Do not raise agent-can-become-root while the first setuid search is within its bound (hq ADR 0266, note E) #175

Merged

mesh-admin merged 2 commits from fix/a-search-not-finished-after-a-restart-is-not-urgent into main

2026-10-09 10:56:15 +00:00

Author	SHA1	Message	Date
jochen	2e1a9abbf7	Count the quiet after a restart from when the controller first saw the search pending mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it… Details mesh/repo-check pass: its merge-check.sh passed Details mesh/delivery covered after its failure: a later walk that contains it was delivered: plan-1791658180097457523 (novox/mesh-controller at a2a671ad into ma… Details The node-engine's own since starts again at every restart, so an agent that restarted the engine in a loop kept agent-can-become-root quiet for ever (the review of 2026-10-09). The controller now keeps when it first saw the verdict waiting for the setuid search (migration 0085), forgets it at the next complete verdict, and raises once the engine's own bound has passed since; the bound and the pending reason are read from mesh-host's rootsearch.	2026-10-09 12:37:18 +02:00
jochen	d15eee61bb	Do not raise agent-can-become-root while the first setuid search is still within its bound After every node-engine restart the account verdict says not judged yet until the engine's first search for setuid programs ends, and DA raised the urgent condition each time. The account stays unconfined and node show still says not judged; the condition is raised once the search fails, runs out its bound, finds a way to root, or the statement goes stale.	2026-10-09 12:37:18 +02:00

Author

SHA1

Message

Date

jochen

2e1a9abbf7

Count the quiet after a restart from when the controller first saw the search pending

mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it…

Details

mesh/repo-check pass: its merge-check.sh passed

Details

mesh/delivery covered after its failure: a later walk that contains it was delivered: plan-1791658180097457523 (novox/mesh-controller at a2a671ad into ma…

Details

The node-engine's own since starts again at every restart, so an agent that
restarted the engine in a loop kept agent-can-become-root quiet for ever (the
review of 2026-10-09). The controller now keeps when it first saw the verdict
waiting for the setuid search (migration 0085), forgets it at the next
complete verdict, and raises once the engine's own bound has passed since;
the bound and the pending reason are read from mesh-host's rootsearch.

2026-10-09 12:37:18 +02:00

jochen

d15eee61bb

Do not raise agent-can-become-root while the first setuid search is still within its bound

After every node-engine restart the account verdict says not judged yet until
the engine's first search for setuid programs ends, and DA raised the urgent
condition each time. The account stays unconfined and node show still says
not judged; the condition is raised once the search fails, runs out its bound,
finds a way to root, or the statement goes stale.

2026-10-09 12:37:18 +02:00