminalOnlyCommands = map[string]string{
+	"operator": "the operator's key and credential",
+	"identity": "the mesh's identity keys",
+	"token":    "a token a machine joins with, answered to the caller",
+	"broker":   "the bus's accounts",
+	"api":      "the controller's API keys",
+	"licence":  "the licences' secrets",
+}
+
+// terminalOnly refuses, through any verb, a command that is the operator's at the controller's terminal
+// alone (novox/hq ADR 0266). **Every `node` subcommand that is not a read**: `node account` and
+// `node agent-account` above all. Whoever may call a verb includes agents, and an agent that named itself
+// the operator account, or cleared the agent account, would have the next send grant it root through the
+// sudo module's rule. An allow list, so a subcommand added later is refused until it is judged a read.
+func terminalOnly(argv []string) error {
+	if len(argv) == 0 {
+		return nil
+	}
+	if what, kept := terminalOnlyCommands[argv[0]]; kept {
+		return terminalRefusal("%s is run at the controller's terminal only, never through a verb: it holds %s, and "+
+			"whoever may call a verb includes agents (novox/hq ADR 0266). Nothing was done", argv[0], what)
+	}
+	// Of a secret's commands only rotation, which seals the new value to the machine that uses it.
+	if argv[0] == "secret" && (len(argv) < 2 || argv[1] != "rotate") {
+		return terminalRefusal("secret %s is run at the controller's terminal only, never through a verb: accepting, "+
+			"recovering or exporting a secret hands it to whoever asks, and that includes agents (novox/hq ADR "+
+			"0266). Nothing was done", strings.Join(argv[1:], " "))
+	}
+	if argv[0] != "node" {
+		return nil
+	}
+	if len(argv) > 1 && nodeReads[argv[1]] {
+		return nil
+	}
+	sub := "node"
+	if len(argv) > 1 {
+		sub += " " + argv[1]
+	}
+	return terminalRefusal("%s is run at the controller's terminal only, never through a verb: a node's accounts "+
+		"decide who may become root on it (novox/hq ADR 0266). A verb may run node list and node show. "+
+		"Nothing was done", sub)
+}

cmd/mesh-controller/seatverbs_schema_test.go

@@ -271,7 +271,6 @@ var accountedFlags = map[string]map[string]string{
 	"builds": {"n": "=limit"},
 	"plans":  {"n": "=limit", "what-if": "=repository"},
 	// The machine's tunnel key, named as the verb's other arguments are (novox/hq ADR 0169).
-	"token issue": {"overlay-key": "=overlay_key"},
 	"durations": {
 		"json": "set by the verb: the answer is data",
 		"all":  "withheld: every measurement of a fortnight is more than a call should carry; `command` reaches it",

cmd/mesh-controller/seatverbs_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"github.com/novox/mesh-controller/internal/link"
 	"strings"
@@ -108,11 +109,14 @@ func TestRotateTakesAProvisionOrAnOwnSecret(t *testing.T) {
 	}
 }
 
-// `token` is `token issue` at a shell, with the machine's tunnel key (novox/hq ADR 0169).
+// `token` answers a joining token to its caller, and whoever may call a verb includes agents: it is the
-func TestTokenIssuesForAMachineAndItsTunnelKey(t *testing.T) {
+// controller's terminal's alone (novox/hq ADR 0266), refused through the verb whatever it is given.
-	argv, err := argvFor("token", map[string]any{"new": "laptop", "overlay_key": "k", "for": "2h"})
+func TestTokenIsRefusedThroughAVerb(t *testing.T) {
-	if err != nil || strings.Join(argv, " ") != "token issue --new laptop --overlay-key k --for 2h" {
+	for _, args := range []map[string]any{{"new": "laptop", "overlay_key": "k", "for": "2h"}, {"node": "ace"}} {
-		t.Fatalf("token: %v %v", argv, err)
+		argv, err := argvFor("token", args)
+		if err == nil || !strings.Contains(err.Error(), "controller's terminal only") {
+			t.Fatalf("token %v: %v %v", args, argv, err)
+		}
 	}
 }
 
@@ -237,20 +241,20 @@ func TestAJSONVerbsAnswerIsItsStandardOutput(t *testing.T) {
 	}
 }
 
-// `command` is the generic verb: the command line as given, split as a shell would, nothing added —
+// `command` is the generic verb: the command line as given, split as a shell would, nothing added
-// so an operator's `node account g14 jochen` is one call through the console rather than a shell on
+// (novox/hq ADR 0154, ADR 0175). It once carried an operator's `node account g14 jochen` too; a node's
-// the control node (novox/hq ADR 0154, ADR 0175).
+// accounts are the controller's terminal's alone since ADR 0266 (TestNoVerbSetsANodesAccounts).
 func TestCommandRunsTheLineAsGiven(t *testing.T) {
-	argv, err := argvFor("command", map[string]any{"command": "node account g14 jochen"})
+	argv, err := argvFor("command", map[string]any{"command": "node show g14"})
-	if err != nil || strings.Join(argv, " ") != "node account g14 jochen" {
+	if err != nil || strings.Join(argv, " ") != "node show g14" {
 		t.Fatalf("a plain line: %v %v", argv, err)
 	}
 	argv, err = argvFor("command", map[string]any{"command": `settings show dnsmasq '{"a": "b c"}' --node ace`})
 	if err != nil || len(argv) != 6 || argv[3] != `{"a": "b c"}` {
 		t.Fatalf("a quoted word stays one word: %q %v", argv, err)
 	}
-	argv, err = argvFor("command", map[string]any{"command": `node add "the box" --adopted`})
+	argv, err = argvFor("command", map[string]any{"command": `plan "the box" --json`})
-	if err != nil || len(argv) != 4 || argv[2] != "the box" {
+	if err != nil || len(argv) != 3 || argv[1] != "the box" {
 		t.Fatalf("double quotes group: %q %v", argv, err)
 	}
 	if _, err := argvFor("command", map[string]any{"command": "   "}); err == nil {
@@ -355,3 +359,59 @@ func TestTheControllerAnnouncesTheVerbsItServes(t *testing.T) {
 		}
 	}
 }
+
+// The generic verb only reads (novox/hq ADR 0266): an allow list of reading forms, and every line that
+// writes, issues, sets a key or reveals a secret refused — the chain a review found ran through it: set the
+// operator's key to one the caller holds, rotate secrets sealed to it, open them.
+func TestTheCommandVerbOnlyReads(t *testing.T) {
+	for _, line := range []string{
+		"operator key set --replace k", "operator issue", "secret accept a b", "secret rotate a b c",
+		"secret recover a", "secret export a", "token issue --new x", "identity show", "broker users",
+		"api key", "licence show", "push anchor --why w", "assign novox m", "settings set m {}",
+		"settings clear m", "module add f", "module check /etc", "module forget m", "module issue m --node a",
+		"seat rename a b", "plans close p --why w", "plans go p", "plans retry p", "plans stop p",
+		"plans --json go p", "plans -n 3 close p", "plans --what-if r retry p", "doctor run", "conditions silence c --why w",
+		"retire approve x", "cleanup delete x", "delivery check", "delivery go x", "bus upgrade",
+		"mirrors --record x", "mirrors --confirm", "hand-act record x --why y --cause z", "serve", "migrate",
+		"prepare", "declare x", "overlay x", "facts", "merge-gate", "check-here", "build x", "rebuild x",
+		"cancel x", "kill x", "clear x", "replay x", "pause", "resume", "pin a b", "unpin a", "take x",
+		"converge", "adopt x", "rollout x", "upgrade x", "collect", "board", "builder", "ask x", "frobnicate",
+	} {
+		argv, err := argvFor("command", map[string]any{"command": line})
+		var policy *heldAtTheTerminal
+		if err == nil || !errors.As(err, &policy) {
+			t.Errorf("%q ran as %v (%v); the generic verb only reads", line, argv, err)
+		}
+	}
+	for _, line := range []string{
+		"status --json", "version", "seats --json", "healers", "hand-acts --days 3", "durations", "collection",
+		"images", "artifacts --collected", "data --machine a", "builds --log b", "queue", "plan ace --diff",
+		"plans", "plans plan-1", "doctor", "doctor probes", "doctor signals", "conditions", "conditions list",
+		"conditions show c", "conditions history", "node list", "node show ace", "module list",
+		"settings show m", "settings preferences", "retire list", "cleanup list", "delivery plan --repository r",
+		"delivery walks", "bus", "mirrors --json",
+	} {
+		if _, err := argvFor("command", map[string]any{"command": line}); err != nil {
+			t.Errorf("%q, a read, was refused: %v", line, err)
+		}
+	}
+}
+
+// What hands a caller a key, a credential or a secret is refused whichever verb composed it.
+func TestNoVerbSetsTheOperatorsKeyOrRevealsASecret(t *testing.T) {
+	for _, argv := range [][]string{
+		{"operator", "key", "set"}, {"operator", "issue"}, {"identity"}, {"token", "issue"}, {"broker", "users"},
+		{"api"}, {"licence"}, {"secret", "export", "x"}, {"secret", "recover", "x"}, {"secret", "accept", "x"}, {"secret"},
+	} {
+		if err := terminalOnly(argv); err == nil {
+			t.Errorf("%v passed", argv)
+		}
+	}
+	if err := terminalOnly([]string{"secret", "rotate", "n", "m", "s"}); err != nil {
+		t.Errorf("rotating seals to the machine that uses the secret, and stays a verb's: %v", err)
+	}
+	// A policy refusal is not a verb this binary is behind on: every verb is still served.
+	if _, behind, err := seatToolHandlers(); err != nil || len(behind) != 0 {
+		t.Fatalf("behind %v: %v", behind, err)
+	}
+}

go.mod

@@ -35,4 +35,4 @@ require (
 // committed. Every build (the build agent's `go build`, the Dockerfile) compiles from vendor/ and
 // fetches nothing; go refuses to build when vendor/ and this file disagree, so a pin moved without
 // `go mod vendor` fails loudly, at once, everywhere.
-replace github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261007162834-56e2ebec4bac
+replace github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261009103656-1c61b72f354d

go.sum

@@ -4,6 +4,12 @@ git.novox.be/novox/mesh-host v0.0.0-20261007120832-bdd44154ccac h1:KvnKtJ2rWeIE/
 git.novox.be/novox/mesh-host v0.0.0-20261007120832-bdd44154ccac/go.mod h1:VlilMCRZ5yyNXg7SNigNBLr0Gt32jrGw5KSNq5JAVYs=
 git.novox.be/novox/mesh-host v0.0.0-20261007162834-56e2ebec4bac h1:yLtFS0pDCCqIE9Zx8hgXEFG9fUWzf8L9WQoKV+Amk1E=
 git.novox.be/novox/mesh-host v0.0.0-20261007162834-56e2ebec4bac/go.mod h1:VlilMCRZ5yyNXg7SNigNBLr0Gt32jrGw5KSNq5JAVYs=
+git.novox.be/novox/mesh-host v0.0.0-20261009081005-b28d7bbcbff4 h1:f4rBnKSemuN0Z9dTtRJMigIGfEs6ltFPOILJGHGab74=
+git.novox.be/novox/mesh-host v0.0.0-20261009081005-b28d7bbcbff4/go.mod h1:72ZATZjxMLaJfWdvlSDJrygIoBzCmKIjCDMhEXxVzTo=
+git.novox.be/novox/mesh-host v0.0.0-20261009101157-2673e7a2c95e h1:H7eVqDILL6e9cMbWSLHTbCqu9ZxDOmyeQhUmWl9QBV0=
+git.novox.be/novox/mesh-host v0.0.0-20261009101157-2673e7a2c95e/go.mod h1:72ZATZjxMLaJfWdvlSDJrygIoBzCmKIjCDMhEXxVzTo=
+git.novox.be/novox/mesh-host v0.0.0-20261009103656-1c61b72f354d h1:IrmJ+lz21n+eSqKrmXREtR/7raUCBJ+fZvs+BNhuXVI=
+git.novox.be/novox/mesh-host v0.0.0-20261009103656-1c61b72f354d/go.mod h1:72ZATZjxMLaJfWdvlSDJrygIoBzCmKIjCDMhEXxVzTo=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

internal/broker/derived.go

@@ -126,9 +126,7 @@ func ConsumerFor(p Principal) (Consumer, bool) {
 	// A module that reacts to anything — a module's events or a role's (novox/hq ADR 0121). Watching
 	// a role was missing here, so the one module that does it got no consumer at all: it started,
 	// connected, and its graph stayed empty with nothing anywhere reporting why.
-	// And one that hears its own answers on a seat it uses (novox/hq ADR 0259 §3): an asker's warrants.
+	if p.Kind != KindModule || (len(p.Consumes) == 0 && len(p.Watches) == 0) {
-	hearsItsOwn := len(SeatTrafficOf(p.Module, nil, p.Uses, nil).Subscribe) > 0
-	if p.Kind != KindModule || (len(p.Consumes) == 0 && len(p.Watches) == 0 && !hearsItsOwn) {
 		return Consumer{}, false
 	}
 	perms, err := PermissionsFor(p)

internal/broker/membership.go

@@ -50,12 +50,6 @@ type Membership struct {
 	// and refuses, with the reason, what is not on it — the bus enforces only the union over every
 	// module on the machine.
 	State []StateIssued `json:"state,omitempty"`
-	// SeatTraffic is what this module's code may submit, say, hear, take, ask, answer and read on seats
-	// that name their caller or their kind (novox/hq ADR 0259 §3). The runtime carrying the module
-	// publishes, takes and answers for it only what is listed here: the bus enforces only the union
-	// over every module on the machine, so one module's code reaching another's name or kind through
-	// the runtime is the runtime's to refuse.
-	SeatTraffic *SeatTraffic `json:"seat-traffic,omitempty"`
 }
 
 // Served is one address a tool is answered on.
@@ -84,8 +78,6 @@ type Placements struct {
 	// Interchangeable is each module whose definition says its instances are the same anywhere,
 	// so the module's plain subject is issued to all of them in one queue.
 	Interchangeable map[string]bool
-	// Kinds is every kind held of a kinded bench, by whom and with what capabilities (ADR 0259 §5).
-	Kinds []KindHeld
 }
 
 // AnswersForTheModule says whether an instance of a module on one machine is issued the module's
@@ -117,20 +109,6 @@ func MembershipFor(node string, d Declared, where Placements) Membership {
 		}
 	}
 	m.State = stateIssuedFor(d, node)
-	t := SeatTrafficOf(d.Module, d.Holds, d.Uses, d.Watches)
-	for _, s := range append(append([]Seat{}, d.Uses...), d.Watches...) {
-		if !s.Kinded {
-			continue
-		}
-		for _, k := range where.Kinds {
-			if k.Seat == s.Name && !kindListed(t.Kinds, k) {
-				t.Kinds = append(t.Kinds, k)
-			}
-		}
-	}
-	if len(t.Publish)+len(t.Subscribe)+len(t.Answers)+len(t.Workers)+len(t.Records)+len(t.Kinds) > 0 {
-		m.SeatTraffic = &t
-	}
 	if len(d.Invokes) > 0 {
 		m.Reaches = map[string][]string{}
 		for _, t := range d.Invokes {
@@ -167,48 +145,5 @@ func PlacementsOf(r Records, interchangeable map[string]bool) Placements {
 	for _, nodes := range p.Nodes {
 		sort.Strings(nodes)
 	}
-	for node, declared := range r.Assigned {
-		for _, d := range declared {
-			for _, s := range d.Holds {
-				if s.Kinded && s.Kind != "" {
-					p.Kinds = append(p.Kinds, KindHeld{Seat: s.Name, Kind: s.Kind, Module: d.Module, Node: node,
-						Capabilities: placedCapabilities(s.Capabilities, d.RunsAs)})
-				}
-			}
-		}
-	}
-	sort.Slice(p.Kinds, func(i, j int) bool {
-		a, b := p.Kinds[i], p.Kinds[j]
-		if a.Seat != b.Seat {
-			return a.Seat < b.Seat
-		}
-		if a.Kind != b.Kind {
-			return a.Kind < b.Kind
-		}
-		return a.Node < b.Node
-	})
 	return p
 }
-
-// placedCapabilities is what a kind's claim promises, as far as its placement lets the router believe it
-// (novox/hq ADR 0259 §8): `verified-sender` only from a holder that runs as an account of its own, on a bus
-// account of its own — never one the machine's runtime carries as the operator's account.
-func placedCapabilities(declared []string, runsAs string) []string {
-	var out []string
-	for _, c := range declared {
-		if c == "verified-sender" && runsAs == "" {
-			continue
-		}
-		out = append(out, c)
-	}
-	return out
-}
-
-func kindListed(list []KindHeld, k KindHeld) bool {
-	for _, x := range list {
-		if x.Seat == k.Seat && x.Kind == k.Kind && x.Module == k.Module && x.Node == k.Node {
-			return true
-		}
-	}
-	return false
-}

internal/broker/nats.go

@@ -63,23 +63,6 @@ type Seat struct {
 	Emits    []string
 	Serves   []string
 	Versions []string // protocol versions served beside the current one; empty for v1 only
-
-	// Kinded says the seat is a kinded bench (novox/hq ADR 0234 §2, ADR 0259 §3): each holder claims one
-	// kind, and its verbs' subjects carry it. Kind is the kind this principal's claim names, for a seat it
-	// holds.
-	Kinded bool
-	Kind   string
-	// ByCaller are the accepts and emits whose last token names the calling module (ADR 0259 §3).
-	ByCaller []string
-	// Proofs are the seat's proof verbs: core request and reply, never on a stream (ADR 0259 §3).
-	Proofs []string
-	// Records are the holder's buckets, by their full name, each user reads under its own name.
-	Records []string
-	// Capabilities are what this principal's claim of a kinded bench promises (ADR 0234 §2).
-	Capabilities []string
-	// DeclaredBy is the module that declares the seat. On a kinded bench it alone submits work to a kind
-	// and answers its proofs (novox/hq ADR 0259 §8): the router, not any user or watcher of the bench.
-	DeclaredBy string
 }
 
 // A Principal is one user of the bus. Its permissions are derived from what it declares and
@@ -547,9 +530,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		// 2b. Events of a role it watches, under the seat's own namespace. Subscribe only: watching a
 		//     role is hearing what it announced, not taking part in it.
 		for _, w := range p.Watches {
-			if w.Kinded {
-				continue // composed by SeatTrafficOf below
-			}
 			for _, e := range w.Emits {
 				sub = append(sub, seatSubject(w, "event", e))
 			}
@@ -568,13 +548,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 
 		// 3. Seats it holds: full participation.
 		for _, s := range p.Holds {
-			if s.isNewTraffic() {
-				// Composed by SeatTrafficOf below, worker and all; only its tools are served here.
-				for _, t := range s.Serves {
-					sub = append(sub, seatToolSubject(s, t, p.Node))
-				}
-				continue
-			}
 			// Taking work from the role's queue: the worker consumer every holder shares (asked
 			// about, pulled from, acknowledged), on the seat's own stream (novox/hq ADR 0190). A
 			// holder pulls — asks the consumer for its next message, answered on its own inbox —
@@ -617,7 +590,7 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		//    seat's inbound subject and watch other modules' traffic, nor publish its outbound
 		//    events and lie about outcomes (design 29 §2).
 		for _, s := range p.Uses {
-			for _, a := range plainVerbs(s, s.Accepts) {
+			for _, a := range s.Accepts {
 				pub = append(pub, seatSubject(s, "accept", a))
 			}
 			for _, t := range s.Serves {
@@ -630,12 +603,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		pub = append(pub, stateGrants(stateAccess{Module: p.Module, Node: p.Node, Keeps: p.State,
 			PerMachine: p.PerMachine, Reads: p.Reads, KeyedReads: p.KeyedReads})...)
 
-		// 6. Its traffic on seats that name their caller or their kind, ask proofs or keep records
-		//    (novox/hq ADR 0259 §3).
-		tp, ts := SeatTrafficOf(p.Module, p.Holds, p.Uses, p.Watches).grants()
-		pub = append(pub, tp...)
-		sub = append(sub, ts...)
-
 	case KindNodeTools:
 		// **One process serves what every module on the machine would have served for itself**
 		// (novox/hq ADR 0175). Each carried module's whole tool namespace — the same grant that
@@ -713,25 +680,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			pub = append(pub, stateGrants(stateAccess{Module: d.Module, Node: p.Node, Keeps: stateNames(d.State),
 				PerMachine: perMachineNames(d.State), Reads: d.Reads, KeyedReads: d.KeyedReads})...)
 		}
-		// **Never the traffic of a trusted holder** (novox/hq ADR 0259 §8): the machine's runtime runs as the
-		// operator's account, which every agent runs as, so a module saying warrants or speaking for a kind
-		// that proves its sender is never composed into it — refused here, naming it, whatever registration
-		// let through.
-		for _, d := range p.Carries {
-			if why := trustedTraffic(d); why != "" {
-				return Permissions{}, fmt.Errorf("%s on %s is carried by the machine's runtime, and %s: it runs "+
-					"as an account of its own, never the runtime's (novox/hq ADR 0259)", d.Module, p.Node, why)
-			}
-		}
-		// **And the seat traffic of the modules it carries** (novox/hq ADR 0259 §3): a bundle reaches the
-		// bus only through its runtime, so the runtime is granted the union. That one module's code does
-		// not publish under another's name or kind through it is the runtime's to keep, from the seat
-		// traffic each module's membership lists.
-		for _, d := range p.Carries {
-			tp, ts := SeatTrafficOf(d.Module, d.Holds, d.Uses, d.Watches).grants()
-			pub = append(pub, tp...)
-			sub = append(sub, ts...)
-		}
 		sub = unique(sub)
 		pub = unique(pub)
 	}

internal/broker/seattraffic.go

@@ -1,305 +0,0 @@
-package broker
-
-import "sort"
-
-// What a module may say and take on the seats it holds, uses and watches, beyond tools (novox/hq ADR
-// 0259 §3, to-be 46 §10).
-//
-// Three rules are added to the ones a seat always had, each a subject whose last token names who may
-// publish it, granted to that publisher alone — the way a node seat's event about a machine carries the
-// machine (ADR 0219):
-//
-//   - **A verb named by its caller** (`by-caller`). A user of the seat submits that accept, and hears that
-//     event, under its own module's name and no other: `accept.ask.<module>`, `event.decided.<module>`. The
-//     holder takes every caller's accept and says the event to any caller. So an ask's asker is a fact the
-//     server enforces, and a warrant reaches only the asker it is for.
-//   - **A kinded bench** (ADR 0234 §2). A holder claims one kind and takes its own kind's accepts, says its
-//     own kind's events and asks its own kind's proofs, and nothing of another kind; a user submits to any
-//     kind. Each kind has its own worker on the seat's queue, so a holder that is away keeps its work and
-//     holds up no other kind.
-//   - **A proof** (`proofs`): core request and reply on `mesh.seat.<seat>.proof.<verb>.<kind>`. No stream's
-//     subjects cover it, so what travels there — a code typed by the operator — is never persisted. A kinded
-//     holder asks with its own kind; the modules that watch the seat answer.
-//
-// And one read: **a holder's records**, a bucket the seat names, read by each user under its own name only
-// (`$KV.<bucket>.<module>.>`), so an asker reads the state of its own asks and no other asker's.
-
-// Worker is one durable consumer a holder pulls a seat's work from.
-type Worker struct {
-	Stream   string
-	Consumer string
-	Filter   string
-}
-
-// SeatTraffic is one module's seat traffic beyond tools. Publish and Subscribe are subject patterns, in the
-// server's wildcards; the runtime that carries the module checks a bundle's request against them, since
-// the runtime's own principal holds the union of every module it carries.
-type SeatTraffic struct {
-	// Publish is what it submits (accepts of seats it uses), says (events of seats it holds) and asks
-	// (proofs of seats it holds a kind of).
-	Publish []string `json:"publish,omitempty"`
-	// Subscribe is what it hears: events of seats it uses that are named by caller, events of seats it
-	// watches, and accepts of seats it holds.
-	Subscribe []string `json:"subscribe,omitempty"`
-	// Answers is the proof subjects it answers, as a watcher of a kinded seat.
-	Answers []string `json:"answers,omitempty"`
-	// Workers are the work queues it takes from, as a holder.
-	Workers []Worker `json:"workers,omitempty"`
-	// Records is the direct-get subjects of the records it reads under its own name.
-	Records []string `json:"records,omitempty"`
-	// Kinds are the holders of every kinded bench it uses or watches, with what each promises: the one
-	// account of which channel is which, and what it can carry, that the router judges an answer by. The
-	// controller's, from the claims, never a channel's word (novox/hq ADR 0259 §5).
-	Kinds []KindHeld `json:"kinds,omitempty"`
-}
-
-// KindHeld is one kind of a kinded bench and who holds it.
-type KindHeld struct {
-	Seat         string   `json:"seat"`
-	Kind         string   `json:"kind"`
-	Module       string   `json:"module"`
-	Node         string   `json:"node"`
-	Capabilities []string `json:"capabilities,omitempty"`
-}
-
-// KindedBenches are the seats that may be kinded (ADR 0234 §2): making another is a decision, recorded.
-var KindedBenches = map[string]bool{"channel": true, "intake": true}
-
-// WorkerName is the worker a seat's holders pull from: one for the seat, or one per kind on a kinded bench.
-func WorkerName(seat, kind string) string {
-	if kind == "" {
-		return "SEAT_" + upperSnake(seat) + "_worker"
-	}
-	return "SEAT_" + upperSnake(seat) + "_" + upperSnake(kind) + "_worker"
-}
-
-func namesVerb(list []string, s string) bool {
-	for _, x := range list {
-		if x == s {
-			return true
-		}
-	}
-	return false
-}
-
-// SeatTrafficOf derives one module's seat traffic from the seats it holds, uses and watches. Only seats
-// carrying one of the rules above are read: every other seat is composed as it always was.
-func SeatTrafficOf(module string, holds, uses, watches []Seat) SeatTraffic {
-	var t SeatTraffic
-	for _, s := range holds {
-		if !s.isNewTraffic() {
-			continue
-		}
-		kind := ""
-		if s.Kinded {
-			kind = s.Kind
-			if kind == "" || !safeSubject.MatchString(kind) {
-				// A kinded claim without a usable kind is refused at registration; here it is granted
-				// nothing, which is the same answer at the last place it could be asked.
-				continue
-			}
-		}
-		if len(s.Accepts) > 0 {
-			stream := seatStreamName(s.Name)
-			filter := "mesh.seat." + s.Name + ".accept.>"
-			if kind != "" {
-				filter = "mesh.seat." + s.Name + ".accept.*." + kind
-			}
-			t.Workers = append(t.Workers, Worker{Stream: stream, Consumer: WorkerName(s.Name, kind), Filter: filter})
-		}
-		for _, a := range s.Accepts {
-			switch {
-			case kind != "":
-				t.Subscribe = append(t.Subscribe, seatSubject(s, "accept", a+"."+kind))
-			case namesVerb(s.ByCaller, a):
-				t.Subscribe = append(t.Subscribe, seatSubject(s, "accept", a+".*"))
-			}
-		}
-		for _, e := range s.Emits {
-			switch {
-			case kind != "":
-				t.Publish = append(t.Publish, seatSubject(s, "event", e+"."+kind))
-			case namesVerb(s.ByCaller, e):
-				t.Publish = append(t.Publish, seatSubject(s, "event", e+".*"))
-			}
-		}
-		if kind != "" {
-			for _, v := range s.Proofs {
-				t.Publish = append(t.Publish, seatSubject(s, "proof", v+"."+kind))
-			}
-		}
-	}
-	for _, s := range uses {
-		if !s.isNewTraffic() {
-			continue
-		}
-		for _, a := range s.Accepts {
-			switch {
-			case namesVerb(s.ByCaller, a):
-				t.Publish = append(t.Publish, seatSubject(s, "accept", a+"."+module))
-			case s.Kinded && module == s.DeclaredBy:
-				// Work for a kind is put on its queue by the bench's own router, and by no other user.
-				t.Publish = append(t.Publish, seatSubject(s, "accept", a+".*"))
-			}
-		}
-		for _, e := range s.Emits {
-			if namesVerb(s.ByCaller, e) {
-				t.Subscribe = append(t.Subscribe, seatSubject(s, "event", e+"."+module))
-			}
-		}
-		for _, b := range s.Records {
-			if !safeSubject.MatchString(b) {
-				continue
-			}
-			t.Records = append(t.Records, "$JS.API.DIRECT.GET.KV_"+b+".$KV."+b+"."+module+".>")
-		}
-	}
-	for _, w := range watches {
-		if w.Kinded {
-			for _, e := range w.Emits {
-				t.Subscribe = append(t.Subscribe, seatSubject(w, "event", e+".*"))
-			}
-			if module == w.DeclaredBy {
-				// A code is answered by the bench's own router, and by no other watcher.
-				for _, v := range w.Proofs {
-					t.Answers = append(t.Answers, seatSubject(w, "proof", v+".*"))
-				}
-			}
-		}
-	}
-	t.Publish = unique(t.Publish)
-	t.Subscribe = unique(t.Subscribe)
-	t.Answers = unique(t.Answers)
-	t.Records = unique(t.Records)
-	sort.Slice(t.Workers, func(i, j int) bool { return t.Workers[i].Consumer < t.Workers[j].Consumer })
-	return t
-}
-
-// grants is the bus permissions seat traffic needs: the subjects themselves, and the JetStream API a
-// worker is pulled and acknowledged through and a record is read through.
-func (t SeatTraffic) grants() (pub, sub []string) {
-	pub = append(pub, t.Publish...)
-	sub = append(sub, t.Subscribe...)
-	sub = append(sub, t.Answers...)
-	for _, w := range t.Workers {
-		pub = append(pub,
-			"$JS.API.CONSUMER.INFO."+w.Stream+"."+w.Consumer,
-			"$JS.API.CONSUMER.MSG.NEXT."+w.Stream+"."+w.Consumer,
-			"$JS.ACK."+w.Stream+"."+w.Consumer+".>")
-	}
-	pub = append(pub, t.Records...)
-	return pub, sub
-}
-
-// isNewTraffic says whether a seat carries any of the rules above, so a seat that carries none is
-// composed exactly as before them.
-func (s Seat) isNewTraffic() bool {
-	return s.Kinded || len(s.ByCaller) > 0 || len(s.Proofs) > 0 || len(s.Records) > 0
-}
-
-// plainVerbs is a seat's accepts or emits with those the rules above compose taken out: a verb named by
-// its caller and every verb of a kinded bench are composed by SeatTrafficOf and nowhere else.
-func plainVerbs(s Seat, verbs []string) []string {
-	if s.Kinded {
-		return nil
-	}
-	var out []string
-	for _, v := range verbs {
-		if !namesVerb(s.ByCaller, v) {
-			out = append(out, v)
-		}
-	}
-	return out
-}
-
-// SeatTrafficObjects is the work queues and workers the seat traffic of every composed user implies
-// (novox/hq ADR 0259 §3): a queue for each seat a holder takes work from, and each holder's worker on it —
-// one per kind on a kinded bench, filtered to that kind, so the kinds never take each other's work. Only
-// seats carrying the rules above; the mesh's own seats' queues are RaiseSeats'.
-func SeatTrafficObjects(users []Principal) ([]Stream, []Consumer) {
-	streams := map[string]Stream{}
-	consumers := map[string]Consumer{}
-	add := func(module string, holds []Seat) {
-		for _, w := range SeatTrafficOf(module, holds, nil, nil).Workers {
-			seat := ""
-			for _, s := range holds {
-				if seatStreamName(s.Name) == w.Stream {
-					seat = s.Name
-				}
-			}
-			streams[w.Stream] = Stream{
-				Name:      w.Stream,
-				Subjects:  []string{"mesh.seat." + seat + ".accept.>"},
-				Retention: RetentionWorkQueue,
-				MaxAge:    7 * 24 * 60 * 60,
-				Why:       "work submitted to the " + seat + " seat; its holders take it, each kind its own, and it queues while nobody does",
-			}
-			consumers[w.Consumer] = Consumer{
-				Name:           w.Consumer,
-				Stream:         w.Stream,
-				Filters:        []string{w.Filter},
-				AckWaitSeconds: 60,
-				// No bound on redelivery: a channel away for a day keeps its work, offered again later and
-				// later by its holder's runtime (novox/hq ADR 0259; the correctness review of 2026-10-08).
-				MaxDeliver: 0,
-				Why: module + " holds " + seat + "; it pulls one ask at a time and acknowledges once it has " +
-					"recorded it, so a crash redelivers rather than loses",
-			}
-		}
-	}
-	for _, p := range users {
-		switch p.Kind {
-		case KindModule:
-			add(p.Module, p.Holds)
-		case KindNodeTools:
-			for _, d := range p.Carries {
-				add(d.Module, d.Holds)
-			}
-		}
-	}
-	var ss []Stream
-	for _, s := range streams {
-		ss = append(ss, s)
-	}
-	sort.Slice(ss, func(i, j int) bool { return ss[i].Name < ss[j].Name })
-	var cs []Consumer
-	for _, c := range consumers {
-		cs = append(cs, c)
-	}
-	sort.Slice(cs, func(i, j int) bool { return cs[i].Name < cs[j].Name })
-	return ss, cs
-}
-
-// trustedTraffic is why a module's seat traffic is the trusted holder's (novox/hq ADR 0259 §8), or "": it
-// says a seat's event to one caller each (a warrant), or holds a kind of a kinded bench that proves its sender.
-func trustedTraffic(d Declared) string {
-	for _, s := range d.Holds {
-		for _, e := range s.Emits {
-			if namesVerb(s.ByCaller, e) {
-				return "it says " + s.Name + "'s " + e + " to one caller each"
-			}
-		}
-		if s.Kinded && namesVerb(s.Capabilities, "verified-sender") {
-			return "it holds " + s.Name + " of kind " + s.Kind + ", which proves its sender"
-		}
-	}
-	return ""
-}
-
-// TrafficQueues is the work queue of every seat naming its caller or its kind that accepts work, held or not
-// (novox/hq ADR 0259 §3): what is submitted before a holder is assigned waits for it.
-func TrafficQueues(seats []Seat) []Stream {
-	var out []Stream
-	seen := map[string]bool{}
-	for _, s := range seats {
-		if len(s.Accepts) == 0 || !s.isNewTraffic() || seen[s.Name] {
-			continue
-		}
-		seen[s.Name] = true
-		out = append(out, Stream{Name: seatStreamName(s.Name), Subjects: []string{"mesh.seat." + s.Name + ".accept.>"},
-			Retention: RetentionWorkQueue, MaxAge: 7 * 24 * 60 * 60,
-			Why: "work submitted to the " + s.Name + " seat; its holders take it, each kind its own, and it queues while nobody does"})
-	}
-	sort.Slice(out, func(i, j int) bool { return out[i].Name < out[j].Name })
-	return out
-}

internal/broker/seattraffic_test.go

@@ -1,340 +0,0 @@
-package broker
-
-import (
-	"strings"
-	"testing"
-)
-
-// The seats of novox/hq ADR 0259 §3, as the messenger declares them.
-func operatorChannel() Seat {
-	return Seat{Name: "operator-channel", Scope: "mesh", Accepts: []string{"ask", "cancel"},
-		Emits: []string{"decided"}, Serves: []string{"open", "history", "notify"},
-		ByCaller: []string{"ask", "cancel", "decided"}, Records: []string{"messenger_asks"}}
-}
-
-func channelSeat(kind string) Seat {
-	return Seat{Name: "channel", Scope: "mesh", Accepts: []string{"show", "edit", "send"}, Kinded: true, Kind: kind,
-		DeclaredBy: "messenger"}
-}
-
-func intakeSeat(kind string) Seat {
-	return Seat{Name: "intake", Scope: "mesh", Emits: []string{"choice", "link"}, Proofs: []string{"code"},
-		Kinded: true, Kind: kind, DeclaredBy: "messenger"}
-}
-
-func allowed(patterns []string, subject string) bool {
-	for _, p := range patterns {
-		if subjectMatches(p, subject) {
-			return true
-		}
-	}
-	return false
-}
-
-func perms(t *testing.T, p Principal) Permissions {
-	t.Helper()
-	got, err := PermissionsFor(p)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return got
-}
-
-func TestAnAskerAsksAndHearsUnderItsOwnNameOnly(t *testing.T) {
-	asker := Principal{Kind: KindModule, Node: "anchor", Module: "mesh-delivery", Uses: []Seat{operatorChannel()}}
-	got := perms(t, asker)
-	for _, s := range []string{
-		"mesh.seat.operator-channel.accept.ask.mesh-delivery",
-		"mesh.seat.operator-channel.accept.cancel.mesh-delivery",
-		"$JS.API.DIRECT.GET.KV_messenger_asks.$KV.messenger_asks.mesh-delivery.a1",
-	} {
-		if !allowed(got.Publish, s) {
-			t.Errorf("an asker may not publish %s", s)
-		}
-	}
-	for _, s := range []string{
-		"mesh.seat.operator-channel.accept.ask.mesh-controller",
-		"mesh.seat.operator-channel.accept.ask.*",
-		"mesh.seat.operator-channel.event.decided.mesh-delivery",
-		"$JS.API.DIRECT.GET.KV_messenger_asks.$KV.messenger_asks.mesh-controller.a1",
-		"$KV.messenger_asks.mesh-delivery.a1",
-	} {
-		if allowed(got.Publish, s) {
-			t.Errorf("an asker may publish %s, which is not its own to submit", s)
-		}
-	}
-	if !allowed(got.Subscribe, "mesh.seat.operator-channel.event.decided.mesh-delivery") {
-		t.Error("an asker does not hear its own warrants")
-	}
-	if allowed(got.Subscribe, "mesh.seat.operator-channel.event.decided.mesh-controller") {
-		t.Error("an asker hears another asker's warrants")
-	}
-	// And its own consumer carries its warrants, so a restart catches up.
-	c, ok := ConsumerFor(asker)
-	if !ok || !allowed(c.Filters, "mesh.seat.operator-channel.event.decided.mesh-delivery") {
-		t.Errorf("the asker's consumer does not carry its warrants: %v", c.Filters)
-	}
-}
-
-func TestOnlyTheHolderPublishesAWarrant(t *testing.T) {
-	users, err := Users(Records{
-		Nodes: []string{"anchor"},
-		Assigned: map[string][]Declared{"anchor": {
-			{Module: "messenger", Holds: []Seat{operatorChannel()}, Uses: []Seat{channelSeat("")},
-				Watches: []Seat{{Name: "intake", Emits: []string{"choice", "link"}, Kinded: true, Proofs: []string{"code"}, DeclaredBy: "messenger"}}},
-			{Module: "mesh-delivery", Uses: []Seat{operatorChannel()}},
-			{Module: "telegram", Holds: []Seat{channelSeat("telegram"), intakeSeat("telegram")}},
-		}},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, u := range users {
-		got := perms(t, u)
-		says := allowed(got.Publish, "mesh.seat.operator-channel.event.decided.mesh-delivery")
-		if says != (u.Module == "messenger") {
-			t.Errorf("%s %s publish a warrant", u.Username(), map[bool]string{true: "may", false: "may not"}[says])
-		}
-	}
-}
-
-func TestTheHolderTakesEveryCallersAskThroughItsWorker(t *testing.T) {
-	got := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "messenger", Holds: []Seat{operatorChannel()}})
-	if !allowed(got.Subscribe, "mesh.seat.operator-channel.accept.ask.mesh-delivery") {
-		t.Error("the router does not take an ask")
-	}
-	for _, s := range []string{
-		"$JS.API.CONSUMER.MSG.NEXT.SEAT_OPERATOR_CHANNEL.SEAT_OPERATOR_CHANNEL_worker",
-		"$JS.ACK.SEAT_OPERATOR_CHANNEL.SEAT_OPERATOR_CHANNEL_worker.x",
-		"mesh.seat.operator-channel.event.decided.mesh-controller",
-	} {
-		if !allowed(got.Publish, s) {
-			t.Errorf("the router may not publish %s", s)
-		}
-	}
-	if allowed(got.Publish, "mesh.seat.operator-channel.accept.ask.messenger") {
-		t.Error("the holder may ask its own seat without using it")
-	}
-}
-
-func TestAKindedHolderReachesItsOwnKindAndNoOther(t *testing.T) {
-	got := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "telegram",
-		Holds: []Seat{channelSeat("telegram"), intakeSeat("telegram")}})
-	for _, s := range []string{
-		"mesh.seat.intake.event.choice.telegram", "mesh.seat.intake.event.link.telegram",
-		"mesh.seat.intake.proof.code.telegram",
-		"$JS.API.CONSUMER.MSG.NEXT.SEAT_CHANNEL.SEAT_CHANNEL_TELEGRAM_worker",
-	} {
-		if !allowed(got.Publish, s) {
-			t.Errorf("telegram may not publish %s", s)
-		}
-	}
-	for _, s := range []string{
-		"mesh.seat.intake.event.choice.desktop", "mesh.seat.intake.proof.code.desktop",
-		"mesh.seat.channel.accept.show.telegram",
-		"$JS.API.CONSUMER.MSG.NEXT.SEAT_CHANNEL.SEAT_CHANNEL_DESKTOP_worker",
-		"mesh.seat.operator-channel.event.decided.mesh-delivery",
-	} {
-		if allowed(got.Publish, s) {
-			t.Errorf("telegram may publish %s", s)
-		}
-	}
-	if !allowed(got.Subscribe, "mesh.seat.channel.accept.show.telegram") ||
-		allowed(got.Subscribe, "mesh.seat.channel.accept.show.desktop") {
-		t.Error("telegram does not take exactly its own kind's work")
-	}
-	if allowed(got.Subscribe, "mesh.seat.intake.proof.code.telegram") {
-		t.Error("a channel answers its own proofs")
-	}
-}
-
-func TestTheWatcherAnswersProofsAndHearsEveryKind(t *testing.T) {
-	got := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "messenger",
-		Uses:    []Seat{channelSeat("")},
-		Watches: []Seat{{Name: "intake", Emits: []string{"choice"}, Kinded: true, Proofs: []string{"code"}, DeclaredBy: "messenger"}}})
-	for _, s := range []string{"mesh.seat.intake.event.choice.telegram", "mesh.seat.intake.proof.code.desktop"} {
-		if !allowed(got.Subscribe, s) {
-			t.Errorf("the router does not hear %s", s)
-		}
-	}
-	if !allowed(got.Publish, "mesh.seat.channel.accept.show.telegram") {
-		t.Error("the router cannot send a channel its work")
-	}
-	if allowed(got.Publish, "mesh.seat.intake.event.choice.telegram") || allowed(got.Publish, "mesh.seat.intake.proof.code.telegram") {
-		t.Error("the router may say a channel's answer or proof")
-	}
-}
-
-func TestNoStreamKeepsAProof(t *testing.T) {
-	users, _ := Users(Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": {
-		{Module: "telegram", Holds: []Seat{channelSeat("telegram"), intakeSeat("telegram")}},
-		{Module: "messenger", Holds: []Seat{operatorChannel()}},
-	}}})
-	streams, _ := SeatTrafficObjects(users)
-	streams = append(streams, MeshStreams()...)
-	for _, s := range streams {
-		for _, subject := range s.Subjects {
-			if subjectMatches(subject, "mesh.seat.intake.proof.code.telegram") {
-				t.Errorf("%s keeps a proof (%s)", s.Name, subject)
-			}
-		}
-	}
-}
-
-func TestEachKindHasAWorkerOfItsOwn(t *testing.T) {
-	users, _ := Users(Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": {
-		{Module: "telegram", Holds: []Seat{channelSeat("telegram")}},
-		{Module: "desk-channel", Holds: []Seat{channelSeat("desktop")}},
-		{Module: "messenger", Holds: []Seat{operatorChannel()}},
-	}}})
-	streams, workers := SeatTrafficObjects(users)
-	names := map[string]string{}
-	for _, w := range workers {
-		names[w.Name] = strings.Join(w.Filters, ",")
-	}
-	want := map[string]string{
-		"SEAT_CHANNEL_TELEGRAM_worker": "mesh.seat.channel.accept.*.telegram",
-		"SEAT_CHANNEL_DESKTOP_worker":  "mesh.seat.channel.accept.*.desktop",
-		"SEAT_OPERATOR_CHANNEL_worker": "mesh.seat.operator-channel.accept.>",
-	}
-	for n, f := range want {
-		if names[n] != f {
-			t.Errorf("worker %s filters %q, want %q", n, names[n], f)
-		}
-	}
-	if len(streams) != 2 {
-		t.Errorf("want the queues of channel and operator-channel, got %v", streams)
-	}
-}
-
-func TestTheRuntimeIsGrantedTheUnionAndTheMembershipEachModulesShare(t *testing.T) {
-	telegram := Declared{Module: "telegram", Holds: []Seat{channelSeat("telegram"), intakeSeat("telegram")}}
-	desk := Declared{Module: "desk-channel", Holds: []Seat{channelSeat("desktop"), intakeSeat("desktop")}}
-	got := perms(t, Principal{Kind: KindNodeTools, Node: "anchor", Module: RuntimeModule, Carries: []Declared{telegram, desk}})
-	for _, s := range []string{"mesh.seat.intake.event.choice.telegram", "mesh.seat.intake.event.choice.desktop"} {
-		if !allowed(got.Publish, s) {
-			t.Errorf("the runtime may not publish %s for a module it carries", s)
-		}
-	}
-	m := MembershipFor("anchor", telegram, Placements{})
-	if m.SeatTraffic == nil || !allowed(m.SeatTraffic.Publish, "mesh.seat.intake.event.choice.telegram") ||
-		allowed(m.SeatTraffic.Publish, "mesh.seat.intake.event.choice.desktop") {
-		t.Errorf("telegram's membership does not list exactly its own kind: %+v", m.SeatTraffic)
-	}
-	if plain := MembershipFor("anchor", Declared{Module: "plain"}, Placements{}); plain.SeatTraffic != nil {
-		t.Error("a module with no such seat is given seat traffic")
-	}
-}
-
-func TestASeatWithoutTheNewRulesIsComposedAsBefore(t *testing.T) {
-	old := Seat{Name: "node-build-agent", Scope: "node", Accepts: []string{"build"}, Emits: []string{"built"}}
-	got := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "builder", Holds: []Seat{old}})
-	for _, s := range []string{"mesh.seat.node-build-agent.event.built",
-		"$JS.API.CONSUMER.MSG.NEXT.SEAT_NODE_BUILD_AGENT.SEAT_NODE_BUILD_AGENT_worker"} {
-		if !allowed(got.Publish, s) {
-			t.Errorf("an old seat's holder lost %s", s)
-		}
-	}
-	if !allowed(got.Subscribe, "mesh.seat.node-build-agent.accept.build") {
-		t.Error("an old seat's holder lost its accept")
-	}
-}
-
-// The router learns which channel is which, and what each promises, from the controller's membership:
-// the claims, never a channel's word (ADR 0259 §5).
-func TestTheRoutersMembershipNamesEveryKindAndItsCapabilities(t *testing.T) {
-	tg := channelSeat("telegram")
-	tg.Capabilities = []string{"choice", "verified-sender"}
-	desk := channelSeat("desktop")
-	desk.Capabilities = []string{"choice"}
-	router := Declared{Module: "messenger", Holds: []Seat{operatorChannel()}, Uses: []Seat{channelSeat("")}}
-	records := Records{Nodes: []string{"anchor", "laptop"}, Assigned: map[string][]Declared{
-		"anchor": {router, {Module: "telegram", Holds: []Seat{tg}, RunsAs: "telegram"}},
-		"laptop": {{Module: "desk-channel", Holds: []Seat{desk}}},
-	}}
-	where := PlacementsOf(records, nil)
-	m := MembershipFor("anchor", router, where)
-	if m.SeatTraffic == nil || len(m.SeatTraffic.Kinds) != 2 {
-		t.Fatalf("the router is not told the kinds: %+v", m.SeatTraffic)
-	}
-	byKind := map[string]KindHeld{}
-	for _, k := range m.SeatTraffic.Kinds {
-		byKind[k.Kind] = k
-	}
-	if k := byKind["telegram"]; k.Module != "telegram" || k.Node != "anchor" || !namesVerb(k.Capabilities, "verified-sender") {
-		t.Errorf("telegram is %+v", k)
-	}
-	if k := byKind["desktop"]; k.Module != "desk-channel" || namesVerb(k.Capabilities, "verified-sender") {
-		t.Errorf("the desk is %+v", k)
-	}
-	if other := MembershipFor("anchor", Declared{Module: "mesh-delivery", Uses: []Seat{operatorChannel()}}, where); other.SeatTraffic != nil && len(other.SeatTraffic.Kinds) > 0 {
-		t.Error("an asker is told the channels")
-	}
-}
-
-// novox/hq ADR 0259 §8: only the bench's own router answers its proofs and puts work on a kind's queue.
-func TestOnlyTheBenchsRouterAnswersProofsAndSubmitsWork(t *testing.T) {
-	other := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "eavesdropper",
-		Uses:    []Seat{channelSeat("")},
-		Watches: []Seat{{Name: "intake", Emits: []string{"choice"}, Kinded: true, Proofs: []string{"code"}, DeclaredBy: "messenger"}}})
-	if allowed(other.Subscribe, "mesh.seat.intake.proof.code.telegram") {
-		t.Error("a watcher that is not the router answers codes")
-	}
-	if allowed(other.Publish, "mesh.seat.channel.accept.show.telegram") {
-		t.Error("a user that is not the router puts work on a kind's queue")
-	}
-	if !allowed(other.Subscribe, "mesh.seat.intake.event.choice.telegram") {
-		t.Error("a watcher no longer hears the bench's events")
-	}
-}
-
-// novox/hq ADR 0259 §8: the machine's runtime runs as the operator's account; it never carries a module
-// that says warrants or speaks for a kind proving its sender, and such a module has its own account.
-func TestTheMachinesRuntimeNeverCarriesATrustedHolder(t *testing.T) {
-	tg := channelSeat("telegram")
-	tg.Capabilities = []string{"choice", "verified-sender"}
-	for name, d := range map[string]Declared{
-		"the router":         {Module: "messenger", Holds: []Seat{operatorChannel()}},
-		"a verified channel": {Module: "telegram", Holds: []Seat{tg}},
-	} {
-		if _, err := PermissionsFor(Principal{Kind: KindNodeTools, Node: "anchor", Module: RuntimeModule,
-			Carries: []Declared{d}}); err == nil || !strings.Contains(err.Error(), "an account of its own") {
-			t.Errorf("%s was composed into the machine's runtime: %v", name, err)
-		}
-	}
-	desk := channelSeat("desktop")
-	desk.Capabilities = []string{"choice"}
-	if _, err := PermissionsFor(Principal{Kind: KindNodeTools, Node: "anchor", Module: RuntimeModule,
-		Carries: []Declared{{Module: "desk-channel", Holds: []Seat{desk}}}}); err != nil {
-		t.Errorf("a channel proving nothing was refused: %v", err)
-	}
-	users, err := Users(Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": {
-		{Module: RuntimeModule}, {Module: "telegram", Holds: []Seat{tg}, RunsAs: "telegram"},
-		{Module: "messenger", Holds: []Seat{operatorChannel()}, RunsAs: "messenger"},
-	}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, u := range users {
-		if u.Kind == KindNodeTools {
-			for _, d := range u.Carries {
-				if d.RunsAs != "" {
-					t.Errorf("the machine's runtime carries %s", d.Module)
-				}
-			}
-			if _, err := PermissionsFor(u); err != nil {
-				t.Errorf("the runtime could not be composed: %v", err)
-			}
-		}
-	}
-}
-
-// novox/hq ADR 0259 §8: verified-sender reaches the router only from a holder of its own account.
-func TestVerifiedSenderIsBelievedOnlyFromAHolderOfItsOwnAccount(t *testing.T) {
-	if got := placedCapabilities([]string{"choice", "verified-sender"}, ""); namesVerb(got, "verified-sender") {
-		t.Errorf("a carried holder keeps verified-sender: %v", got)
-	}
-	if got := placedCapabilities([]string{"choice", "verified-sender"}, "telegram"); !namesVerb(got, "verified-sender") {
-		t.Errorf("a holder of its own account lost verified-sender: %v", got)
-	}
-}

internal/broker/users.go

@@ -50,9 +50,6 @@ type Declared struct {
 	// Checks are the module's own tools its health asks, each `<module>.<tool>` (novox/hq ADR 0240, to-be
 	// 48 §3): the machine's node-engine asks them of its own node tools, and is granted that and no more.
 	Checks []string
-	// RunsAs is the account the module runs as in a runtime of its own (novox/hq ADR 0259 §8): it is never
-	// carried by the machine's runtime, and reaches the bus on its own account.
-	RunsAs string
 }
 
 // Records is what composing a user list needs to know about the mesh, and nothing more.
@@ -123,13 +120,10 @@ func Users(r Records) ([]Principal, error) {
 			})
 		}
 		if runtimeHere {
-			var carried []Declared
+			out = append(out, Principal{
-			for _, d := range r.Assigned[node] {
+				Kind: KindNodeTools, Node: node, Module: RuntimeModule,
-				if d.RunsAs == "" {
+				Carries: append([]Declared(nil), r.Assigned[node]...),
-					carried = append(carried, d)
+			})
-				}
-			}
-			out = append(out, Principal{Kind: KindNodeTools, Node: node, Module: RuntimeModule, Carries: carried})
 		}
 	}
 	for _, node := range sortedCopy(r.Enrolling) {

internal/broker/writers.go

@@ -87,8 +87,10 @@ var WritersTable = []WriterRow{
 	{State: "a machine's applied state and its report", Writer: "the node-engine's apply queue",
 		KeptIn: "the machine; the report on the bus", Others: "the reconcile and a delivery enqueue, never apply",
 		// And its health statement between reports (novox/hq ADR 0240): the same writer stating the same
-		// machine, inside the grant it already had (`mesh.control.<its own>.>`).
+		// machine, inside the grant it already had (`mesh.control.<its own>.>`). And a line mesh-cli was given
-		Subjects: []string{"mesh.control.*.report", "mesh.control.*.health"}, Writes: ownMachine},
+		// on the machine (novox/hq ADR 0272): the node is what the controller judges the terminal by, so that
+		// subject is this machine's engine's alone.
+		Subjects: []string{"mesh.control.*.report", "mesh.control.*.health", "mesh.control.*.cli"}, Writes: ownMachine},
 	{State: "the controller lease", Writer: "the controller instance holding it", KeptIn: "key-value " + LeaseBucket,
 		Others: "a candidate waits", Subjects: kvOf(LeaseBucket), Writes: isController},
 	{State: "plans and their tiers", Writer: "controller (lease holder), compare-and-set on the plan's revision",

internal/broker/writers_test.go

@@ -86,6 +86,10 @@ func TestASecondWriterIsRefusedAtComposition(t *testing.T) {
 			[]string{"mesh.control.>"}, "a machine's applied state and its report"},
 		{"a machine publishing another's report", Principal{Kind: KindNode, Node: "one"},
 			[]string{"mesh.control.two.report"}, "a machine's applied state and its report"},
+		{"a machine asking the controller as another (mesh-cli, ADR 0272)", Principal{Kind: KindNode, Node: "one"},
+			[]string{"mesh.control.two.cli"}, "a machine's applied state and its report"},
+		{"a module asking the controller as a machine (mesh-cli, ADR 0272)", Principal{Kind: KindModule, Module: "shop"},
+			[]string{"mesh.control.one.cli"}, "a machine's applied state and its report"},
 		{"a machine publishing every machine's", Principal{Kind: KindNode, Node: "one"},
 			[]string{"mesh.control.*.>"}, "a machine's applied state and its report"},
 		{"a module writing the lease", Principal{Kind: KindModule, Module: "shop"},
@@ -115,6 +119,7 @@ func TestASecondWriterIsRefusedAtComposition(t *testing.T) {
 		publish []string
 	}{
 		{Principal{Kind: KindNode, Node: "one"}, []string{"mesh.control.one.>"}},
+		{Principal{Kind: KindNode, Node: "one"}, []string{"mesh.control.one.cli"}},
 		{Principal{Kind: KindController}, []string{"mesh.node.>", "$JS.API.>", "$KV.mesh-controller_lease.>"}},
 		{Principal{Kind: KindModule, Module: "gitea"}, []string{"mesh.mod.gitea.event.pull.merged"}},
 		{Principal{Kind: KindModule, Module: "shop"}, []string{"$JS.API.CONSUMER.CREATE.KV_shop_carts.>"}},

internal/catalogue/agent_account_test.go

@@ -0,0 +1,119 @@
+package catalogue
+
+import (
+	"testing"
+)
+
+// The account agents run as (novox/hq ADR 0266): a module names it as a machine fact — the agent account
+// where the node names one, the operator's otherwise — and asks the node-engine to judge it never to become
+// root only where it is the agents' own.
+
+func TestTheAgentAccountFactFallsBackToTheOperatorAndIsNeverRootOnlyWhenItsOwn(t *testing.T) {
+	facts := machineFacts(Resolution{Node: "anchor", Account: "ops"}, nil, "")
+	if facts["agent-account"] != "ops" || facts["agent-home"] != "/home/ops" || facts["agent-root"] != "" {
+		t.Errorf("with no agent account named, agents run as the operator: %v", facts)
+	}
+	facts = machineFacts(Resolution{Node: "anchor", Account: "ops", AccountHome: "/srv/ops"}, nil, "")
+	if facts["agent-home"] != "/srv/ops" {
+		t.Errorf("the operator's stated home is the agent's home when they are one account: %v", facts)
+	}
+	facts = machineFacts(Resolution{Node: "anchor", Account: "ops", AgentAccount: "agent"}, nil, "")
+	if facts["agent-account"] != "agent" || facts["agent-home"] != "/home/agent" || facts["agent-root"] != RootNever {
+		t.Errorf("a named agent account is the agents', never root: %v", facts)
+	}
+	if facts["account"] != "ops" {
+		t.Errorf("the operator account is still the operator's: %v", facts)
+	}
+	facts = machineFacts(Resolution{Node: "anchor", AgentAccount: "agent", AgentAccountHome: "/var/lib/agent"}, nil, "")
+	if facts["agent-home"] != "/var/lib/agent" || facts["agent-root"] != RootNever {
+		t.Errorf("an agent account with a stated home on a machine with no operator: %v", facts)
+	}
+	if _, has := machineFacts(Resolution{Node: "anchor"}, nil, "")["agent-account"]; has {
+		t.Error("a machine with no account at all names an agent account")
+	}
+}
+
+// The agent's module, in the shape the catalogue's declares it: the account, never root where it is its
+// own; its directory under that home, owned by it.
+const agentModule = `{"module": "agent", "version": "1", "resources": [
+  {"id": "account", "type": "user", "name": "${machine:agent-account}", "home": "${machine:agent-home}",
+   "root": "${machine:agent-root}"},
+  {"id": "home", "type": "directory", "path": "${machine:agent-home}/.agent", "mode": "0700",
+   "owner": "${machine:agent-account}"}
+]}`
+
+func TestTheAgentAccountIsDeclaredNeverRootOnlyToAnEngineThatJudgesIt(t *testing.T) {
+	m, err := ParseManifest([]byte(agentModule))
+	if err != nil {
+		t.Fatal(err)
+	}
+	compose := func(r Resolution, with Rendering) (user, home map[string]any) {
+		t.Helper()
+		r.Node, r.Modules = "anchor", []Manifest{m}
+		out, err := r.Declaration(with)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return fileNamed(out, "agent.account"), fileNamed(out, "agent.home")
+	}
+
+	user, home := compose(Resolution{Account: "ops", AgentAccount: "agent"}, Rendering{JudgesRoot: true})
+	if user["name"] != "agent" || user[RootField] != RootNever || user["home"] != "/home/agent" {
+		t.Errorf("an engine that judges root is sent the agent account never to become root: %v", user)
+	}
+	if home["path"] != "/home/agent/.agent" || home["owner"] != "agent" {
+		t.Errorf("the agent's directory is under its own home, its own: %v", home)
+	}
+
+	user, _ = compose(Resolution{Account: "ops", AgentAccount: "agent", AgentAccountHome: "/srv/agent"}, Rendering{JudgesRoot: true})
+	if user["home"] != "/srv/agent" {
+		t.Errorf("an agent account named with a home of its own is made there: %v", user)
+	}
+
+	user, _ = compose(Resolution{Account: "ops", AgentAccount: "agent"}, Rendering{})
+	if _, sent := user[RootField]; sent || user["name"] != "agent" {
+		t.Errorf("an older engine, which parses strictly, is sent root: %v", user)
+	}
+
+	user, home = compose(Resolution{Account: "ops"}, Rendering{JudgesRoot: true})
+	if _, sent := user[RootField]; sent || user["name"] != "ops" {
+		t.Errorf("where agents run as the operator, root asserts nothing and is not sent: %v", user)
+	}
+	if home["path"] != "/home/ops/.agent" || home["owner"] != "ops" {
+		t.Errorf("with no agent account, the agent's directory is the operator's: %v", home)
+	}
+}
+
+func TestTheRuntimeIsToldTheAgentAccount(t *testing.T) {
+	with := Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}}
+	envOf := func(r Resolution) map[string]string {
+		t.Helper()
+		r.Node, r.Modules = "anchor", []Manifest{aToolsModule(t, "nftables", "tools/index.js"), theRuntime(t)}
+		out, err := r.Declaration(with)
+		if err != nil {
+			t.Fatal(err)
+		}
+		process := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
+		if process == nil {
+			t.Fatal("no runtime process was composed")
+		}
+		return process["env"].(map[string]string)
+	}
+	env := envOf(Resolution{Account: "ops", AgentAccount: "agent"})
+	if env[RuntimeAgentAccount] != "agent" || env[RuntimeAgentHome] != "/home/agent" || env[RuntimeOperatorAccount] != "ops" {
+		t.Errorf("the runtime is not told whom agents run as: %v", env)
+	}
+	env = envOf(Resolution{Account: "ops"})
+	if env[RuntimeAgentAccount] != "ops" || env[RuntimeAgentHome] != "/home/ops" {
+		t.Errorf("with no agent account, agents run as the operator: %v", env)
+	}
+	env = envOf(Resolution{})
+	if _, set := env[RuntimeAgentAccount]; set {
+		t.Errorf("a machine with no account names an agent account: %v", env)
+	}
+	if problems := bundleEnvProblems("x", Artifact{Name: "b", Kind: ArtifactBundle, Loads: []string{"x"},
+		Env: map[string]string{RuntimeAgentAccount: "me"}}); len(problems) == 0 {
+		t.Error("a bundle may tell the runtime whom agents run as")
+	}
+}

internal/catalogue/build.go

@@ -399,7 +399,7 @@ func versionOf(digest string) string {
 // telling the runtime what it is, which is the mesh's to say (novox/hq ADR 0192).
 var bundleEnvWords = map[string]bool{
 	RuntimeToolModules: true, RuntimeBrokerFile: true, RuntimeOperatorAccount: true,
-	RuntimeOperatorHome: true, RuntimeToolEnv: true,
+	RuntimeOperatorHome: true, RuntimeToolEnv: true, RuntimeAgentAccount: true, RuntimeAgentHome: true,
 }
 
 // bundleEnvProblems says what is wrong with what a bundle says it is given (novox/hq ADR 0192):

internal/catalogue/declaration.go

@@ -241,6 +241,31 @@ type Rendering struct {
 	// refuses a field it does not know, whole — so to it the field is not sent, and what it runs is
 	// judged by liveness alone.
 	ReadsHealth bool
+
+	// JudgesRoot says this machine's node-engine judges a user's declared `root` (novox/hq ADR 0266: its
+	// statement's contract is link.RootContract or later). To an older, strict engine the field is not
+	// sent, and the account it names is not judged — which the self-check says, as not judged.
+	JudgesRoot bool
+}
+
+// RootField is a user resource's field saying the account must never become root without a person
+// (novox/hq ADR 0266).
+const RootField = "root"
+
+// rootInto composes a user's `root` for the node-engine: taken away when it asserts nothing (empty — a
+// machine where agents run as the operator) or when the engine is older than the field and parses
+// strictly; kept as "never" otherwise.
+func rootInto(resource map[string]any, with Rendering) {
+	if resource["type"] != "user" {
+		return
+	}
+	value, has := resource[RootField]
+	if !has {
+		return
+	}
+	if s, _ := value.(string); s == "" || !with.JudgesRoot {
+		delete(resource, RootField)
+	}
 }
 
 // machinePort is where a module's port lives on this machine, or the port itself when the mesh has
@@ -981,6 +1006,9 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			// How it is ready, in the node-engine's words: its endpoint as the port this machine
 			// published it on — or not sent at all to an engine older than the field (ADR 0240).
 			healthInto(copied, m, with)
+			// And a user's `root` (novox/hq ADR 0266): sent only when it asserts something, to an engine
+			// that judges it.
+			rootInto(copied, with)
 			// The account's environment and every module's shell code, where this module holds the
 			// seat that places them (novox/hq ADR 0203, ADR 0204). Gathered from every module on
 			// the node, as the jails are, and **last of every placeholder pass**: shell code is a
@@ -1073,23 +1101,9 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		}
 		owner[fmt.Sprint(process["id"])] = RuntimeModule
 		out = append(out, process)
-		// And a runtime of its own for each module of its own account, after it (novox/hq ADR 0259 §8).
+		// What each module's bundles are given is read as the account the runtime runs as.
-		owns, err := r.ownRuntimes(with)
-		if err != nil {
-			return nil, err
-		}
-		for _, p := range owns {
-			id := fmt.Sprint(p["id"])
-			owner[id] = strings.TrimSuffix(id, "."+OwnRuntimeID())
-			out = append(out, p)
-		}
-		// What each module's bundles are given is read as the account the runtime runs as — not what a
-		// module of its own account is given, which its own account reads.
 		words := map[string]map[string]string{}
 		for _, m := range r.Modules {
-			if m.RunsAs != "" {
-				continue
-			}
 			w, err := bundleWords(m, with)
 			if err != nil {
 				return nil, err

internal/catalogue/kinded_test.go

@@ -1,161 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// The router of novox/hq ADR 0259: it declares the operator's seat and the two kinded benches.
-func router() Manifest {
-	return Manifest{Module: "messenger", Tools: []string{"open", "history", "notify"},
-		State: []StateDeclaration{{Name: "asks"}}, RunsAs: "messenger", SecretsOwner: "messenger",
-		DefinesSeats: []SeatDeclaration{
-			{Name: "operator-channel", Scope: ScopeMesh, Accepts: []string{"ask", "cancel"}, Emits: []string{"decided"},
-				ByCaller: []string{"ask", "cancel", "decided"}, Records: []string{"asks"},
-				Serves: []Verb{{Name: "open"}, {Name: "history"}, {Name: "notify"}}},
-			{Name: "channel", Scope: ScopeMesh, Kinded: true, Accepts: []string{"show", "edit", "send"}},
-			{Name: "intake", Scope: ScopeMesh, Kinded: true, Emits: []string{"choice", "link"}, Proofs: []string{"code"}},
-		},
-		Claims: []Claim{{Name: "operator-channel", Scope: ScopeMesh}},
-		Uses:   []string{"channel"}}
-}
-
-func aChannel(module, kind string) Manifest {
-	return Manifest{Module: module, Claims: []Claim{
-		{Name: "channel", Scope: ScopeMesh, Kind: kind}, {Name: "intake", Scope: ScopeMesh, Kind: kind}}}
-}
-
-func TestTwoChannelsOfDifferentKindsHoldTheBenches(t *testing.T) {
-	shelf := Shelf{"messenger": router(), "telegram": aChannel("telegram", "telegram"),
-		"desk-channel": aChannel("desk-channel", "desktop")}
-	if got := problemsFor(t, shelf); got != "" {
-		t.Fatalf("two kinds were refused: %s", got)
-	}
-	for _, m := range shelf {
-		if got := declaredSeatProblems(m); len(got) > 0 {
-			t.Fatalf("%s: %v", m.Module, got)
-		}
-	}
-}
-
-func TestASecondClaimOfOneKindIsRefused(t *testing.T) {
-	got := problemsFor(t, Shelf{"messenger": router(), "telegram": aChannel("telegram", "telegram"),
-		"telegram-two": aChannel("telegram-two", "telegram")})
-	if !strings.Contains(got, `of kind "telegram", which telegram already claims`) {
-		t.Fatalf("a second holder of one kind stood: %s", got)
-	}
-}
-
-func TestAKindedBenchNeedsAKindAndNoOtherSeatTakesOne(t *testing.T) {
-	got := problemsFor(t, Shelf{"messenger": router(), "nameless": aChannel("nameless", "")})
-	if !strings.Contains(got, "claims the kinded bench channel and names no kind") {
-		t.Fatalf("a claim without a kind stood: %s", got)
-	}
-	odd := Manifest{Module: "odd", Claims: []Claim{{Name: "operator-channel", Scope: ScopeMesh, Kind: "telegram"}}}
-	got = problemsFor(t, Shelf{"messenger": router(), "odd": odd})
-	if !strings.Contains(got, "only a kinded bench takes a kind") {
-		t.Fatalf("a kind on a seat that is not kinded stood: %s", got)
-	}
-	dotted := problemsFor(t, Shelf{"messenger": router(), "dotted": aChannel("dotted", "a.b")})
-	if !strings.Contains(dotted, "not a usable name") {
-		t.Fatalf("a kind that would widen a subject stood: %s", dotted)
-	}
-}
-
-func TestOnlyChannelAndIntakeAreKinded(t *testing.T) {
-	m := Manifest{Module: "x", DefinesSeats: []SeatDeclaration{{Name: "pager", Kinded: true, Accepts: []string{"page"}}}}
-	if got := strings.Join(declaredSeatProblems(m), "; "); !strings.Contains(got, "only channel and intake are kinded") {
-		t.Fatalf("another kinded bench was declared: %s", got)
-	}
-}
-
-func TestTheNewRulesAreHeldToWhatTheSeatSays(t *testing.T) {
-	m := Manifest{Module: "x", DefinesSeats: []SeatDeclaration{{Name: "thing", Accepts: []string{"do"},
-		ByCaller: []string{"undo"}, Proofs: []string{"code"}, Records: []string{"nothing"}}}}
-	got := strings.Join(declaredSeatProblems(m), "; ")
-	for _, want := range []string{"names thing.undo by its caller, which the seat neither accepts nor emits",
-		"declares proofs on thing, which is not kinded", `read its records "nothing", which it keeps no state of`} {
-		if !strings.Contains(got, want) {
-			t.Errorf("not refused: %q in %s", want, got)
-		}
-	}
-}
-
-// Two kinds on one machine are two holders, and one kind on two machines is a second claimant.
-func TestEachKindIsItsOwnHolderWhenResolved(t *testing.T) {
-	modules := []Manifest{aChannel("telegram", "telegram"), aChannel("desk-channel", "desktop")}
-	held, problems := checkClaims(modules, Node{Name: "anchor"}, nil, nil)
-	if len(problems) > 0 || len(held) != 4 {
-		t.Fatalf("two kinds on one machine: held %v, problems %v", held, problems)
-	}
-	_, problems = checkClaims([]Manifest{aChannel("telegram", "telegram")}, Node{Name: "home"}, held, nil)
-	if len(problems) == 0 {
-		t.Fatal("one kind held on two machines was not refused")
-	}
-}
-
-// A channel's capabilities come from the fixed vocabulary, and only a kinded claim carries any.
-func TestCapabilitiesAreTheVocabularysAndOnlyOnAKindedClaim(t *testing.T) {
-	good := aChannel("telegram", "telegram")
-	good.Claims[0].Capabilities = []string{"deliver", "choice", "verified-sender", "max-length:4096"}
-	good.RunsAs = "telegram"
-	if got := problemsFor(t, Shelf{"messenger": router(), "telegram": good}); got != "" {
-		t.Fatalf("the vocabulary was refused: %s", got)
-	}
-	bad := aChannel("telegram", "telegram")
-	bad.Claims[0].Capabilities = []string{"trusted", "max-length:lots"}
-	got := problemsFor(t, Shelf{"messenger": router(), "telegram": bad})
-	for _, w := range []string{`"trusted"`, `"max-length:lots"`} {
-		if !strings.Contains(got, w+", which channel-capabilities/1 does not have") {
-			t.Errorf("%s was not refused: %s", w, got)
-		}
-	}
-	odd := Manifest{Module: "odd", Claims: []Claim{{Name: "operator-channel", Scope: ScopeMesh, Capabilities: []string{"deliver"}}}}
-	if got := problemsFor(t, Shelf{"messenger": router(), "odd": odd}); !strings.Contains(got, "only a kinded bench's claim carries them") {
-		t.Errorf("capabilities on a seat that is not kinded stood: %s", got)
-	}
-}
-
-// novox/hq ADR 0259 §8: a module saying warrants, or speaking for a kind that proves its sender, runs as an
-// account of its own — never carried by the machine's runtime, which runs as the operator's account.
-func TestATrustedHolderMustRunAsAnAccountOfItsOwn(t *testing.T) {
-	r := router()
-	r.RunsAs = ""
-	if got := problemsFor(t, Shelf{"messenger": r}); !strings.Contains(got, "messenger must run as an account of its own") {
-		t.Errorf("a router on the machine's runtime stood: %s", got)
-	}
-	tg := aChannel("telegram", "telegram")
-	tg.Claims[0].Capabilities = []string{"choice", "verified-sender"}
-	if got := problemsFor(t, Shelf{"messenger": router(), "telegram": tg}); !strings.Contains(got, "telegram must run as an account of its own") {
-		t.Errorf("a verified channel on the machine's runtime stood: %s", got)
-	}
-	desk := aChannel("desk-channel", "desktop")
-	desk.Claims[0].Capabilities = []string{"choice"}
-	if got := problemsFor(t, Shelf{"messenger": router(), "desk-channel": desk}); got != "" {
-		t.Errorf("a channel proving nothing was held to it: %s", got)
-	}
-}
-
-func TestRunsAsIsAnAccountOfTheModulesOwn(t *testing.T) {
-	ok := Manifest{Module: "telegram", RunsAs: "telegram", SecretsOwner: "telegram",
-		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/telegram/broker"}},
-		Resources:  []map[string]any{{"id": "account", "type": "user", "name": "telegram"}}}
-	if got := RunsAsProblems(ok); len(got) != 0 {
-		t.Fatalf("a sound runs-as was refused: %v", got)
-	}
-	for want, change := range map[string]func(*Manifest){
-		"never root":                 func(m *Manifest) { m.RunsAs, m.SecretsOwner = "root", "root" },
-		"not an account name":        func(m *Manifest) { m.RunsAs = "${machine:account}" },
-		"which it does not make":     func(m *Manifest) { m.Resources = nil },
-		"declares no own secret":     func(m *Manifest) { m.OwnSecrets = nil },
-		"they are the account's own": func(m *Manifest) { m.SecretsOwner = "" },
-	} {
-		m := ok
-		m.Resources = append([]map[string]any(nil), ok.Resources...)
-		m.OwnSecrets = OwnSecrets{"broker": {Path: "/x"}}
-		change(&m)
-		if got := strings.Join(RunsAsProblems(m), "; "); !strings.Contains(got, want) {
-			t.Errorf("want %q, got %q", want, got)
-		}
-	}
-}

internal/catalogue/machine_into_files.go

@@ -78,9 +78,47 @@ func machineFacts(r Resolution, names map[string]string, meshRange string) map[s
 		out["account"] = r.Account
 		out["account-home"] = accountHomeOf(r.Account, r.AccountHome)
 	}
+	// The account agents run as here, and whether it must never become root (novox/hq ADR 0266). The agent
+	// account where the node names one; the operator account otherwise, so a module writing the agent's
+	// home names one fact on every machine. `agent-root` is "never" only for an account of the agents' own:
+	// the user resource naming it then asks the node-engine to judge it, and on a machine where agents run
+	// as the operator it is empty, asserting nothing — the operator's account may become root there.
+	if agent, home := r.agentAccount(); agent != "" {
+		out["agent-account"] = agent
+		out["agent-home"] = home
+		out["agent-root"] = ""
+		if r.AgentAccount != "" {
+			out["agent-root"] = RootNever
+		}
+	}
 	return out
 }
 
+// RootNever is what a user resource's `root` says of an account that must never become root without a
+// person (novox/hq ADR 0266); the node-engine judges it.
+const RootNever = "never"
+
+// agentAccount is the account agents run as on this machine and its home: the agent account when the node
+// names one (novox/hq ADR 0266), else the operator account; empty when neither is known.
+func (r Resolution) agentAccount() (string, string) {
+	if r.AgentAccount != "" {
+		return r.AgentAccount, agentHomeOf(r.AgentAccount, r.AgentAccountHome)
+	}
+	if r.Account != "" {
+		return r.Account, accountHomeOf(r.Account, r.AccountHome)
+	}
+	return "", ""
+}
+
+// agentHomeOf is where the agent account's home is: what was stored, or /home/<account>. Never /root: the
+// agent account is never root.
+func agentHomeOf(account, home string) string {
+	if home != "" {
+		return home
+	}
+	return "/home/" + account
+}
+
 // accountHomeOf is where an account's home is: what was stored, or the derived default — /root for
 // root, /home/<account> otherwise. The one place the default is written, so a fact and the store
 // cannot disagree about it.
@@ -105,8 +143,12 @@ func machineInto(resource map[string]any, facts map[string]string, module string
 	// (novox/hq to-be 29), the same reason its content names ${machine:address}. And the name a
 	// `user` shape sets the login shell of, and the user a user-scoped unit or a process runs as:
 	// the shell module makes the operator's account its holder's login shell, and the desktop's
-	// watchers run as that account (novox/hq ADR 0176, ADR 0177) — neither can name the person.
+	// watchers run as that account (novox/hq ADR 0176, ADR 0177) — neither can name the person. And a
-	for _, field := range []string{"path", "owner", "content", "name", "user"} {
+	// user's `root`: the agent's module declares the account agents run as with ${machine:agent-root},
+	// "never" only where that account is the agents' own (novox/hq ADR 0266), and its `home`, so an account
+	// the operator named with a home of its own is made there (${machine:agent-home}); the node-engine reads a
+	// user's home only when it creates the account, so an existing one is never moved.
+	for _, field := range []string{"path", "owner", "content", "name", "user", "root", "home"} {
 		s, ok := resource[field].(string)
 		if !ok {
 			continue

internal/catalogue/manifest.go

@@ -64,13 +64,6 @@ type Claim struct {
 	// text/template over one piece — its fields and `module` — in the tool's own grammar (novox/hq ADR
 	// 0255). The data is the mesh's, the format the holder's, as a module's facts template is.
 	Renders map[string]string `json:"renders,omitempty"`
-	// Kind is the kind this module holds a kinded bench as (novox/hq ADR 0234 §2, ADR 0259): `telegram`,
-	// `desktop`. Refused on any other seat, and a second claim of one kind is refused.
-	Kind string `json:"kind,omitempty"`
-	// Capabilities are what a channel of this kind promises, from the fixed vocabulary
-	// channel-capabilities/1 (novox/hq ADR 0234 §2): the router judges an answer by these, read from the
-	// controller's record of this claim and never from the channel.
-	Capabilities []string `json:"capabilities,omitempty"`
 }
 
 // ServesFor is what this claim offers a seat's protocol: the verbs it names, else the module's
@@ -647,13 +640,6 @@ type Manifest struct {
 	// cannot use.
 	SecretsOwner string `json:"secrets-owner,omitempty"`
 
-	// RunsAs is the account this module's tools bundle runs as, in a runtime of its own on a bus account of
-	// its own (novox/hq ADR 0259 §8): never the machine's runtime, which runs as the operator's account and
-	// carries every module on the machine. The account is one the module makes (a `user` resource of that
-	// name), owns its secrets (`secrets-owner`), and is neither root nor the operator's. Required of a module
-	// that says a warrant, or speaks for a channel kind that proves its sender.
-	RunsAs string `json:"runs-as,omitempty"`
-
 	// Keeps is where this module wants every operator-sealed secret in the mesh written — the
 	// vault's field, and so far nobody else's (novox/hq ADR 0085, amended).
 	//
@@ -1634,7 +1620,6 @@ func ParseManifest(raw []byte) (Manifest, error) {
 	// prefix. Whether a seat anybody names exists, and whether a holder answers for it, are
 	// facts about the catalogue and are checked at registration (CatalogueProblems).
 	problems = append(problems, declaredSeatProblems(m)...)
-	problems = append(problems, RunsAsProblems(m)...)
 	if m.Computed != "" && len(m.Resources) > 0 {
 		// One or the other. A module that both ships files and has them computed would leave
 		// nobody able to say where a given file came from.

internal/catalogue/resolve.go

@@ -32,6 +32,11 @@ type Node struct {
 	// to-be 29). What a home-scoped file is owned by and what ${machine:account} resolves to.
 	Account     string
 	AccountHome string
+	// AgentAccount is the login agents run as here when it is not the operator's, AgentAccountHome its
+	// home when not derived (novox/hq ADR 0266). What ${machine:agent-account} resolves to; empty means
+	// agents run as the operator account.
+	AgentAccount     string
+	AgentAccountHome string
 }
 
 // World is what the rest of the mesh already has.
@@ -115,16 +120,6 @@ type Held struct {
 	Node   string
 	Module string
 	Site   string
-	// Kind is the kind a kinded bench is held as (novox/hq ADR 0234 §2): each kind is its own holder.
-	Kind string
-}
-
-// heldKey is what one holder holds: the seat, and its kind on a kinded bench.
-func heldKey(claim, kind string) string {
-	if kind == "" {
-		return canonicalSeat(claim)
-	}
-	return canonicalSeat(claim) + "/" + kind
 }
 
 // Resolution is what a node should run, and why.
@@ -144,6 +139,10 @@ type Resolution struct {
 	// here without a store lookup.
 	Account     string
 	AccountHome string
+	// AgentAccount and AgentAccountHome are the account agents run as here when it is not the
+	// operator's, and its home (novox/hq ADR 0266); empty when agents run as the operator account.
+	AgentAccount     string
+	AgentAccountHome string
 	// Capabilities are the machine's, as its profile reported them, carried from the node so a
 	// contribution placed only where the machine has something (`if-capability`, novox/hq ADR 0255)
 	// is decided here without a store lookup.
@@ -713,7 +712,8 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 	}
 
 	resolution := Resolution{Node: node.Name, At: node.At, PublicDomain: node.PublicDomain,
-		Account: node.Account, AccountHome: node.AccountHome, Capabilities: node.Capabilities,
+		Account: node.Account, AccountHome: node.AccountHome, AgentAccount: node.AgentAccount,
+		AgentAccountHome: node.AgentAccountHome, Capabilities: node.Capabilities,
 		Because: because, Needs: needs, Unhostable: unhostable, Kept: kept}
 	for _, n := range providersFirst(order, catalogue) {
 		resolution.Modules = append(resolution.Modules, catalogue[n])
@@ -874,7 +874,7 @@ func checkClaims(modules []Manifest, node Node, elsewhere []Held, holdings []Hel
 			// **One seat under either of its names** (novox/hq ADR 0122): a manifest registered before
 			// a rename claims the former name, and one written after it the current — two claimants of
 			// one seat, compared by the seat they resolve to and not by how each spelled it.
-			seat := heldKey(c.Name, c.Kind)
+			seat := canonicalSeat(c.Name)
 			if other, taken := byScope[scope][seat]; taken {
 				problems = append(problems, fmt.Sprintf(
 					"%s and %s both claim %q, and only one thing may hold it per %s",
@@ -883,14 +883,14 @@ func checkClaims(modules []Manifest, node Node, elsewhere []Held, holdings []Hel
 			}
 			byScope[scope][seat] = m.Module
 			held = append(held, Held{Claim: c.Name, Scope: scope, Node: node.Name,
-				Module: m.Module, Site: node.Site, Kind: c.Kind})
+				Module: m.Module, Site: node.Site})
 		}
 	}
 
 	// And against the rest of the mesh, for the scopes that reach past this machine.
 	for _, h := range held {
 		for _, e := range elsewhere {
-			if e.Node == node.Name || heldKey(e.Claim, e.Kind) != heldKey(h.Claim, h.Kind) || e.Scope != h.Scope {
+			if e.Node == node.Name || canonicalSeat(e.Claim) != canonicalSeat(h.Claim) || e.Scope != h.Scope {
 				continue
 			}
 			switch h.Scope {

internal/catalogue/runtime.go

@@ -83,6 +83,11 @@ const (
 	RuntimeBrokerFile      = "MESH_BROKER_FILE"
 	RuntimeOperatorAccount = "MESH_OPERATOR_ACCOUNT"
 	RuntimeOperatorHome    = "MESH_OPERATOR_HOME"
+	// RuntimeAgentAccount and RuntimeAgentHome are the account agents run as on the machine and its home
+	// (novox/hq ADR 0266): the agent account where the node names one, the operator account otherwise.
+	// The agent's module writes the agent's home from them; absent where neither account is known.
+	RuntimeAgentAccount = "MESH_AGENT_ACCOUNT"
+	RuntimeAgentHome    = "MESH_AGENT_HOME"
 	// RuntimeToolEnv is every served module's composed environment, as JSON (novox/hq ADR 0192):
 	// {"<module>": {"<word>": "<value>"}}. The runtime takes it at start, removes it from its own
 	// environment and hands each module's words to that module's bundles alone. In the unit, so a
@@ -165,10 +170,6 @@ func (r Resolution) runtimeProcess(with Rendering) (map[string]any, error) {
 		if with.Adopted && m.Filtering != nil {
 			continue
 		}
-		if m.RunsAs != "" {
-			// Served by a runtime of its own, on its own account (ownRuntimes): never the machine's.
-			continue
-		}
 		words, err := bundleWords(m, with)
 		if err != nil {
 			return nil, err
@@ -219,6 +220,10 @@ func (r Resolution) runtimeProcess(with Rendering) (map[string]any, error) {
 		env[RuntimeOperatorHome] = accountHomeOf(r.Account, r.AccountHome)
 		process["user"] = r.Account
 	}
+	if agent, home := r.agentAccount(); agent != "" {
+		env[RuntimeAgentAccount] = agent
+		env[RuntimeAgentHome] = home
+	}
 	// Routed through the artifact store as this network reaches it now, like everything the mesh
 	// built; refused with the same words when there is no store to route through.
 	if err := artifactsInto(process, RuntimeModule, with); err != nil {
@@ -227,84 +232,6 @@ func (r Resolution) runtimeProcess(with Rendering) (map[string]any, error) {
 	return process, nil
 }
 
-// OwnRuntimeID names the process a module of its own account is served by (novox/hq ADR 0259 §8).
-func OwnRuntimeID() string { return "own-runtime" }
-
-// ownRuntimes are the processes the modules of their own account are served by (novox/hq ADR 0259 §8): each
-// the machine's runtime program — the same build, run from the same source — serving that one module alone,
-// as the module's own account, on the module's own bus credential. Never the machine's runtime, which runs
-// as the operator's account and carries every module on the machine.
-func (r Resolution) ownRuntimes(with Rendering) ([]map[string]any, error) {
-	var own []Manifest
-	for _, m := range r.Modules {
-		if m.RunsAs != "" && !(with.Adopted && m.Filtering != nil) {
-			own = append(own, m)
-		}
-	}
-	if len(own) == 0 {
-		return nil, nil
-	}
-	var runtime *Manifest
-	for i := range r.Modules {
-		if r.Modules[i].Module == RuntimeModule {
-			runtime = &r.Modules[i]
-		}
-	}
-	if runtime == nil || len(runtime.Bundles) != 1 || runtime.Bundles[0].Binary == "" {
-		return nil, fmt.Errorf("%s runs as its own account in a runtime of its own, and %s is not here to run it "+
-			"from: assign %s to %s first (novox/hq ADR 0259)", own[0].Module, RuntimeModule, RuntimeModule, r.Node)
-	}
-	program := runtime.Bundles[0]
-	var out []map[string]any
-	for _, m := range own {
-		credential, declared := m.OwnSecrets["broker"]
-		if !declared {
-			return nil, fmt.Errorf("%s runs as its own account and declares no own secret broker", m.Module)
-		}
-		var served, restartOn []string
-		for _, b := range m.Bundles {
-			for _, load := range b.Loads {
-				if launcher, has := b.Launchers[load]; has {
-					load = launcher
-				}
-				served = append(served, m.Module+"="+BundlePath(m.Module, b.Name)+"/"+load)
-			}
-			if len(b.Loads) > 0 {
-				restartOn = append(restartOn, m.Module+"."+BundleID(b.Name))
-			}
-		}
-		if len(served) == 0 {
-			return nil, fmt.Errorf("%s runs as its own account and its build produced no bundle to serve", m.Module)
-		}
-		sort.Strings(served)
-		restartOn = append(restartOn, m.Module+"."+NeedID("broker"))
-		sort.Strings(restartOn)
-		env := map[string]string{RuntimeToolModules: strings.Join(served, ","), RuntimeBrokerFile: credential.Path}
-		words, err := bundleWords(m, with)
-		if err != nil {
-			return nil, err
-		}
-		if len(words) > 0 {
-			body, err := json.Marshal(map[string]map[string]string{m.Module: words})
-			if err != nil {
-				return nil, err
-			}
-			env[RuntimeToolEnv] = string(body)
-		}
-		process := map[string]any{
-			"id": m.Module + "." + OwnRuntimeID(), "type": "process", "name": m.Module + "-runtime",
-			"source": program.Source, "digest": program.Digest,
-			"run": []any{"./" + program.Binary}, "env": env, "restart-on": toAny(restartOn),
-			"user": m.RunsAs,
-		}
-		if err := artifactsInto(process, RuntimeModule, with); err != nil {
-			return nil, err
-		}
-		out = append(out, process)
-	}
-	return out, nil
-}
-
 func toAny(in []string) []any {
 	out := make([]any, 0, len(in))
 	for _, s := range in {

internal/catalogue/runtime_test.go

@@ -457,49 +457,3 @@ func TestAGoToolsBundleIsServedByItsBinary(t *testing.T) {
 		t.Error("a Go bundle loading a file it does not contain was admitted")
 	}
 }
-
-// novox/hq ADR 0259 §8: a module of its own account is served by a runtime of its own — the machine's
-// runtime program, as that account, on that module's own credential — and never by the machine's runtime,
-// which runs as the operator's account and is given none of its words.
-func TestAModuleOfItsOwnAccountIsServedByARuntimeOfItsOwn(t *testing.T) {
-	with := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}, "telegram": {"broker": "own"}}}
-	goRuntime := Manifest{Module: RuntimeModule, Version: "1",
-		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/" + RuntimeModule + "/broker"}},
-		Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "go",
-			System: "arch", From: "cmd/node-tools"}}}}
-	goRuntime, err := goRuntime.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	telegram := aToolsModule(t, "telegram", "tools/index.js")
-	telegram.RunsAs, telegram.SecretsOwner = "telegram", "telegram"
-	telegram.OwnSecrets = OwnSecrets{"broker": {Path: "/var/lib/telegram/broker"}}
-	out, err := Resolution{Node: "anchor", Account: "ops",
-		Modules: []Manifest{aToolsModule(t, "nftables", "tools/index.js"), telegram, goRuntime}}.Declaration(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	machine := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
-	if served := machine["env"].(map[string]string)[RuntimeToolModules]; strings.Contains(served, "telegram") || !strings.Contains(served, "nftables") {
-		t.Errorf("the machine's runtime serves %q", served)
-	}
-	own := fileNamed(out, "telegram."+OwnRuntimeID())
-	if own == nil {
-		t.Fatalf("telegram has no runtime of its own: %v", ids(out))
-	}
-	env := own["env"].(map[string]string)
-	if own["user"] != "telegram" || fmt.Sprint(own["run"]) != "[./node-tools]" ||
-		env[RuntimeBrokerFile] != "/var/lib/telegram/broker" ||
-		env[RuntimeToolModules] != "telegram="+BundleRoot+"/telegram/tools/tools/index.js" {
-		t.Errorf("its own runtime: user %v run %v env %v", own["user"], own["run"], env)
-	}
-	if _, told := env[RuntimeOperatorAccount]; told {
-		t.Error("a runtime of a module's own account is told the operator's account")
-	}
-	// Without the machine's runtime to run it from, it is refused in words.
-	if _, err := (Resolution{Node: "anchor", Modules: []Manifest{telegram}}).ownRuntimes(with); err == nil {
-		t.Error("a module of its own account composed without a runtime program")
-	}
-}

internal/catalogue/seats_declared.go

@@ -2,7 +2,6 @@ package catalogue
 
 import (
 	"fmt"
-	"regexp"
 	"sort"
 	"strings"
 )
@@ -52,35 +51,6 @@ type SeatDeclaration struct {
 	// owns its own, which is why a seat is also the answer for a module that needs retention
 	// its events cannot have.
 	RetainSeconds int `json:"retain-seconds,omitempty"`
-
-	// Kinded makes the seat a kinded bench (novox/hq ADR 0234 §2, ADR 0259 §3): its holders are different
-	// modules, each claiming one kind, and each verb's subject carries the kind. Only the benches in
-	// KindedBenches may be kinded; making another is a decision, recorded.
-	Kinded bool `json:"kinded,omitempty"`
-	// ByCaller are accepts and emits whose subject's last token names the calling module (ADR 0259 §3): a
-	// user submits such an accept, and hears such an event, under its own name and no other.
-	ByCaller []string `json:"by-caller,omitempty"`
-	// Proofs are verbs carried as core request and reply, never on a stream: what travels on them (a code
-	// the operator typed) is never kept (ADR 0259 §3). On a kinded bench a holder asks with its own kind and
-	// the modules watching the seat answer.
-	Proofs []string `json:"proofs,omitempty"`
-	// Records are state buckets of the declaring module that each user reads under its own name — the
-	// keys `<user>.…` and no other (ADR 0259 §3).
-	Records []string `json:"records,omitempty"`
-}
-
-// KindedBenches are the seats that may be kinded (novox/hq ADR 0234 §2): `channel` sends to the operator,
-// `intake` takes what the operator answers. Another is a decision, recorded, as ADR 0223 asks of a bench.
-var KindedBenches = map[string]bool{"channel": true, "intake": true}
-
-// NamedByCaller says whether one of the seat's verbs is named by its caller.
-func (s SeatDeclaration) NamedByCaller(verb string) bool {
-	for _, v := range s.ByCaller {
-		if v == verb {
-			return true
-		}
-	}
-	return false
 }
 
 // At is this declaration's scope, with the default applied. Mesh by default, because a seat
@@ -162,7 +132,6 @@ func declaredSeatProblems(m Manifest) []string {
 					"%s declares %s.%s, which is not a usable verb", m.Module, s.Name, v))
 			}
 		}
-		problems = append(problems, trafficProblems(m, s)...)
 	}
 
 	for _, u := range m.Uses {
@@ -173,56 +142,6 @@ func declaredSeatProblems(m Manifest) []string {
 	return problems
 }
 
-// trafficProblems is what one declaration of the rules of ADR 0259 §3 can be judged on alone.
-func trafficProblems(m Manifest, s SeatDeclaration) []string {
-	var problems []string
-	if s.Kinded && !KindedBenches[s.Name] {
-		problems = append(problems, fmt.Sprintf(
-			"%s declares %s as a kinded bench; only channel and intake are kinded, and another is a "+
-				"decision, recorded (novox/hq ADR 0234)", m.Module, s.Name))
-	}
-	if s.Kinded && len(s.ByCaller) > 0 {
-		problems = append(problems, fmt.Sprintf(
-			"%s declares %s kinded and names verbs by their caller; a kinded bench's subjects carry the kind",
-			m.Module, s.Name))
-	}
-	for _, v := range s.ByCaller {
-		inAccepts, inEmits := false, false
-		for _, a := range s.Accepts {
-			inAccepts = inAccepts || a == v
-		}
-		for _, e := range s.Emits {
-			inEmits = inEmits || e == v
-		}
-		if !inAccepts && !inEmits {
-			problems = append(problems, fmt.Sprintf(
-				"%s names %s.%s by its caller, which the seat neither accepts nor emits", m.Module, s.Name, v))
-		}
-	}
-	for _, v := range s.Proofs {
-		if !name.MatchString(v) || strings.Contains(v, ".") {
-			problems = append(problems, fmt.Sprintf("%s declares the proof %s.%s, which is not a usable verb",
-				m.Module, s.Name, v))
-		}
-	}
-	if len(s.Proofs) > 0 && !s.Kinded {
-		problems = append(problems, fmt.Sprintf(
-			"%s declares proofs on %s, which is not kinded; a proof is asked by a holder of a kind",
-			m.Module, s.Name))
-	}
-	for _, r := range s.Records {
-		kept := false
-		for _, st := range m.State {
-			kept = kept || st.Name == r
-		}
-		if !kept {
-			problems = append(problems, fmt.Sprintf(
-				"%s says %s's users read its records %q, which it keeps no state of", m.Module, s.Name, r))
-		}
-	}
-	return problems
-}
-
 // A Shelf is every manifest the mesh has registered, by module name.
 type Shelf map[string]Manifest
 
@@ -263,19 +182,8 @@ func CatalogueProblems(shelf Shelf) []string {
 		return ok
 	}
 
-	// Who claims each kind of a kinded bench, so a second claim of one kind is refused (ADR 0234 §2).
-	kindsTaken := map[string]string{}
-
 	for _, module := range shelfOrder(shelf) {
 		m := shelf[module]
-		for _, c := range m.Claims {
-			if c.Kind != "" {
-				if _, isModuleSeat := declared[c.Name]; !isModuleSeat {
-					problems = append(problems, fmt.Sprintf(
-						"%s claims %s of kind %q, and only a kinded bench takes a kind", module, c.Name, c.Kind))
-				}
-			}
-		}
 
 		// A `uses` naming nothing is where ADR 0110's guarantee lands under a derived set: the
 		// same refusal, at the same moment, from a set nobody maintains by hand.
@@ -306,7 +214,6 @@ func CatalogueProblems(shelf Shelf) []string {
 				}
 				continue
 			}
-			problems = append(problems, kindProblems(module, c, s, kindsTaken)...)
 			if c.At() != s.At() {
 				problems = append(problems, fmt.Sprintf(
 					"%s claims %s at scope %q, and %s declares it at %s",
@@ -321,16 +228,6 @@ func CatalogueProblems(shelf Shelf) []string {
 			}
 		}
 	}
-	// **A trusted holder runs as its own account** (novox/hq ADR 0259 §8): a module saying warrants, or
-	// speaking for a kind that proves its sender, is never carried by a machine's runtime.
-	for _, module := range shelfOrder(shelf) {
-		m := shelf[module]
-		if why := TrustedHolding(m, declared); why != "" && m.RunsAs == "" {
-			problems = append(problems, fmt.Sprintf(
-				"%s must run as an account of its own (runs-as): %s, and the machine's runtime runs as the "+
-					"operator's account, which every agent runs as (novox/hq ADR 0259)", module, why))
-		}
-	}
 	// A read of a module's state that module does not keep (novox/hq ADR 0201) — said only where the
 	// owner is on the shelf, as a consumer may be installed before its emitter.
 	var manifests []Manifest
@@ -342,63 +239,6 @@ func CatalogueProblems(shelf Shelf) []string {
 	return problems
 }
 
-// ChannelCapabilities is the fixed vocabulary `channel-capabilities/1` (novox/hq ADR 0234 §2): a word
-// outside it is refused. `max-length:<N>` takes a number.
-var ChannelCapabilities = map[string]bool{
-	"deliver": true, "reaches-away": true, "loud": true, "silent": true, "edit": true,
-	"reaches-when-mesh-down": true, "private": true,
-	"choice": true, "reply": true, "threads": true, "operator-first": true,
-	"verified-sender": true, "exact-render": true, "code-factor": true, "key-factor": true,
-}
-
-var maxLength = regexp.MustCompile(`^max-length:[1-9][0-9]{0,6}$`)
-
-// capabilityProblems are the words of a claim outside the vocabulary, and capabilities on a claim of a
-// seat that is not kinded.
-func capabilityProblems(module string, c Claim, kinded bool) []string {
-	if len(c.Capabilities) == 0 {
-		return nil
-	}
-	if !kinded {
-		return []string{fmt.Sprintf("%s claims %s with capabilities, and only a kinded bench's claim carries them",
-			module, c.Name)}
-	}
-	var problems []string
-	for _, w := range c.Capabilities {
-		if !ChannelCapabilities[w] && !maxLength.MatchString(w) {
-			problems = append(problems, fmt.Sprintf(
-				"%s claims %s with the capability %q, which channel-capabilities/1 does not have", module, c.Name, w))
-		}
-	}
-	return problems
-}
-
-// kindProblems is a claim judged against a declared seat's kind: a kinded bench takes one claim per kind,
-// a usable name; any other seat takes none.
-func kindProblems(module string, c Claim, s SeatDeclaration, taken map[string]string) []string {
-	if problems := capabilityProblems(module, c, s.Kinded); len(problems) > 0 {
-		return problems
-	}
-	switch {
-	case !s.Kinded && c.Kind != "":
-		return []string{fmt.Sprintf("%s claims %s of kind %q, and only a kinded bench takes a kind",
-			module, c.Name, c.Kind)}
-	case !s.Kinded:
-		return nil
-	case c.Kind == "":
-		return []string{fmt.Sprintf("%s claims the kinded bench %s and names no kind", module, c.Name)}
-	case !name.MatchString(c.Kind) || strings.Contains(c.Kind, "."):
-		return []string{fmt.Sprintf("%s claims %s of kind %q, which is not a usable name", module, c.Name, c.Kind)}
-	}
-	key := c.Name + "/" + c.Kind
-	if first, ok := taken[key]; ok && first != module {
-		return []string{fmt.Sprintf("%s claims %s of kind %q, which %s already claims; a kind has one holder",
-			module, c.Name, c.Kind, first)}
-	}
-	taken[key] = module
-	return nil
-}
-
 // unserved is what a seat's protocol promises and the claimant does not answer. Only the tools
 // are checked: `accepts` and `emits` are wired by the runtime from the declaration, while a tool
 // is code the module either has or has not written — under the claim's serves, or among its own.
@@ -426,65 +266,3 @@ func shelfOrder(shelf Shelf) []string {
 	sort.Strings(out)
 	return out
 }
-
-var accountName = regexp.MustCompile(`^[a-z_][a-z0-9_-]{0,30}$`)
-
-// RunsAsProblems is what one manifest's `runs-as` is held to (novox/hq ADR 0259 §8): an account of the
-// module's own making — a `user` resource of that name — that owns its secrets, with a bus account of its own,
-// and that is neither root nor the operator's.
-func RunsAsProblems(m Manifest) []string {
-	if m.RunsAs == "" {
-		return nil
-	}
-	var problems []string
-	say := func(format string, a ...any) { problems = append(problems, fmt.Sprintf(format, a...)) }
-	switch {
-	case !accountName.MatchString(m.RunsAs):
-		say("%s runs as %q, which is not an account name of the module's own", m.Module, m.RunsAs)
-		return problems
-	case m.RunsAs == "root":
-		say("%s runs as root; a module of its own account runs as an account it makes, never root", m.Module)
-	}
-	made := false
-	for _, r := range m.Resources {
-		if fmt.Sprint(r["type"]) == "user" && fmt.Sprint(r["name"]) == m.RunsAs {
-			made = true
-		}
-	}
-	if !made {
-		say("%s runs as %s, which it does not make: a user resource named %s", m.Module, m.RunsAs, m.RunsAs)
-	}
-	if _, has := m.OwnSecrets["broker"]; !has {
-		say("%s runs as its own account and declares no own secret broker: its runtime reaches the bus on an "+
-			"account of its own", m.Module)
-	}
-	if m.SecretsOwner != m.RunsAs {
-		say("%s runs as %s, and its secrets belong to %q: they are the account's own", m.Module, m.RunsAs, m.SecretsOwner)
-	}
-	return problems
-}
-
-// TrustedHolding is why a module must run as its own account (novox/hq ADR 0259 §8), or "": it holds a seat
-// whose events it says to one caller each (a warrant), or speaks for a kind of a kinded bench that proves
-// its sender. Neither may be carried by the machine's runtime, which runs as the operator's account.
-func TrustedHolding(m Manifest, declared map[string]SeatDeclaration) string {
-	for _, c := range m.Claims {
-		s, ok := declared[c.Name]
-		if !ok {
-			continue
-		}
-		for _, e := range s.Emits {
-			if s.NamedByCaller(e) {
-				return fmt.Sprintf("it holds %s, whose %s it says to one caller each", c.Name, e)
-			}
-		}
-		if s.Kinded {
-			for _, capability := range c.Capabilities {
-				if capability == "verified-sender" {
-					return fmt.Sprintf("it holds %s of kind %s, which proves its sender", c.Name, c.Kind)
-				}
-			}
-		}
-	}
-	return ""
-}

internal/catalogue/verbs.go

@@ -237,9 +237,9 @@ var ControllerVerbs = []Verb{
 			"node":   "the machine that runs the module",
 			"module": "the module's name",
 		}, []string{"node", "module"})},
-	{Name: "token", Description: "Issue a one-time token for a machine to join with. Give the public half of the " +
+	{Name: "token", Description: "Refused through a verb since novox/hq ADR 0266: the one-time token a machine " +
-		"tunnel key the machine made (`nox-mesh-host key`): the machine is given its address and made a peer of " +
+		"joins with is answered to its caller, and whoever may call a verb includes agents. Issue it at the " +
-		"the hub, and joins through the tunnel. The token is shown once, in the answer.",
+		"controller's terminal: `mesh-controller token issue --new <name> --overlay-key <public half>`.",
 		Input: schema(map[string]string{
 			"node":        "a machine the mesh already has a record for",
 			"new":         "or the name of a machine to create the record for",
@@ -267,10 +267,14 @@ var ControllerVerbs = []Verb{
 			"list": "\"preferences\": every module's preferences — key, default and why — and the value on each " +
 				"machine it is assigned to with where it comes from; module and node narrow it (novox/hq ADR 0262)",
 		}, nil, "clear", "replace", "history")},
-	{Name: "command", Description: "Run one command line of the controller's own, as you would type it at its " +
+	{Name: "command", Description: "Run one reading command line of the controller's own, as you would type it at " +
-		"shell — `node account g14 jochen`, `node show ace`, `module list` — and answer what it printed. The " +
+		"its shell — `node show ace`, `module list`, `plans`, `conditions show <key>` — and answer what it " +
-		"generic verb beside the named ones (novox/hq ADR 0154): everything the binary can do, without a verb " +
+		"printed. The generic verb beside the named ones (novox/hq ADR 0154), and since ADR 0266 it only reads: " +
-		"per command. Any node may call any tool (ADR 0175), so nothing is held back here.",
+		"status, version, help, seats, healers, hand-acts, durations, collection, images, artifacts, data, builds, " +
+		"queue, plan, plans (not stop/close/go), doctor (not run), conditions list/show/history, node list/show, " +
+		"module list, settings show/preferences, retire list, cleanup list, delivery plan/walks, bus, mirrors (not " +
+		"--record/--confirm). What writes has its named verb; what sets a key, issues a credential or a token, or " +
+		"accepts, recovers or exports a secret is the controller's terminal's alone.",
 		Input: schema(map[string]string{
 			"command": "the command line, as the controller's binary takes it; quotes group a word with spaces",
 		}, []string{"command"})},

internal/facts/facts.go

@@ -131,6 +131,10 @@ type Machine struct {
 	// home is when that is not the derived one.
 	Account     string `json:"account,omitempty"`
 	AccountHome string `json:"account-home,omitempty"`
+	// AgentAccount is the account agents run as there when it is not the operator's (a pseudonym), and
+	// AgentAccountHome its home when not derived (novox/hq ADR 0266).
+	AgentAccount     string `json:"agent-account,omitempty"`
+	AgentAccountHome string `json:"agent-account-home,omitempty"`
 	// PublicDomain is the domain it answers for, its labels replaced.
 	PublicDomain string `json:"public-domain,omitempty"`
 	// Assigned is every module assigned there.

internal/inventory/agent_account_test.go

@@ -0,0 +1,93 @@
+package inventory
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+)
+
+// The agent account (novox/hq ADR 0266): recorded and read back with every node, its home derived when
+// not stated, cleared by an empty name — and refused when it is root, the operator's own account, or no
+// login at all, because each of those would say agents have an account of their own while they do not.
+func TestAgentAccountIsRecordedAndRefusedWhereItWouldNotConfine(t *testing.T) {
+	inv := ForTest(t)
+	ctx := context.Background()
+	if _, err := inv.AddNode(ctx, "anchor"); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.SetAccount(ctx, "anchor", "operator", ""); err != nil {
+		t.Fatal(err)
+	}
+
+	n, err := inv.NodeByName(ctx, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n.AgentAccount != "" || n.AgentHome() != "" {
+		t.Fatalf("a node that names none has agent account %q, home %q", n.AgentAccount, n.AgentHome())
+	}
+
+	if err := inv.SetAgentAccount(ctx, "anchor", "agent", ""); err != nil {
+		t.Fatal(err)
+	}
+	n, _ = inv.NodeByName(ctx, "anchor")
+	if n.AgentAccount != "agent" || n.AgentHome() != "/home/agent" {
+		t.Fatalf("agent account %q, home %q; want agent, /home/agent", n.AgentAccount, n.AgentHome())
+	}
+	all, err := inv.Nodes(ctx)
+	if err != nil || len(all) != 1 || all[0].AgentAccount != "agent" {
+		t.Fatalf("the listing does not carry the agent account: %+v %v", all, err)
+	}
+
+	if err := inv.SetAgentAccount(ctx, "anchor", "agent", "/srv/agent"); err != nil {
+		t.Fatal(err)
+	}
+	if n, _ = inv.NodeByName(ctx, "anchor"); n.AgentHome() != "/srv/agent" {
+		t.Fatalf("the stated home is %q", n.AgentHome())
+	}
+
+	for _, c := range []struct{ account, home, says string }{
+		{"root", "", "may not run as root"},
+		{"operator", "", "operator account"},
+		{"Agent", "", "not a login name"},
+		{"9agent", "", "not a login name"},
+		{"agent", "relative", "absolute"},
+		{"postgres", "", "service account"},
+		{"systemd-network", "", "service account"},
+		{"showcase", "", "service account"},
+		{"", "/home/x", "without an agent account"},
+	} {
+		err := inv.SetAgentAccount(ctx, "anchor", c.account, c.home)
+		if err == nil || !strings.Contains(err.Error(), c.says) {
+			t.Errorf("%q %q: %v; want a refusal saying %q", c.account, c.home, err, c.says)
+		}
+	}
+	if n, _ = inv.NodeByName(ctx, "anchor"); n.AgentAccount != "agent" {
+		t.Fatalf("a refusal changed the record: %q", n.AgentAccount)
+	}
+
+	// The other direction: the operator account may not be named as the agent account either.
+	if err := inv.SetAccount(ctx, "anchor", "agent", ""); err == nil || !strings.Contains(err.Error(), "agent account") {
+		t.Fatalf("the operator account named as the agent account: %v; want a refusal", err)
+	}
+	if n, _ = inv.NodeByName(ctx, "anchor"); n.Account != "operator" {
+		t.Fatalf("a refusal changed the operator account: %q", n.Account)
+	}
+
+	if err := inv.SetAgentAccount(ctx, "anchor", "", ""); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.SetAccount(ctx, "anchor", "agent", ""); err != nil {
+		t.Fatalf("with the agent account cleared, the name is free: %v", err)
+	}
+	if err := inv.SetAccount(ctx, "anchor", "operator", ""); err != nil {
+		t.Fatal(err)
+	}
+	if n, _ = inv.NodeByName(ctx, "anchor"); n.AgentAccount != "" || n.AgentAccountHome != "" {
+		t.Fatalf("clearing left %q %q", n.AgentAccount, n.AgentAccountHome)
+	}
+	if err := inv.SetAgentAccount(ctx, "nowhere", "agent", ""); !errors.Is(err, ErrNoSuchNode) {
+		t.Fatalf("an unknown node: %v", err)
+	}
+}

internal/inventory/busrecords.go

@@ -34,12 +34,9 @@ func (i *Inventory) BusRecords(ctx context.Context) (broker.Records, error) {
 	// that seat promises. **Across the whole catalogue, not one manifest**: a seat is declared by
 	// one module and held by another, which is the whole reason a seat exists (ADR 0118).
 	seats := map[string]catalogue.SeatDeclaration{}
-	// And who declared each, so a seat's records are named as the declaring module's buckets (ADR 0259).
-	declarers := map[string]string{}
 	for _, m := range declared {
 		for _, s := range m.DefinesSeats {
 			seats[s.Name] = s
-			declarers[s.Name] = m.Module
 		}
 	}
 	// And the mesh's own, which carry protocol too (novox/hq ADR 0121). Added after the modules'
@@ -81,7 +78,7 @@ func (i *Inventory) BusRecords(ctx context.Context) (broker.Records, error) {
 					"%s is assigned to %s and is not in the catalogue, so what it may say cannot "+
 						"be derived", module, n.Name)
 			}
-			d := declaredFor(m, seats, declarers)
+			d := declaredFor(m, seats)
 			// And the state offered to it as a seat's holder by the modules beside it (novox/hq ADR 0255).
 			// For this machine's key alone (novox/hq ADR 0260): a bar shows its own machine's draw.
 			for _, sr := range catalogue.ReadsGranted(m, onMachine(declared, modules), n.Name) {
@@ -124,7 +121,7 @@ func onMachine(declared map[string]catalogue.Manifest, modules []string) []catal
 
 // declaredFor is one module's manifest as the composer needs it: what it says about itself, and the
 // protocol of every seat it holds or uses.
-func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaration, declarers map[string]string) broker.Declared {
+func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaration) broker.Declared {
 	// A consumed name is a module's event unless it names a seat, and only somebody holding the seat
 	// set can tell (novox/hq ADR 0121). Split here, because the composer cannot look at a name and
 	// know — and a role's event read as a module's is a subscription to a namespace nobody owns.
@@ -135,16 +132,6 @@ func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaratio
 		if named {
 			// A seat's event when the seat says it; else the event of the module of that name — a seat and
 			// the module holding it may share a name (mesh-delivery, novox/hq ADR 0239).
-			if s, isASeat := seats[emitter]; isASeat && s.Kinded {
-				// A kinded bench's event is named `<event>` or `<event>.*` and heard from every kind; its
-				// proofs are answered by whoever watches it (ADR 0259 §3).
-				ev := strings.TrimSuffix(event, ".*")
-				if catalogue.SeatSays(s.Emits, ev) {
-					watches = append(watches, broker.Seat{Name: s.Name, Scope: s.Scope, Emits: []string{ev},
-						Kinded: true, Proofs: s.Proofs, DeclaredBy: declarers[s.Name]})
-					continue
-				}
-			}
 			if s, isASeat := seats[emitter]; isASeat && catalogue.SeatSays(s.Emits, event) {
 				watches = append(watches, broker.Seat{Name: s.Name, Emits: []string{event}})
 				continue
@@ -168,8 +155,6 @@ func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaratio
 		Reads: m.Reads,
 		// And the tools its health asks (novox/hq ADR 0240): the machine's node-engine is granted them.
 		Checks: catalogue.HealthChecks(m),
-		// And whether it runs as an account of its own (novox/hq ADR 0259 §8).
-		RunsAs: m.RunsAs,
 	}
 	// Whether it can be given an account at all: delivered as its own secret named broker, so one
 	// that declares none has nowhere to read it (novox/hq issue 195).
@@ -183,15 +168,12 @@ func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaratio
 		// Every seat with a protocol, the mesh's own included. One that says only who does a job is
 		// not here and grants nothing, which is most of them.
 		if s, hasAProtocol := seats[c.Name]; hasAProtocol {
-			held := asSeat(s, declarers[s.Name])
+			d.Holds = append(d.Holds, asSeat(s))
-			held.Kind = c.Kind
-			held.Capabilities = c.Capabilities
-			d.Holds = append(d.Holds, held)
 		}
 	}
 	for _, name := range m.Uses {
 		if s, declaredSomewhere := seats[name]; declaredSomewhere {
-			d.Uses = append(d.Uses, asSeat(s, declarers[s.Name]))
+			d.Uses = append(d.Uses, asSeat(s))
 		}
 	}
 	return d
@@ -222,17 +204,9 @@ func (i *Inventory) DeclaredBuckets(ctx context.Context) ([]broker.Bucket, error
 	return out, nil
 }
 
-func asSeat(s catalogue.SeatDeclaration, declarer string) broker.Seat {
+func asSeat(s catalogue.SeatDeclaration) broker.Seat {
-	seat := broker.Seat{Name: s.Name, Scope: s.Scope, Accepts: s.Accepts, Emits: s.Emits,
+	return broker.Seat{Name: s.Name, Scope: s.Scope, Accepts: s.Accepts, Emits: s.Emits,
-		Serves: catalogue.VerbNames(s.Serves), Kinded: s.Kinded, ByCaller: s.ByCaller, Proofs: s.Proofs,
+		Serves: catalogue.VerbNames(s.Serves)}
-		DeclaredBy: declarer}
-	// A seat's records are its declaring module's buckets, named as the bus holds them (ADR 0259 §3).
-	for _, r := range s.Records {
-		if declarer != "" {
-			seat.Records = append(seat.Records, broker.BucketName(declarer, r))
-		}
-	}
-	return seat
 }
 
 // MeshSeats are the mesh's own seats that carry a protocol, as the bus needs them: what to make a work
@@ -303,22 +277,3 @@ func heldHere(claimed []broker.Seat, holdings []catalogue.Held, node, module str
 	}
 	return out
 }
-
-// DeclaredTrafficSeats is every seat any registered module declares that names its caller or its kind
-// (novox/hq ADR 0259 §3), as the bus needs it: assigned or not, so its work queue exists from registration.
-func (i *Inventory) DeclaredTrafficSeats(ctx context.Context) ([]broker.Seat, error) {
-	declared, err := i.Catalogue(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("cannot read the catalogue: %w", err)
-	}
-	var out []broker.Seat
-	for _, m := range declared {
-		for _, s := range m.DefinesSeats {
-			seat := asSeat(s, m.Module)
-			if seat.Kinded || len(seat.ByCaller) > 0 {
-				out = append(out, seat)
-			}
-		}
-	}
-	return out, nil
-}

internal/inventory/catalogue.go

@@ -169,6 +169,27 @@ func (i *Inventory) RegisterModule(ctx context.Context, m catalogue.Manifest, fr
 	return nil
 }
 
+// SourceIdentity is the forge's id of the repository a module is registered from, 0 when none is recorded.
+func (i *Inventory) SourceIdentity(ctx context.Context, module string) (int64, error) {
+	var id *int64
+	err := i.store.Pool().QueryRow(ctx, `select source_repo_id from module where name = $1`, module).Scan(&id)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return 0, fmt.Errorf("%w: %s", ErrNoSuchModule, module)
+	}
+	if err != nil || id == nil {
+		return 0, err
+	}
+	return *id, nil
+}
+
+// SetSourceIdentity records the forge's id of the repository a module is registered from. 0 — the forge could not
+// say, at the terminal — keeps the id already recorded: an unknown is never a reason to forget what was known.
+func (i *Inventory) SetSourceIdentity(ctx context.Context, module string, id int64) error {
+	_, err := i.store.Pool().Exec(ctx,
+		`update module set source_repo_id = coalesce(nullif($2::bigint, 0), source_repo_id) where name = $1`, module, id)
+	return err
+}
+
 // hasModule is whether the catalogue holds a module of that name.
 func (i *Inventory) hasModule(ctx context.Context, name string) (bool, error) {
 	var one int

internal/inventory/gate.go

@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/jackc/pgx/v5"
@@ -169,6 +170,12 @@ func (i *Inventory) PreviousBuild(ctx context.Context, module, commit string, fa
 		if b.ID == failed.ID || (commit != "" && b.Commit != commit) {
 			continue
 		}
+		// Only a build of the repository the failed build was made from — the module's, since its take-in
+		// registered it (novox/hq ADR 0266): a build of the module's name from another repository is recorded
+		// and was never registered, and putting it back would register it now.
+		if failed.Repository != "" && !sameRepositoryAs(b.Repository, failed.Repository) {
+			continue
+		}
 		if !failed.AskedOrAt().IsZero() && !b.AskedOrAt().Before(failed.AskedOrAt()) {
 			continue
 		}
@@ -190,6 +197,14 @@ func (i *Inventory) PreviousBuild(ctx context.Context, module, commit string, fa
 	return Build{}, false, nil
 }
 
+// sameRepositoryAs says two recorded repositories are one, however their case or `.git` is spelled.
+func sameRepositoryAs(a, b string) bool {
+	trim := func(s string) string {
+		return strings.TrimSuffix(strings.TrimRight(strings.ToLower(strings.TrimSpace(s)), "/"), ".git")
+	}
+	return trim(a) == trim(b)
+}
+
 // RestoreModule puts a module's registered build back to an earlier one: its manifest, the commit it
 // was built from, and when it was asked — as now, so the build that failed its gate, asked before, can
 // never register over it again (issue 219's order). The source's head is left where the merge moved it:

internal/inventory/health.go

@@ -31,6 +31,9 @@ type ResourceHealth struct {
 	// Account is the account whose own service manager runs it, or the account a resource of kind account
 	// is (novox/hq ADR 0254).
 	Account string `json:"account,omitempty"`
+	// Root is "never" on an account verdict that judged whether the account can become root without a
+	// person (novox/hq ADR 0266).
+	Root string `json:"root,omitempty"`
 }
 
 // NodeHealth is a machine's newest statement, as kept.

internal/inventory/migrations/0083-a-node-names-the-account-its-agents-run-as.sql

@@ -0,0 +1,13 @@
+-- A node names the account its agents run as (novox/hq ADR 0266).
+--
+-- On the control node every agent session ran as the operator's account, which may become root without
+-- a password: any agent there could become root without a person. The decision is an account of the
+-- agents' own, without sudo, beside the operator's, who keeps theirs. Stated by the operator at the
+-- controller's terminal, like the operator account (migration 0036), and never by a verb or a setting,
+-- so no agent can change which account it is.
+--
+-- Empty rather than null, as the operator account is: empty is a real state, "agents run as the
+-- operator's account here" — a workstation's today. The home is stored only when it is not
+-- /home/<account>; empty means derive it.
+alter table node add column agent_account text not null default '';
+alter table node add column agent_account_home text not null default '';

internal/inventory/migrations/0084-a-build-asked-at-the-terminal-says-so.sql

@@ -0,0 +1,18 @@
+-- A build asked at the controller's terminal says so (novox/hq ADR 0266).
+--
+-- A build's outcome registers its module, and a module is what the next push sends: a module named `sudo`
+-- built from a repository an agent made would grant whoever wrote it root on every node it is assigned.
+-- So an outcome may register a module only from the repository the catalogue already builds it from — or,
+-- for a module new to the catalogue, from a repository the catalogue already builds another module from.
+-- Anything else — a module moved to another repository, a new module from a new repository — is the
+-- operator's, at the controller's terminal. This column is how the take-in tells: true only for a build
+-- request kept by a `build` or `replay --register` run at the terminal, never through a verb (whoever may
+-- call a verb includes agents). False for every request kept before this column existed.
+alter table build_request add column at_terminal boolean not null default false;
+
+-- And which repository a module is registered from, by the forge's own id for it (novox/hq ADR 0266): a name
+-- is not an identity. A repository deleted and made again under the same name is another repository, with
+-- none of the protection the first had until someone sets it; its outcome must not register as the module's.
+-- Recorded when a build of it is registered from the mesh's own forge; null until then, and for a source the
+-- forge does not hold.
+alter table module add column source_repo_id bigint;

internal/inventory/migrations/0085-the-controller-keeps-when-a-root-search-began-pending.sql

@@ -0,0 +1,9 @@
+-- The controller keeps when it first saw an agent account's root verdict waiting for the node-engine's search
+-- for setuid programs (novox/hq ADR 0266), cleared by the next complete verdict.
+--
+-- The self-check does not raise `agent-can-become-root` while that search is within its bound, so a restart is
+-- not an urgent condition each time. The node-engine's own "since" starts again at every restart: an agent
+-- that restarted the engine in a loop kept the condition quiet for ever. This time is the controller's, kept
+-- across the engine's restarts and its own, so the quiet ends once the bound has passed since the search first
+-- read as pending, however often the engine started again.
+alter table node add column agent_root_pending_since timestamptz;

internal/inventory/nodes.go

@@ -9,6 +9,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"regexp"
 	"sort"
 	"strings"
 	"time"
@@ -69,6 +70,14 @@ type Node struct {
 	Account     string
 	AccountHome string
 
+	// AgentAccount is the login agents run as on this machine when it is not the operator's — `agent`
+	// on the control node (novox/hq ADR 0266): an account of their own, without sudo, so no agent there
+	// can become root without a person. Empty means agents run as the operator account. Stated at the
+	// controller's terminal only, never by a verb or a setting. AgentAccountHome is its home when not
+	// /home/<account>; empty means derive it.
+	AgentAccount     string
+	AgentAccountHome string
+
 	// HostVersion is the version of the host this machine reported running (novox/hq 04-ISSUES/087).
 	// Empty when it has not said since the mesh began keeping it — which is not the same as running
 	// no host, so nothing derives "behind" from an empty one.
@@ -91,6 +100,17 @@ func (n Node) Home() string {
 	}
 }
 
+// AgentHome is the agent account's home, derived when not stored; empty when no agent account is named.
+func (n Node) AgentHome() string {
+	if n.AgentAccount == "" {
+		return ""
+	}
+	if n.AgentAccountHome != "" {
+		return n.AgentAccountHome
+	}
+	return "/home/" + n.AgentAccount
+}
+
 // Silent is how long since this node was last heard from, and whether it ever was.
 func (n Node) Silent() (time.Duration, bool) {
 	if n.LastSeen.IsZero() {
@@ -147,14 +167,14 @@ func (i *Inventory) AddNodeAs(ctx context.Context, name string, adopted bool) (N
 // nodeColumns and scanNode are the one reading of a node row, so every way of finding a node
 // says whether it is adopted.
 const nodeColumns = `id, name, created, last_seen, adopted, adopted_since, account, account_home,
-	host_version`
+	agent_account, agent_account_home, host_version`
 
 func scanNode(row pgx.Row) (Node, error) {
 	var n Node
 	var seen, since *time.Time
 	var host *string
 	if err := row.Scan(&n.ID, &n.Name, &n.Created, &seen, &n.Adopted, &since,
-		&n.Account, &n.AccountHome, &host); err != nil {
+		&n.Account, &n.AccountHome, &n.AgentAccount, &n.AgentAccountHome, &host); err != nil {
 		return Node{}, err
 	}
 	if host != nil {
@@ -172,7 +192,23 @@ func scanNode(row pgx.Row) (Node, error) {
 // SetAccount records the operator account on a node — its human login — and optionally where that
 // account's home is (novox/hq to-be 29). An empty home means the mesh derives it. Clearing the
 // account (empty name) is allowed: a machine may stop having a known operator.
+//
+// **Never the node's agent account** (novox/hq ADR 0266): the operator account may become root, and the
+// agent account exists so agents cannot; naming the one as the other gives agents root. Refused here as
+// SetAgentAccount refuses the other direction.
 func (i *Inventory) SetAccount(ctx context.Context, node, account, home string) error {
+	account = strings.TrimSpace(account)
+	if account != "" {
+		n, err := i.NodeByName(ctx, node)
+		if err != nil {
+			return err
+		}
+		if n.AgentAccount != "" && n.AgentAccount == account {
+			return fmt.Errorf("%s is %s's agent account: the operator account may become root, and agents run as "+
+				"%s so that they cannot (novox/hq ADR 0266); clear the agent account first "+
+				"(node agent-account %s --clear) if the operator is to log in as it", account, node, account, node)
+		}
+	}
 	tag, err := i.store.Pool().Exec(ctx,
 		`update node set account = $1, account_home = $2 where name = $3`, account, home, node)
 	if err != nil {
@@ -184,6 +220,86 @@ func (i *Inventory) SetAccount(ctx context.Context, node, account, home string)
 	return nil
 }
 
+// loginName is what a login may be called: what useradd accepts by default, lower case, a letter or
+// an underscore first.
+var loginName = regexp.MustCompile(`^[a-z_][a-z0-9_-]{0,31}$`)
+
+// SetAgentAccount records the account agents run as on a node, and optionally its home (novox/hq ADR
+// 0266). An empty account clears it: agents run as the operator account again.
+//
+// **Refused, rather than recorded and judged later:** root, which is the very thing the account exists
+// to keep agents from; the node's operator account, which may become root without a password and is
+// what agents ran as before — naming it here would say the agents have an account of their own while
+// they do not; and a name no machine would accept as a login.
+func (i *Inventory) SetAgentAccount(ctx context.Context, node, account, home string) error {
+	account, home = strings.TrimSpace(account), strings.TrimSpace(home)
+	if account == "" && home != "" {
+		return errors.New("a home without an agent account says nothing; name the account too")
+	}
+	if account != "" {
+		if err := AgentAccountRefusal(account, home); err != nil {
+			return err
+		}
+		n, err := i.NodeByName(ctx, node)
+		if err != nil {
+			return err
+		}
+		if n.Account != "" && n.Account == account {
+			return fmt.Errorf("%s is %s's operator account: agents would run as the operator, who may become "+
+				"root; clear the agent account instead (node agent-account %s --clear)", account, node, node)
+		}
+	}
+	tag, err := i.store.Pool().Exec(ctx,
+		`update node set agent_account = $1, agent_account_home = $2 where name = $3`, account, home, node)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return fmt.Errorf("%w: %s", ErrNoSuchNode, node)
+	}
+	return nil
+}
+
+// serviceAccounts are the system and service accounts a machine of the mesh has, or a module of the
+// catalogue declares (showcase, and the accounts ADR 0259 gives the router and the channels). The controller
+// cannot read a machine's user database, so this list is the controller's half; the node-engine's half is
+// refusing to take an existing account below the first login uid as one that must never become root.
+var serviceAccounts = map[string]bool{
+	"root": true, "bin": true, "daemon": true, "sys": true, "adm": true, "nobody": true, "mail": true,
+	"ftp": true, "http": true, "www-data": true, "git": true, "sshd": true, "dbus": true, "polkitd": true,
+	"postgres": true, "docker": true, "nats": true, "redis": true, "uuidd": true, "dnsmasq": true,
+	"avahi": true, "rtkit": true, "colord": true, "geoclue": true, "tss": true, "alpm": true, "usbmux": true,
+	"showcase": true, "messenger": true, "telegram": true,
+}
+
+// serviceAccount says whether a name is a system or service account: one of the list, or a name of
+// systemd's own (systemd-…).
+func serviceAccount(name string) bool {
+	return serviceAccounts[name] || strings.HasPrefix(name, "systemd-")
+}
+
+// AgentAccountRefusal is why an agent account cannot be named, or nil: root, a malformed login, or a
+// home that is not an absolute path.
+func AgentAccountRefusal(account, home string) error {
+	if account == "root" {
+		return errors.New("agents may not run as root: the agent account exists to keep them from it " +
+			"(novox/hq ADR 0266)")
+	}
+	if !loginName.MatchString(account) {
+		return fmt.Errorf("%q is not a login name: lower case letters, digits, _ and -, a letter or _ first, "+
+			"at most 32", account)
+	}
+	if serviceAccount(account) {
+		return fmt.Errorf("%q is a system or service account a machine or a module already has: the agent "+
+			"account is one the mesh creates for agents alone, which nothing else runs as or owns files as "+
+			"(novox/hq ADR 0266); name a new one, such as agent", account)
+	}
+	if home != "" && !strings.HasPrefix(home, "/") {
+		return fmt.Errorf("the agent account's home %q is not an absolute path", home)
+	}
+	return nil
+}
+
 // Nodes are every node record, oldest first.
 func (i *Inventory) Nodes(ctx context.Context) ([]Node, error) {
 	rows, err := i.store.Pool().Query(ctx,
@@ -1176,3 +1292,24 @@ func (i *Inventory) Sequence(ctx context.Context, id string) (int64, error) {
 	}
 	return *n, nil
 }
+
+// RootSearchPending keeps when the controller first saw this node's agent account waiting for the node-engine's
+// setuid search (novox/hq ADR 0266) and answers it: the first time it is seen since the last complete verdict,
+// at, kept; seen again, what was kept. Kept across the engine's restarts and the controller's own.
+func (i *Inventory) RootSearchPending(ctx context.Context, node string, at time.Time) (time.Time, error) {
+	var since time.Time
+	err := i.store.Pool().QueryRow(ctx,
+		`update node set agent_root_pending_since = coalesce(agent_root_pending_since, $2)
+		  where name = $1 returning agent_root_pending_since`, node, at).Scan(&since)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return time.Time{}, fmt.Errorf("%w: %s", ErrNoSuchNode, node)
+	}
+	return since, err
+}
+
+// RootSearchJudged forgets when a search began pending: a complete verdict came.
+func (i *Inventory) RootSearchJudged(ctx context.Context, node string) error {
+	_, err := i.store.Pool().Exec(ctx,
+		`update node set agent_root_pending_since = null where name = $1 and agent_root_pending_since is not null`, node)
+	return err
+}

internal/inventory/pending.go

@@ -38,6 +38,9 @@ type BuildRequest struct {
 	// unknown. Read as in flight until its outcome or its bound.
 	OutcomeUnknown string
 	At             time.Time
+	// AtTerminal says the request was asked at the controller's terminal, never through a verb (novox/hq ADR
+	// 0266): what lets its outcome register a module from a repository the catalogue does not build it from.
+	AtTerminal bool
 }
 
 // Name is the module this request is expected to register, read from its directory: the last element of
@@ -73,16 +76,31 @@ func (i *Inventory) RecordBuildRequest(ctx context.Context, a BuildRequest) erro
 		notAsked = &a.NotAsked
 	}
 	if _, err := i.store.Pool().Exec(ctx,
-		`insert into build_request (id, repository, seat, source_path, ref, commit_hash, asked_for, not_asked, asked_at)
+		`insert into build_request (id, repository, seat, source_path, ref, commit_hash, asked_for, not_asked, asked_at,
-		 values ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+		                            at_terminal)
+		 values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
 		 on conflict (id) do nothing`,
-		a.ID, a.Repository, a.Seat, strings.Trim(a.Path, "/"), a.Ref, a.Commit, a.For, notAsked, at); err != nil {
+		a.ID, a.Repository, a.Seat, strings.Trim(a.Path, "/"), a.Ref, a.Commit, a.For, notAsked, at,
+		a.AtTerminal); err != nil {
 		return err
 	}
 	_, err := i.store.Pool().Exec(ctx, `delete from build_request where asked_at < $1`, time.Now().Add(-KeptFor))
 	return err
 }
 
+// BuildRequestByID is the build request kept under this id, and whether one was kept.
+func (i *Inventory) BuildRequestByID(ctx context.Context, id string) (BuildRequest, bool, error) {
+	var a BuildRequest
+	err := i.store.Pool().QueryRow(ctx,
+		`select id, repository, seat, source_path, ref, commit_hash, asked_for, at_terminal, asked_at
+		   from build_request where id = $1`, id).Scan(&a.ID, &a.Repository, &a.Seat, &a.Path, &a.Ref, &a.Commit,
+		&a.For, &a.AtTerminal, &a.At)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return BuildRequest{}, false, nil
+	}
+	return a, err == nil, err
+}
+
 // MarkNotAsked says a kept build request was never handed over: the words are kept, unless its outcome was
 // heard first.
 func (i *Inventory) MarkNotAsked(ctx context.Context, id, why string) error {

internal/link/calls.go

@@ -324,6 +324,15 @@ func (l *CallLog) finish(c *Call, answer []byte, failed, answeredAlready bool) {
 		return
 	}
 	onTheBus := *c
+	if c.Seat == CLISeat {
+		// **A mesh-cli line's answer is its asker's alone** (ADR 0272): what a command at the controller's terminal
+		// printed — a token, a secret's reference — and `calls` answers anyone who may call the seat. Kept in this
+		// process's memory for the asker to follow, and never on the bus.
+		onTheBus.Answer, _ = json.Marshal(map[string]any{"not kept": "a mesh-cli line's answer, its asker's alone: " +
+			"kept in the memory of the controller that ran it, for the asker to follow"})
+		l.keep(onTheBus)
+		return
+	}
 	if len(onTheBus.Answer) > keptOnTheBusAtMost {
 		// A record on the bus is one message too, and one larger than the bus carries is refused whole —
 		// the call's state with it (novox/hq issue 314). The answer stays in this process's memory, and
@@ -391,6 +400,29 @@ func (l *CallLog) Recent() ([]Call, error) {
 	return out, nil
 }
 
+// inMemory is one call this process served and still holds, whole.
+func (l *CallLog) inMemory(id string) (Call, bool) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	for _, c := range l.calls {
+		if c.ID == id {
+			return *c, true
+		}
+	}
+	return Call{}, false
+}
+
+// Shown is one kept call as `calls` shows it: whole, but for a mesh-cli line's answer, which is its asker's alone
+// and followed by it (ADR 0272) — `calls` answers anyone who may call the seat.
+func (l *CallLog) Shown(id string) (Call, bool, error) {
+	c, found, err := l.Get(id)
+	if found && c.Seat == CLISeat {
+		c.Answer, _ = json.Marshal(map[string]any{"not shown": "a mesh-cli line's answer is its asker's alone: " +
+			"mesh-cli follows it"})
+	}
+	return c, found, err
+}
+
 // Get is one kept call: from memory, or from the bus when this process did not serve it.
 func (l *CallLog) Get(id string) (Call, bool, error) {
 	l.mu.Lock()
@@ -431,6 +463,11 @@ func kept(args json.RawMessage) json.RawMessage {
 		switch {
 		case k == "values" || k == "secret":
 			out[k] = "(given, not kept)"
+		case k == "line":
+			// A mesh-cli line (ADR 0272): its command word, never the rest, which may carry settings.
+			if words, ok := v.([]any); ok && len(words) > 0 {
+				out[k] = []any{words[0], "(the rest given, not kept)"}
+			}
 		case isString && len(s) <= 120:
 			out[k] = s
 		case isString:
@@ -513,6 +550,19 @@ var watched struct {
 	conns map[*nats.Conn]bool
 }
 
+type callIDKey struct{}
+
+// WithCallID is ctx carrying the call it serves; CallIDIn reads it back, empty outside one.
+func WithCallID(ctx context.Context, id string) context.Context {
+	return context.WithValue(ctx, callIDKey{}, id)
+}
+
+// CallIDIn is the call ctx serves, or empty.
+func CallIDIn(ctx context.Context) string {
+	id, _ := ctx.Value(callIDKey{}).(string)
+	return id
+}
+
 // answerNow is how a handler asks for its caller to be answered before it goes on (Acknowledge).
 type answerNowKey struct{}
 
@@ -565,6 +615,8 @@ func (l *CallLog) serveCallWithin(seat, verb string, args json.RawMessage, reply
 	c := l.begin(seat, verb, kept(args), reply)
 	// Who asked travels with the call, so an act it does by hand says so (novox/hq to-be 45 §7).
 	ctx = context.WithValue(ctx, callerKey{}, c.Caller)
+	// And which call it is, for what the handler says of it in the journal.
+	ctx = WithCallID(ctx, c.ID)
 	acknowledged := make(chan struct{})
 	var once sync.Once
 	ctx = context.WithValue(ctx, answerNowKey{}, func() { once.Do(func() { close(acknowledged) }) })

internal/link/meshcli.go

@@ -0,0 +1,220 @@
+package link
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"strings"
+
+	"github.com/nats-io/nats.go"
+)
+
+// mesh-cli asks the controller through the node-engine of the machine it runs on (novox/hq ADR 0272 §3). The engine
+// reads the asking account from the kernel and asks on its own node's subject, which only that node's engine may
+// publish (its grant is `mesh.control.<node>.>`): so the node is a fact the bus server enforces, and the account a
+// fact the kernel gave. The engine's side holds the same field names (mesh-host internal/meshcli, a test on each
+// side), as for its health statement.
+
+// CLISubjects is every node's mesh-cli subject, which the serving controller answers.
+const CLISubjects = "mesh.control.*.cli"
+
+// CLISubject is one node's.
+func CLISubject(node string) string { return "mesh.control." + node + ".cli" }
+
+// CLISeat is what a mesh-cli line is recorded under in the calls record, beside the seats' verbs: its verb there is
+// the node it was asked on.
+const CLISeat = "mesh-cli"
+
+// CLIAtOnce bounds the mesh-cli lines running at once, from every node together. A person types one at a time; one
+// over the bound is answered busy at once, and nothing runs.
+var CLIAtOnce = 8
+
+// CLIAsked is a line mesh-cli was given on a node, and the account the node-engine says is asking — or, with
+// Follow, the call a line runs as, asked again by the same account on the same node until it ends.
+type CLIAsked struct {
+	Line    []string `json:"line,omitempty"`
+	Account string   `json:"account"`
+	UID     uint32   `json:"uid"`
+	Follow  string   `json:"follow,omitempty"`
+	// Session is the login session the asking process runs in, as the node-engine read it from the kernel's cgroup
+	// (`session-<id>.scope` under the account's own slice), or empty: a service, a user unit. Only a login session is
+	// the terminal (novox/hq ADR 0272).
+	Session string `json:"session,omitempty"`
+}
+
+// CLIAnswer is what the controller answers, as the `result` of a call's answer: what the command printed, how it
+// exited, whether it ran as the controller's terminal and why, or why nothing ran. A line still running is answered
+// as every call is (`running`, `call`), and followed.
+type CLIAnswer struct {
+	Stdout   []byte `json:"stdout,omitempty"`
+	Stderr   []byte `json:"stderr,omitempty"`
+	Exit     int    `json:"exit"`
+	Terminal bool   `json:"terminal"`
+	Why      string `json:"why,omitempty"`
+	Refused  string `json:"refused,omitempty"`
+	Cut      bool   `json:"cut,omitempty"`
+}
+
+// CLIRefusal is an answer saying nothing ran, and why.
+func CLIRefusal(why string) CLIAnswer { return CLIAnswer{Exit: 1, Refused: why} }
+
+// CLINode is the node a mesh-cli subject names, or false for any other subject.
+func CLINode(subject string) (string, bool) {
+	rest, ok := strings.CutPrefix(subject, "mesh.control.")
+	if !ok {
+		return "", false
+	}
+	node, tail, ok := strings.Cut(rest, ".")
+	if !ok || tail != "cli" || node == "" {
+		return "", false
+	}
+	return node, true
+}
+
+// CLIHandler answers one line from one node.
+type CLIHandler func(ctx context.Context, node string, asked CLIAsked) CLIAnswer
+
+// ServeCLI answers mesh-cli for every node until stopped: one queue group, so of two controllers during a handover
+// one answers.
+//
+// **Every line is a call** (review of ADR 0272): run, recorded and answered as a seat's verb is (calls.go) — its
+// caller answered within AnswerWithin that it is still running, with its call, and the line's answer kept for
+// the asker to follow. The bus permits an answer for a minute only (broker.ResponseTTL); a line answered when it
+// ends lost every answer after that, and mesh-cli said nothing ran of a line that had.
+func (b OverNATS) ServeCLI(handle CLIHandler, logger *log.Logger) (func(), error) {
+	return b.serveCLI(Calls, CLIAtOnce, handle, logger)
+}
+
+func (b OverNATS) serveCLI(calls *CallLog, atOnce int, handle CLIHandler, logger *log.Logger) (func(), error) {
+	done := make(chan struct{})
+	slots := make(chan struct{}, atOnce)
+	bind := func() (*nats.Subscription, error) {
+		return b.Conn.QueueSubscribe(CLISubjects, "mesh-cli", func(msg *nats.Msg) {
+			go b.answerCLI(msg, calls, slots, handle, logger)
+		})
+	}
+	sub, err := bind()
+	if err != nil {
+		return nil, fmt.Errorf("serving %s: %w", CLISubjects, err)
+	}
+	go keepBound(sub, bind, CLISubjects, done, logger)
+	return func() {
+		close(done)
+		_ = sub.Unsubscribe()
+	}, nil
+}
+
+// cliEnvelope is an answer as every call's is: its result.
+func cliEnvelope(a CLIAnswer) []byte {
+	body, _ := json.Marshal(map[string]any{"result": a})
+	return body
+}
+
+func (b OverNATS) answerCLI(msg *nats.Msg, calls *CallLog, slots chan struct{}, handle CLIHandler, logger *log.Logger) {
+	if msg.Reply == "" {
+		return
+	}
+	respond := func(body []byte) {
+		if err := msg.Respond(body); err != nil && logger != nil {
+			logger.Printf("mesh-cli on %s: the answer could not be sent: %v", msg.Subject, err)
+		}
+	}
+	node, ok := CLINode(msg.Subject)
+	var asked CLIAsked
+	switch {
+	case !ok:
+		respond(cliEnvelope(CLIRefusal("not a mesh-cli subject: " + msg.Subject)))
+		return
+	case json.Unmarshal(msg.Data, &asked) != nil:
+		respond(cliEnvelope(CLIRefusal("the node-engine's request could not be read, so nothing ran")))
+		return
+	case asked.Follow != "":
+		respond(calls.followCLI(asked.Follow, node, asked.Account))
+		return
+	case len(asked.Line) == 0:
+		respond(cliEnvelope(CLIRefusal("the request names no command, so nothing ran")))
+		return
+	}
+	select {
+	case slots <- struct{}{}:
+		defer func() { <-slots }()
+	default:
+		respond(cliEnvelope(CLIRefusal(fmt.Sprintf("busy: %d lines from mesh-cli are running already; ask again "+
+			"when one has ended. Nothing ran", cap(slots)))))
+		return
+	}
+	limit := b.Conn.MaxPayload()
+	calls.serveCallWithin(CLISeat, node, msg.Data, msg.Reply, func(ctx context.Context, _ json.RawMessage) (any, error) {
+		return fitCLI(handle(ctx, node, asked), limit-4096), nil
+	}, msg.Respond, limit, logger)
+}
+
+// followCLI answers the asker of a line what came of it: running still, its answer, or why that is not known. Only
+// the account that asked it, on the node it was asked on: the answer is what the command printed, and `calls`
+// keeps it from everyone else.
+func (l *CallLog) followCLI(id, node, account string) []byte {
+	noSuch := func() []byte {
+		body, _ := json.Marshal(map[string]any{"error": fmt.Sprintf("no mesh-cli call %s was asked by %s on %s", id,
+			account, node)})
+		return body
+	}
+	c, inMemory := l.inMemory(id)
+	if !inMemory {
+		kept, found, err := l.Get(id)
+		if err != nil || !found {
+			return noSuch()
+		}
+		c = kept
+	}
+	var args CLIAsked
+	_ = json.Unmarshal(c.Args, &args)
+	if c.Seat != CLISeat || c.Verb != node || args.Account != account {
+		return noSuch()
+	}
+	switch {
+	case c.State == CallRunning:
+		return running(&c, AnswerWithin, false, l.Follow)
+	case c.State == CallAbandoned:
+		body, _ := json.Marshal(map[string]any{"error": fmt.Sprintf("call %s was running under a controller that "+
+			"stopped before it finished: it may have done part of what it was asked, and nothing will finish it", id)})
+		return body
+	case !inMemory:
+		body, _ := json.Marshal(map[string]any{"error": fmt.Sprintf("call %s finished (%s), and its answer was kept "+
+			"only in the memory of the controller that ran it, which has stopped; whether it took effect, the "+
+			"mesh says (status, the hand-act log)", id, c.State)})
+		return body
+	}
+	return c.Answer
+}
+
+// fitCLI is an answer whose streams fit in limit bytes once written: what the command printed is cut, standard
+// output first, and the cut is said (ADR 0272 §5) — never silently short.
+func fitCLI(a CLIAnswer, limit int64) CLIAnswer {
+	body, _ := json.Marshal(a)
+	if limit <= 0 || int64(len(body)) <= limit {
+		return a
+	}
+	a.Cut = true
+	// Room for the rest of the answer and JSON's base64 of the streams (4 bytes for every 3).
+	room := (limit - 4096) * 3 / 4
+	if room < 0 {
+		room = 0
+	}
+	if int64(len(a.Stderr)) > room/2 {
+		a.Stderr = a.Stderr[:room/2]
+	}
+	if left := room - int64(len(a.Stderr)); int64(len(a.Stdout)) > left {
+		if left < 0 {
+			left = 0
+		}
+		a.Stdout = a.Stdout[:left]
+	}
+	return a
+}
+
+// FitCLIAnswer is the answer as one bus message of at most limit bytes, written.
+func FitCLIAnswer(a CLIAnswer, limit int64) []byte {
+	body, _ := json.Marshal(fitCLI(a, limit))
+	return body
+}

internal/link/meshcli_test.go

@@ -0,0 +1,269 @@
+package link
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"sort"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/testbus"
+)
+
+// The node-engine's request and the answer it hands mesh-cli hold these field names; the engine's side holds the
+// same list (mesh-host internal/meshcli, TestTheRequestToTheControllerKeepsItsFieldNames).
+func TestTheMeshCLIRequestAndAnswerKeepTheirFieldNames(t *testing.T) {
+	body, _ := json.Marshal(CLIAsked{Line: []string{"status"}, Account: "a", UID: 1, Session: "session-3.scope"})
+	if got := keysIn(t, body); got != "account line session uid" {
+		t.Fatalf("the request's fields are %q", got)
+	}
+	body, _ = json.Marshal(CLIAsked{Line: []string{"status"}, Account: "a", UID: 1})
+	if got := keysIn(t, body); got != "account line uid" {
+		t.Fatalf("the request's fields are %q", got)
+	}
+	body, _ = json.Marshal(CLIAnswer{Stdout: []byte("o"), Stderr: []byte("e"), Exit: 1, Terminal: true, Why: "w",
+		Refused: "r", Cut: true})
+	if got := keysIn(t, body); got != "cut exit refused stderr stdout terminal why" {
+		t.Fatalf("the answer's fields are %q", got)
+	}
+	body, _ = json.Marshal(CLIAsked{Follow: "call-1", Account: "a", UID: 1})
+	if got := keysIn(t, body); got != "account follow uid" {
+		t.Fatalf("a follow's fields are %q", got)
+	}
+	// What a line still running answers, in the envelope every call's answer is in: `result`, then these.
+	var env struct {
+		Result json.RawMessage `json:"result"`
+	}
+	_ = json.Unmarshal(running(&Call{ID: "call-1", Seat: CLISeat, Verb: "a"}, AnswerWithin, false, ""), &env)
+	if got := keysIn(t, env.Result); got != "call output running started" {
+		t.Fatalf("a running answer's fields are %q", got)
+	}
+}
+
+func keysIn(t *testing.T, body []byte) string {
+	t.Helper()
+	var m map[string]any
+	if err := json.Unmarshal(body, &m); err != nil {
+		t.Fatal(err)
+	}
+	var keys []string
+	for k := range m {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return strings.Join(keys, " ")
+}
+
+// A node's mesh-cli subject names the node, and no other subject does.
+func TestTheMeshCLISubjectNamesItsNode(t *testing.T) {
+	if node, ok := CLINode(CLISubject("laptop")); !ok || node != "laptop" {
+		t.Fatalf("CLINode(%q) = %q %v", CLISubject("laptop"), node, ok)
+	}
+	for _, s := range []string{"mesh.control.laptop.report", "mesh.control..cli", "mesh.control.a.b.cli", "mesh.node.a.cli"} {
+		if _, ok := CLINode(s); ok {
+			t.Fatalf("%s was read as a mesh-cli subject", s)
+		}
+	}
+}
+
+// An answer larger than one bus message is cut to fit, and the cut is said.
+func TestALargeMeshCLIAnswerIsCutAndSaysSo(t *testing.T) {
+	a := CLIAnswer{Stdout: []byte(strings.Repeat("o", 200000)), Stderr: []byte(strings.Repeat("e", 1000)), Why: "the terminal"}
+	body := FitCLIAnswer(a, 64<<10)
+	if len(body) > 64<<10 {
+		t.Fatalf("the answer is %d bytes, over the bound", len(body))
+	}
+	var got CLIAnswer
+	if err := json.Unmarshal(body, &got); err != nil {
+		t.Fatal(err)
+	}
+	if !got.Cut || got.Why != "the terminal" || len(got.Stdout) == 0 || string(got.Stderr) != strings.Repeat("e", 1000) {
+		t.Fatalf("the cut answer is %+v", got)
+	}
+	if small := FitCLIAnswer(CLIAnswer{Stdout: []byte("ok")}, 64<<10); strings.Contains(string(small), `"cut"`) {
+		t.Fatal("an answer that fits was said to be cut")
+	}
+}
+
+// cliBus serves mesh-cli on a bus of the test's own with a call log of its own, and returns a connection to ask on.
+func cliBus(t *testing.T, l *CallLog, atOnce int, handle CLIHandler) *nats.Conn {
+	t.Helper()
+	conn, err := nats.Connect(testbus.URL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(conn.Close)
+	stop, err := OverNATS{Conn: conn}.serveCLI(l, atOnce, handle, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(stop)
+	return conn
+}
+
+// askCLI asks one request on a node's subject and reads the envelope.
+func askCLI(t *testing.T, conn *nats.Conn, node string, asked CLIAsked) (CLIAnswer, map[string]any, string) {
+	t.Helper()
+	body, _ := json.Marshal(asked)
+	msg, err := conn.Request(CLISubject(node), body, 5*time.Second)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var env struct {
+		Result json.RawMessage `json:"result"`
+		Error  string          `json:"error"`
+	}
+	if err := json.Unmarshal(msg.Data, &env); err != nil {
+		t.Fatalf("not an envelope: %s", msg.Data)
+	}
+	var a CLIAnswer
+	var raw map[string]any
+	_ = json.Unmarshal(env.Result, &a)
+	_ = json.Unmarshal(env.Result, &raw)
+	return a, raw, env.Error
+}
+
+// **A line that outlasts the bus's window for an answer is followed to its answer, never lost** (review of ADR
+// 0272): the first answer says it is running and names its call, and following the call by the same account on
+// the same node gives what the line printed once it ends. Another account, or another node, is told no such call.
+func TestALongMeshCLILineIsFollowedToItsAnswer(t *testing.T) {
+	was := AnswerWithin
+	AnswerWithin = 50 * time.Millisecond
+	t.Cleanup(func() { AnswerWithin = was })
+	release := make(chan struct{})
+	conn := cliBus(t, NewCallLog(), 4, func(ctx context.Context, node string, asked CLIAsked) CLIAnswer {
+		<-release
+		return CLIAnswer{Stdout: []byte("done on " + node), Terminal: true}
+	})
+	_, first, failed := askCLI(t, conn, "laptop", CLIAsked{Line: []string{"push", "laptop"}, Account: "op", UID: 1000})
+	call, _ := first["call"].(string)
+	if failed != "" || first["running"] != true || call == "" {
+		t.Fatalf("a long line was not answered as running with its call: %v %q", first, failed)
+	}
+	_, still, _ := askCLI(t, conn, "laptop", CLIAsked{Follow: call, Account: "op", UID: 1000})
+	if still["running"] != true {
+		t.Fatalf("following a running line answered %v", still)
+	}
+	close(release)
+	deadline := time.Now().Add(5 * time.Second)
+	for {
+		a, raw, failed := askCLI(t, conn, "laptop", CLIAsked{Follow: call, Account: "op", UID: 1000})
+		if failed != "" {
+			t.Fatalf("following answered %q", failed)
+		}
+		if raw["running"] != true {
+			if string(a.Stdout) != "done on laptop" || !a.Terminal {
+				t.Fatalf("followed to %+v", a)
+			}
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("the line never finished for its follower")
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	if _, _, failed := askCLI(t, conn, "laptop", CLIAsked{Follow: call, Account: "agent", UID: 1001}); failed == "" {
+		t.Fatal("another account followed the operator's line")
+	}
+	if _, _, failed := askCLI(t, conn, "desktop", CLIAsked{Follow: call, Account: "op", UID: 1000}); failed == "" {
+		t.Fatal("another node followed the line")
+	}
+}
+
+// Lines running at once are bounded: one over the bound is answered busy at once, and nothing ran.
+func TestMeshCLILinesAtOnceAreBounded(t *testing.T) {
+	was := AnswerWithin
+	AnswerWithin = 50 * time.Millisecond
+	t.Cleanup(func() { AnswerWithin = was })
+	release := make(chan struct{})
+	t.Cleanup(func() { close(release) })
+	ran := make(chan struct{}, 4)
+	conn := cliBus(t, NewCallLog(), 1, func(context.Context, string, CLIAsked) CLIAnswer {
+		ran <- struct{}{}
+		<-release
+		return CLIAnswer{}
+	})
+	if _, first, _ := askCLI(t, conn, "laptop", CLIAsked{Line: []string{"status"}, Account: "op"}); first["running"] != true {
+		t.Fatalf("the first line answered %v", first)
+	}
+	a, _, _ := askCLI(t, conn, "laptop", CLIAsked{Line: []string{"status"}, Account: "op"})
+	if !strings.Contains(a.Refused, "busy") || a.Exit == 0 {
+		t.Fatalf("a line over the bound answered %+v", a)
+	}
+	if len(ran) != 1 {
+		t.Fatalf("%d lines ran, one was bound", len(ran))
+	}
+}
+
+// A mesh-cli line's record keeps its first word, never the rest of its line, and its answer is never kept on the
+// bus, where `calls` answers anyone who may call the seat.
+func TestAMeshCLIRecordKeepsNeitherItsLineNorItsAnswerOnTheBus(t *testing.T) {
+	l, a := NewCallLog(), newAnswers(t)
+	writes := make(chan Call, 4)
+	l.writes = writes
+	asked, _ := json.Marshal(CLIAsked{Line: []string{"settings", "set", "x", `{"password":"s3cret"}`}, Account: "op"})
+	l.serveCall(CLISeat, "laptop", asked, "_INBOX.node.laptop.abcdefghijklmnopqrstuv",
+		func(context.Context, json.RawMessage) (any, error) {
+			return CLIAnswer{Stdout: []byte("s3cret-join")}, nil
+		},
+		a.respond, nil)
+	_ = a.only()
+	close(writes)
+	for c := range writes {
+		if carries(c.Args, "s3cret") || carries(c.Answer, "s3cret-join") {
+			t.Fatalf("the bus was sent %s / %s", c.Args, c.Answer)
+		}
+		if !strings.Contains(string(c.Args), "settings") || !strings.Contains(string(c.Args), `"op"`) {
+			t.Fatalf("the record does not say what was asked and by whom: %s", c.Args)
+		}
+	}
+}
+
+// `calls` answers anyone who may call the seat, agents among them: a mesh-cli line's answer is never shown there,
+// even from the memory of the controller that ran it; every other call's is (review of ADR 0272).
+func TestCallsNeverShowsAMeshCLILinesAnswer(t *testing.T) {
+	l, a := NewCallLog(), newAnswers(t)
+	asked, _ := json.Marshal(CLIAsked{Line: []string{"token", "issue", "x"}, Account: "operator"})
+	l.serveCall(CLISeat, "control", asked, "_INBOX.node.control.abcdefghijklmnopqrstuv",
+		func(context.Context, json.RawMessage) (any, error) {
+			return CLIAnswer{Stdout: []byte("s3cret-join")}, nil
+		},
+		a.respond, nil)
+	_ = a.only()
+	recent, _ := l.Recent()
+	shown, found, err := l.Shown(recent[0].ID)
+	if err != nil || !found {
+		t.Fatalf("the line is not shown at all: %v %v", found, err)
+	}
+	if carries(shown.Answer, "s3cret-join") {
+		t.Fatalf("calls shows a mesh-cli line's answer: %s", shown.Answer)
+	}
+	b := newAnswers(t)
+	l.serveCall("mesh-controller", "status", nil, "_INBOX.x.abcdefghijklmnopqrstuv",
+		func(context.Context, json.RawMessage) (any, error) { return "all well", nil }, b.respond, nil)
+	_ = b.only()
+	recent, _ = l.Recent()
+	if shown, _, _ := l.Shown(recent[0].ID); !strings.Contains(string(shown.Answer), "all well") {
+		t.Fatalf("another call's answer is withheld: %s", shown.Answer)
+	}
+}
+
+// carries says whether a record holds a secret as text or as the base64 JSON writes bytes in: a line's output is
+// bytes, so a search for its text alone finds nothing whatever the record keeps (review of ADR 0272).
+func carries(body []byte, secret string) bool {
+	return strings.Contains(string(body), secret) ||
+		strings.Contains(string(body), base64.StdEncoding.EncodeToString([]byte(secret)))
+}
+
+// The two tests above hold what they claim: each fails when the protection it names is taken away.
+func TestTheWithholdingTestsHoldSomething(t *testing.T) {
+	// The answer as a mesh-cli line's record would carry it, were it kept: the search finds it.
+	body, _ := json.Marshal(map[string]any{"result": CLIAnswer{Stdout: []byte("s3cret-join")}})
+	if !carries(body, "s3cret-join") {
+		t.Fatalf("a record carrying the answer is not found carrying it: %s", body)
+	}
+}

internal/link/protocol.go

@@ -8,6 +8,7 @@ package link
 
 import (
 	"encoding/base64"
+	"github.com/novox/mesh-host/rootsearch"
 	"strconv"
 	"strings"
 	"time"
@@ -420,6 +421,29 @@ const LivenessContract = 1
 // because an older one parses strictly and would refuse the whole declaration for it.
 const ReadinessContract = 2
 
+// RootContract is the statement of an engine that also judges a user's declared `root` (novox/hq ADR 0266):
+// whether an account declared never to become root without a person can — uid 0, a group that grants root,
+// a sudo rule, a secret of the mesh it may read. Only to such an engine is the field sent: an older one
+// parses strictly and would refuse the whole declaration for it.
+const RootContract = 3
+
+// ReasonRoot starts the reason of an account verdict that found a way to root (ADR 0266); the node-engine's
+// own words (mesh-host internal/accounts ReasonRoot).
+const ReasonRoot = "can become root without a person"
+
+// ReasonRootPending starts the reason of an account verdict the node-engine cannot give yet because its search
+// for setuid programs, started when the engine started, has not finished: not judged yet, said as such, never a
+// pass. The node-engine's own words (mesh-host rootsearch.ReasonPending), read from it rather than copied.
+const ReasonRootPending = rootsearch.ReasonPending
+
+// RootSearchBound is the longest the node-engine lets one search for setuid programs run (mesh-host
+// rootsearch.Bound): the one value both read.
+const RootSearchBound = rootsearch.Bound
+
+// RootNever is the value of a user's `root`, and of a verdict's Root, that the account must never become
+// root without a person (ADR 0266).
+const RootNever = "never"
+
 // Health is one statement of a machine's long-running resources (to-be 48 §4): in every report, as the
 // event HealthSubject between reports on each change, and again every minute while one is not healthy.
 // The node-engine's own (mesh-host internal/link Health); a test on each side holds the field names.
@@ -550,6 +574,10 @@ type ResourceHealth struct {
 	// manager, and the account itself for a resource of kind KindAccount (novox/hq ADR 0254). Empty from an
 	// engine older than that, and for anything the machine's own manager or runtime runs.
 	Account string `json:"account,omitempty"`
+	// Root is "never" on a verdict of kind KindAccount whose account is declared never to become root
+	// without a person (novox/hq ADR 0266): the engine judged that too, and a healthy verdict says it cannot.
+	// Empty from an engine older than RootContract, and on every other verdict.
+	Root string `json:"root,omitempty"`
 }
 
 // HealthSaid is the health event's body: the machine and its statement. The machine is read from the

vendor/github.com/novox/mesh-host/internal/declaration/declaration.go

@@ -198,6 +198,12 @@ type File struct {
 	// by looking rather than by knowing which field won.
 	Sealed string `json:"sealed,omitempty"`
 
+	// Trusted is the catalogue's word on whether the settings this file's content took are trusted (novox/hq
+	// issue 339). It is the controller's to act on, and a controller takes it out before it sends a declaration.
+	// Accepted here, and nothing is done with it, so that a controller that passes it on — an older one, or one
+	// rolled back to — never costs a node its whole declaration. Not part of the file's digest.
+	Trusted *bool `json:"trusted,omitempty"`
+
 	// Secrets are sealed values put into Content where it says `${secret:name}`.
 	//
 	// **The one place a secret and a configuration meet, and it happens on the machine.** A
@@ -383,8 +389,25 @@ type User struct {
 	// has it not. On the account rather than on the unit, because it is the account's: two units of
 	// one account cannot disagree about it, and undeclaring one of them must not stop the other.
 	Linger *bool `json:"linger,omitempty"`
+
+	// Root says whether this account may become root without a person (novox/hq ADR 0266). "never"
+	// is the agents' own account: the login an agent session runs as on a machine where it must not
+	// reach root by itself. Empty asserts nothing, as Shell's does.
+	//
+	// **A statement the engine judges, never one it acts on.** The apply gives an account it creates
+	// no password, no sudo rule and no group beyond those declared, as it always has, and takes none
+	// away from one it finds: a sudo rule or a group granted by hand is a person's to remove, and a
+	// declaration that silently stripped them would be the mesh deciding what a person's machine
+	// grants. What "never" adds is the look: on every look the engine reads whether the account can
+	// become root by itself — by its uid, a group that grants root, any sudo rule, or a secret the mesh
+	// placed that it can read — and says it unhealthy while it can (internal/accounts), so the
+	// controller can tell a machine where it holds from one where it does not.
+	Root string `json:"root,omitempty"`
 }
 
+// RootNever is the one value Root takes besides empty: the account never becomes root without a person.
+const RootNever = "never"
+
 // Network is a named network on this machine.
 //
 // **A name and nothing else.** Not a driver, a subnet or a gateway: each of those is something a
@@ -478,6 +501,9 @@ func (u *User) validate(where string, _ bool) []string {
 	if u.Home != "" && !strings.HasPrefix(u.Home, "/") {
 		problems = append(problems, where+": a home directory is an absolute path")
 	}
+	if u.Root != "" && u.Root != RootNever {
+		problems = append(problems, fmt.Sprintf("%s: root is %q or absent, and %q is neither", where, RootNever, u.Root))
+	}
 	return problems
 }
 

vendor/github.com/novox/mesh-host/rootsearch/rootsearch.go

@@ -0,0 +1,19 @@
+// Package rootsearch holds what the node-engine's search for setuid programs and the controller that reads its
+// verdicts must agree on (novox/hq ADR 0266): how long one search may run, and the words a verdict starts with
+// while it has no answer. Public, so the controller imports these rather than keeps copies that could drift.
+package rootsearch
+
+import "time"
+
+// Bound is how long one search for setuid programs may run. It governs the whole search, the walk and the
+// package manager's answers together; the controller does not raise an agent account as not judged while the
+// first search after a start is within it.
+const Bound = 15 * time.Minute
+
+// The reasons of a root verdict the search could not answer yet.
+const (
+	// ReasonPending starts the reason while the first search since the engine started runs.
+	ReasonPending = "not judged yet (search running)"
+	// ReasonIncomplete starts the reason when no search has finished: one failed or ran out its bound.
+	ReasonIncomplete = "not judged (search incomplete)"
+)

vendor/modules.txt

@@ -75,9 +75,10 @@ github.com/nats-io/nkeys
 # github.com/nats-io/nuid v1.0.1
 ## explicit
 github.com/nats-io/nuid
-# github.com/novox/mesh-host v0.0.0 => git.novox.be/novox/mesh-host v0.0.0-20261007162834-56e2ebec4bac
+# github.com/novox/mesh-host v0.0.0 => git.novox.be/novox/mesh-host v0.0.0-20261009103656-1c61b72f354d
 ## explicit; go 1.26.0
 github.com/novox/mesh-host/internal/declaration
+github.com/novox/mesh-host/rootsearch
 github.com/novox/mesh-host/validate
 # go.uber.org/automaxprocs v1.6.0
 ## explicit; go 1.20
@@ -133,4 +134,4 @@ golang.org/x/text/width
 # golang.org/x/time v0.15.0
 ## explicit; go 1.25.0
 golang.org/x/time/rate
-# github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261007162834-56e2ebec4bac
+# github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261009103656-1c61b72f354d