node hand-over: the terminal hands a directory used as found to the mesh, asked of the node's engine (hq issue 356) #187
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: novox/mesh-controller#187
Reference in New Issue
Block a user
hq issue 356 (hq pull request named in the thread once open); the engine's side is mesh-host #74, the catalogue's check mesh-catalog #165. A module's condition told the operator to run the node-engine's
hand-overat the machine, as root (issue 339), the mesh had no channel for it, and the engine on the machine's PATH was a build from before the subcommand (the engine's PR fixes that).Reviewers' checklist
handOverLine(cmd/mesh-controller/nodes.go) takes exactly a node and a path: the node a name (not a flag, not empty) the inventory knows (NodeByName); the path absolute andfilepath.Clean(path) == path— no.., no doubled or trailing separator — before anything is asked. The engine judges the same values again and is the one that acts (mesh-host #74).AskHandOver(internal/link/handover.go) refuses an answer that is neither a record nor a refusal, and an unreadable one.node hand-overis anodesubcommand that is not innodeReads, soterminalOnlyrefuses it through every verb andordinaryLinethrough mesh-cli outside the terminal — no new rule, andTestAHandOverIsRefusedThroughEveryVerbholds it four ways (terminalOnly, the generic command verb's composition, the ordinary mesh-cli line, thenodeverb's composition). The ask goes onmesh.node.<node>.ask.hand-over: the controller'smesh.node.>publish grant, and the node's grant gains exactly its own subject and the right to answer what it was asked (AllowResponsesforKindNode; a person still has none). The golden composition (internal/broker/testdata/composed.conf) changed by exactly those two lines.TestAHandOverLineIsJudgedBeforeItIsAsked(ten refusals, the one acceptance),TestAHandOverNamesWhoAsked,TestAHandOverIsRefusedThroughEveryVerb,TestTheUsedAsFoundConditionNamesTheOperatorsLine(the module's health namesnox node hand-over <node> <directory>on the control-node, never the engine's binary, never a path; the condition's words are plain underconditions.PlainWords) (cmd/mesh-controller);TestTheHandOverAskAndAnswerKeepTheirFieldNames(held by the engine's twin),TestAHandOverIsAskedOfTheMachineAndItsAnswerComesBack(over a bus: the record and the refusal come back whole, a machine with no engine listening is said as not answering, an empty answer is refused, no bus is refused),TestAMachineHearsItsOwnHandOverAskAndMayAnswerIt(internal/link);TestOnlyWhatCanBeAskedMayAnswernow holds that a node answers its one ask and a person answers nothing (internal/broker).What changes
node hand-over <node> <directory>: judges the line, asks the node's engine with who asked (MESH_CALLER, as every verb's caller is recorded — " through mesh-cli on " — or "the controller's terminal"), prints the engine's answer and thatpush <node>applies it now.broker.AskHandOverSubject, the node's subscribe grant andAllowResponses;link.AskHandOverwith the field names the engine holds.noxline with the machine; the condition's "needs" line is plain (the line and the directory are in the summary and the evidence);nox-mesh-host overlay takeandenrolin the network command's and the lab's texts use the binary's real name (install-time acts, at the machine).Checks.
merge-check.shpassed locally on the merge result (this branch on top of main at1c7c385, after #184 and #185 merged): gofmt, vet,go test -race ./..., 26 packages ok. Not merged.Order. This first — it composes the node's grant; then mesh-host #74. The catalogue's and hq's PRs in any order. Live, after both:
nox node hand-over <control-node> <the messenger's data directory>on the control-node, then its next apply clears the messenger's condition.Delivery
novox/mesh-controller@081d9244d6dd— delivered since 2026-10-09T18:13:21ZDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Machines
Transitions
The commit's note under
refs/notes/mesh-plankeeps every transition:git log --notes=mesh-plan.The record: hq #256 (issue 356). The engine's side is mesh-host #74 (merge after this one), the catalogue's check mesh-catalog #165.
7ba3274408to9006c82393Merge check at
7ba32744mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on ace as
build-1791563824735966092(builds --log build-1791563824735966092).Merge check at
9006c823mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on novox as
build-1791563916409013292(builds --log build-1791563916409013292).Review addressed — head
081d924(b55a38c, merged with main at7477346).Forgeable ask (blocking).
link.SignHandOversigns the ask with the mesh's identity key (open.Identity, the key declarations are signed with) overHandOverContext("novox-mesh hand-over v1\n") + the ask's bytes, so the signature is never a declaration's. The ask is{node, path, by, expires (now+1m), nonce (16 random bytes, hex)}, sent asSignedHandOver{ask, signature}. The engine verifies before reading (mesh-host #74).Writers table. New row "a hand-over asked of a machine",
mesh.node.*.ask.hand-over,Writes: isController(anddesignRows; to-be 45 §1 gains the row in hq #256). The false comment onAskHandOverSubjectnow says the subject bounds who is granted the publish and the signature who is believed.KindNode AllowResponses. Kept: the request/reply needs it, and it is bounded — the node is its machine's engine (root there already), it is delivered only its own subjects (declare, ask.report, ask.hand-over, its _DELIVER), max 1 / 1m, and the controller records nothing from the answer. Narrowing per subject is not something the server's permissions express.
Test gaps.
handOverAskedis the line with its two acts given:TestAHandOverAsksOnlyAKnownNodeAndFailsOnARefusal(unknown node → nothing asked; a refused line → nothing asked; the engine's refusal → error, nothing printed; a record → printed withnox push; a failing ask → error).TestAHandOverIsSignedWithAContextANonceAndAnExpiry,TestAHandOverAskHasOnePublisher(node, node tools, module refused at composition; the controller allowed).Mutations (each check removed, a test failed): sign context, nonce, expiry, no signer, signed body sent, neither-answer, known node, refusal-fails, line clean/abs/node, writers row, node subscribes, node answers — 14 of 14 killed.
merge-check.sh on the merge result
081d924: exit 0 (gofmt, vet,go test -race ./...).Merge check at
081d9244mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on g14 as
build-1791568027361874825(builds --log build-1791568027361874825).