Issue 339: places and accesses only at the terminal, never at the machine's own trees; a setting is one line #168

Merged

mesh-admin merged 1 commits from fix/339-places-and-accesses-are-the-terminals into main

2026-10-08 22:21:02 +00:00

Author	SHA1	Message	Date
jochen	f5824b31c6	Keep places and accesses at the terminal, and refuse a line break in any setting mesh/delivery delivered Details mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it… Details mesh/repo-check pass: its merge-check.sh passed Details Through the settings verb, or a settings line run by the generic command verb, any caller of the mesh's console could place a module's directory at /etc with an owner of its own and have the node-engine, as root, hand it over at the next push, or mount any of the machine's paths into a container (hq issue 339). A change to either key is now refused in every process a verb runs, the generic verb refuses settings writes outright, and neither key may name the machine's own trees from anywhere, the terminal included. A line break, carriage return or NUL in any setting, which a file it is written into reads as a line of the caller's own, is refused where a layer is kept and where it is composed; PEM blocks alone may hold lines.	2026-10-08 23:58:08 +02:00

Author

SHA1

Message

Date

jochen

f5824b31c6

Keep places and accesses at the terminal, and refuse a line break in any setting

mesh/delivery delivered

Details

mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it…

Details

mesh/repo-check pass: its merge-check.sh passed

Details

Through the settings verb, or a settings line run by the generic command
verb, any caller of the mesh's console could place a module's directory at
/etc with an owner of its own and have the node-engine, as root, hand it
over at the next push, or mount any of the machine's paths into a container
(hq issue 339). A change to either key is now refused in every process a
verb runs, the generic verb refuses settings writes outright, and neither key
may name the machine's own trees from anywhere, the terminal included. A
line break, carriage return or NUL in any setting, which a file it is
written into reads as a line of the caller's own, is refused where a layer
is kept and where it is composed; PEM blocks alone may hold lines.

2026-10-08 23:58:08 +02:00