Answer mesh-cli: the control-node's operator is the terminal, everyone else is not (hq ADR 0272) #176

Merged

mesh-admin merged 3 commits from feat/272-answer-mesh-cli into main 2026-10-09 11:38:44 +00:00

Conversation 4 Commits 3 Files Changed 14

+1169 -31

3 Commits

Author	SHA1	Message	Date
jochen	ea1d3ed96d	Merge main (hq ADR 0266) into the mesh-cli answer, and close what the confirmation review found ... - The generic command verb only reads now (commandReads) and terminal-only commands are refused through any verb (terminalOnly). mesh-cli's ordinary line made neither check: `node account`, `token issue` and `secret export` from another node would have run. It now meets both, in the one function the command verb shares. - The serving controller marks itself and its children never the terminal (ADR 0266); a line mesh-cli runs as the terminal drops that mark and carries MESH_CLI_TERMINAL, so it reads as the terminal it is. - Two withholding tests searched the answer's text while JSON writes bytes as base64, so they held nothing. They search both now, each proved by disabling what it guards (Shown, the bus withholding, `calls` via Get). - The control-node refusal is tested through the assign and unassign acts.	2026-10-09 13:08:48 +02:00
jochen	0c47f48537	mesh-cli lines are calls, followed to their answer; the terminal does not follow assign (review of hq ADR 0272) ... - A line ran past the bus's one-minute window for an answer and its answer was refused; mesh-cli then said nothing ran of a line that had. Every line is now a call (calls.go): answered within AnswerWithin that it is running, with its call, and followed by the same account on the same node until it ends. Its record keeps the command word only, and its answer stays in the memory of the controller that ran it — never on the bus, never in `calls`, which answers anyone who may call the seat. Each line is said in the journal with its call, who asked where, and how. - Lines running at once are bounded (8); one over is answered busy. - An ordinary `settings` line is composed as the settings verb composes its own and meets that verb's refusals, the terminal-only keys among them, instead of the generic command's blanket refusal. - The controller's module is assigned and unassigned at the terminal only: where it runs is the control-node, whose operator is the terminal. - mesh.control.*.cli is in the writers table as the machine's own.	2026-10-09 12:48:12 +02:00
jochen	b1897a3498	Answer mesh-cli: the control-node's operator is the terminal, everyone else is not (hq ADR 0272) ... The records send the operator to "the controller's terminal", and nothing reached it (hq issue 343). The serving controller now answers each node's mesh.control.<node>.cli, where only that node's engine may publish, with the account the engine read from the kernel. A line from the control-node's operator account runs as the terminal: a fresh process of this binary with no MESH_VERB, whatever the serving process carries. The same account on any other node, where agents may run as it, is an ordinary call: the generic command verb's refusals (one function now, so the two routes cannot drift) and MESH_VERB=mesh-cli, so a terminal-only change is refused with its reason. Any other account, root included, runs nothing. Servers are never run, and an answer over one bus message is cut and says so. The terminal-only refusals and the usage now name mesh-cli on the control-node as the way to the terminal.	2026-10-09 12:10:24 +02:00