Archived
Name the account agents run as on a node, and say whether it can become root (hq ADR 0266) #164
Assignees
agent-ace
agent-g14
agent-novox
agent-shanks
jschoubben
mesh-tools
miel.truyen
nox-agent
Clear assignees
agent-ace
agent-g14
agent-novox
agent-shanks
jschoubben
mesh-tools
miel.truyen
nox-agent
No Assignees
No due date set.
Dependencies
No dependencies set.
Reference: novox/mesh-controller#164
Reference in New Issue
Block a user
On the control node every agent session runs as the operator's account, which has passwordless sudo: any agent there can become root without a person. hq ADR 0266 (agents run under an account of their own, without sudo) decides an agent account per node; this is the controller's part.
What changes
node.agent_account,node.agent_account_home(empty = agents run as the operator account). No consolidated schema exists in this repository; migrations are the schema.Node.AgentAccount,AgentAccountHome,AgentHome();SetAgentAccountrefuses root, the node's operator account, a malformed login and a relative home; empty clears.mesh-controller node agent-account <node>reports;node agent-account <node> <account> [home]names;node agent-account <node> --clearclears. Not a verb and not a setting, so no agent can change it; thenodeverb still runs onlynode show(tested).node showsays whom agents run as and the verdict.${machine:agent-account}(the agent account, or the operator account when none is named),${machine:agent-home},${machine:agent-root}(neveronly for an account of the agents' own, else empty). A user resource'srootfield is substituted too.MESH_AGENT_ACCOUNT,MESH_AGENT_HOMEbesideMESH_OPERATOR_*; reserved, a bundle may not set them.link.ResourceHealth.Root(root),link.RootContract = 3,link.ReasonRoot. A user'srootis sent only to an engine whose newest statement is contract 3 or later, and only when it saysnever; an older engine parses strictly and is not sent it.DA, kindagent-can-become-root, urgent, with plain words: every machine that names an agent account has it judged, on its engine's newest statement, unable to become root without a person. Anything not judged (no statement, an older engine, no verdict on that account, a verdict of unknown) fails. The judgement is one function,agentConfined, fornode show, the probe and later ADR 0259's router.Depends on mesh-host
The node-engine judges
root: neveron branchfeat/an-agent-account-never-becomes-root(mesh-host). This branch pins mesh-host at that branch's commit8390fab5cb35and vendors it, so D1's validator knows the field. After the mesh-host pull request merges, the pin must move to mesh-host's main commit (go mod edit -replace …andgo mod vendor) before this merges.Verified here
gofmt,
go vet ./..., and the whole suitego test -count=1 ./...against a local throwaway PostgreSQL 18: all pass (not under the race detector locally). New tests: inventory round trip and refusals, the facts' fallback andneveronly when distinct, the runtime env,rootstripped for an older engine and when empty, the judgement over every case, the probe raising and clearing, plain words, the snapshot pseudonym, and thenodeverb only showing.Delivery
novox/mesh-controller@e168b60159f7— superseded since 2026-10-09T10:56:47ZDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Transitions
The commit's note under
refs/notes/mesh-plankeeps every transition:git log --notes=mesh-plan.Merge check at
2d7d4d44mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on shanks as
build-1791477470452846257(builds --log build-1791477470452846257).Merge check at
d7b911famesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: FAIL — its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.62s)Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on g14 as
build-1791484791914080976(builds --log build-1791484791914080976).Merge check at
0df02f20mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: FAIL — its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.74s)Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on shanks as
build-1791485616650385069(builds --log build-1791485616650385069).0df02f20e1to874a2670faMerge check at
874a2670mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on ace as
build-1791486525309422142(builds --log build-1791486525309422142).Merge check at
10bbc591mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on novox as
build-1791487322812336862(builds --log build-1791487322812336862).Merge check at
10d8a9bemesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on ace as
build-1791487935528407222(builds --log build-1791487935528407222).10d8a9be9bto1d5a523a53Merge check at
1d5a523amesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on ace as
build-1791489299966716399(builds --log build-1791489299966716399).Merge check at
9b00d2ddmesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on g14 as
build-1791489360900150520(builds --log build-1791489360900150520).9b00d2ddf7to926dbd7a97Rebased onto main on 2026-10-09 (head
926dbd7).--through-verbflag is gone.plansline that acts is refused wherever its subcommand stands,retryincluded (plans --json go pis refused).settings set|clearthroughcommandstays first, and is now a terminal-held refusal. The read-only allow list follows it.homegets the machine facts too. Before this,node agent-account <node> <account> <home>stored a home that nothing used.sh merge-check.shpassed on the rebased head: race detector, the whole suite, against a local PostgreSQL 18.Merge check at
926dbd7amesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on shanks as
build-1791536859913357524(builds --log build-1791536859913357524).Merge check at
d951f22cmesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on shanks as
build-1791540770800074701(builds --log build-1791540770800074701).Merge check at
e168b601mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on g14 as
build-1791542265088884237(builds --log build-1791542265088884237).